This Week in Neurolaw: Your Brain Data Is Being Collected. The Law Is Just Starting to Catch Up.

Most people know that apps collect their location data, their search history, and their purchase habits. Far fewer people know that companies are now collecting something far more intimate: the electrical activity of their brains.

Consumer neurotechnology, including EEG headsets, brain-computer interfaces, meditation wearables, and focus-tracking devices, is a growing industry. As of early 2026, four states have classified brain data as sensitive personal information, with at least seven more bills advancing through state legislatures. [4] The technology is moving faster than the laws designed to govern it, and the gap between the two is where serious harm can happen.

Here is what the legal landscape actually looks like right now.

What states have done

California was among the first to act. Legislation expanding existing privacy protections to include neural data was signed into law by Governor Gavin Newsom, passing through both chambers of the state legislature in unanimous votes. [2] Colorado and Montana have passed similar laws. [1] Connecticut's SB 1295, most of which went into effect July 1, 2026, amended its data privacy law to clarify that neural data is sensitive personal information. [3]

But the definitions vary widely from state to state, and there is no federal standard. Active neural data bills are advancing in Virginia, Alabama, New York, Illinois, and Vermont, each taking a distinct regulatory approach. [4] The result is a patchwork of rules that companies can navigate around simply by operating across state lines.

What the data shows

The urgency behind these laws is not hypothetical. A report by the Neurorights Foundation found that 29 of 30 companies with neurotechnology products that can be purchased online have access to brain data and provide no meaningful limitations on that access. Almost all of them can share data with third parties. [1]

To put that plainly: if you have ever used a consumer EEG headset, a brain-training app, or a neurofeedback device, there is a reasonable chance your brain data has been shared with someone you did not intend to share it with, under terms you probably did not read.

Why this is a neurolaw issue

This might seem like a privacy story rather than a criminal justice story. But the two are closer than they appear.

Brain data can reveal patterns associated with mental illness, impulse control disorders, and neurological conditions. If that data can be collected by companies and shared with third parties, it can eventually be subpoenaed, used in civil proceedings, or accessed by law enforcement. The question of who owns your brain data and what it can be used for is a direct extension of the questions MoT covers every week: what does the law do with information about how your brain works, and does that use respect the complexity of what that information actually means?

As one researcher put it: "If you can decode your mental activity, then you can decode everything that you are, your thoughts, your memories, your imagination, your personality, your emotions, your consciousness, even your unconsciousness." [2]

The international picture

The United States is not leading on this. Chile became the first nation to amend its constitution to protect neurorights in 2021, requiring that technological development respect citizens' mental integrity and that the law specifically protect brain activity and the information derived from it. [4] Brazil, Mexico, and several European nations are advancing similar protections. The US response remains fragmented.

What to watch

The next major development to track is whether Congress moves toward a federal neural data standard or continues to leave this to individual states. A patchwork of 50 different state laws is not a solution. It is an invitation for companies to find the weakest link.

This is exactly the kind of issue neurolaw exists to address: the place where the science of the brain runs ahead of the legal frameworks designed to protect the people whose brains the science is studying.

This Week in Neurolaw is a recurring series tracking real developments at the intersection of brain science and the law. Have a case or story we should cover? Email info@mindontrial.org.

Sources

[1] KFF Health News. "States Pass Privacy Laws To Protect Brain Data Collected by Devices." February 18, 2026. kffhealthnews.org/mental-health/colorado-california-montana-states-neural-data-privacy-laws-neurorights/

[2] The Record. "Neural Data Privacy an Emerging Issue as California Signs Protections into Law." therecord.media/neural-data-privacy-california-law-yuste

[3] Future of Privacy Forum. "The Neural Data Goldilocks Problem: Defining Neural Data in U.S. State Privacy Laws." August 12, 2025. fpf.org/blog/the-neural-data-goldilocks-problem-defining-neural-data-in-u-s-state-privacy-laws/

[4] Inside BCI. "US States Build Patchwork of Neural Data Privacy Laws as BCI Market Accelerates." April 3, 2026. insidebci.com/policy/2026-04-03-us-states-build-patchwork-of-neural-data-privacy-laws-as-bci-market-accelerates/

[5] Neurorights Foundation. Consumer Neurotechnology Audit Report. 2024. neurorightsfoundation.org

[6] California Senate District 13. "Senate Overwhelmingly Approves Nation's Strongest Neurorights Bill." May 21, 2024. sd13.senate.ca.gov/index.php/news/press-release/may-21-2024/senate-overwhelmingly-approves-nations-strongest-neurorights-bill

[7] Risk Management Magazine. "State of Mind: The New Landscape of Neural Data Privacy Laws." February 24, 2026. rmmagazine.com/articles/article/2026/02/24/state-of-mind--the-new-landscape-of-neural-data-privacy-laws