Neural Data Privacy Laws: A Four-State Compliance Guide for Neurotech and Wearable Companies

Your meditation headband measures your brainwaves. Your sleep-tracking earbuds detect neural firing patterns as you drift toward REM. Your EEG-enabled focus app collects electroencephalogram data to score your attention levels. The data your product generates is unlike any other category of consumer information — it is, quite literally, a record of the activity of a human mind.

Four U.S. states have now enacted laws specifically designed to protect that data. Colorado, California, Connecticut, and Montana each treat neural information as a category of sensitive data deserving heightened legal protection. But the four statutes differ in meaningful ways: they define “neural data” differently, impose different consent models, cover different categories of companies, and carry different compliance obligations.

For a neurotech startup or consumer wearable company with users across state lines, navigating these divergent requirements is not optional — it is a current legal obligation. This post walks through what each state requires, how the frameworks differ, and what a unified compliance approach looks like.

Why Neural Data Is Different

Before turning to the legal frameworks, it is worth pausing on why neural data occupies a special category in privacy law.

Most categories of personal data — browsing history, purchase records, location data — are generated by observable external behavior. Neural data is different. It is generated by direct measurement of internal neurological activity. Depending on the sophistication of the measurement device, neural data can reveal cognitive states, emotional responses, levels of attention and distraction, early markers of neurological conditions, and patterns of thought that the individual may not be consciously aware of themselves.

That information is uniquely intimate. It cannot be changed the way a password can. It cannot be revoked the way consent to use a location history can. Neural data persists as a record of who you are, not merely what you have done. Legislators across the political spectrum have concluded that this category of data requires specific protection rather than reliance on general consumer privacy frameworks.

Colorado: The Pioneer — HB 24-1058

Colorado was the first state to explicitly extend the protections of a comprehensive state privacy law to neural data, doing so through House Bill 24-1058, signed by Governor Polis on April 17, 2024, and effective August 7, 2024.

What Colorado Covers

Colorado amended its existing Colorado Privacy Act (CPA) to add “biological data” — including neural data — to the definition of “sensitive data.” The statute defines biological data broadly as:

Data generated by the technological processing, measurement, or analysis of an individual’s biological, genetic, biochemical, physiological, or neural properties, compositions, or activities or of an individual’s body or bodily functions, which data is used or intended to be used, singly or in combination with other personal data, for identification purposes.

Neural data is defined as information generated by the measurement of the activity of an individual’s central or peripheral nervous system that can be processed by or with the assistance of a device.

The critical qualifier in Colorado’s definition is the identification purpose requirement: the biological data (including neural data) must be “used or intended to be used for identification purposes” to trigger the heightened protections. This means that neural data collected purely for wellness feedback, without any identification component, may not be covered — though companies should not assume this interpretation without careful legal analysis of their specific use case.

Colorado’s Consent Model

Under the CPA, sensitive data cannot be processed without the consumer’s opt-in consent. Colorado’s consent standard is demanding: consent must be “freely given, specific, informed, and unambiguous.” Pre-checked boxes, broadly worded terms of service, and passive acknowledgments do not satisfy this standard.

Before collecting biological or neural data, companies subject to the CPA must also complete a data protection assessment — a documented analysis weighing the benefits of the data collection against the potential risks to individuals’ rights. This assessment must be available to the Colorado Attorney General on request.

Who Is Covered by Colorado’s Law

The CPA covers “controllers” — entities that determine the purposes and means of processing personal data — who either (a) do business in Colorado or (b) produce products or services targeted to Colorado residents, and who either (i) process the personal data of at least 100,000 Colorado consumers per year or (ii) process the data of at least 25,000 consumers and derive revenue from the sale of personal data. Colorado does not have a general revenue threshold exemption, unlike some other state privacy laws.

California: SB 1223 and the CCPA Framework

California amended its California Consumer Privacy Act (CCPA) through Senate Bill 1223, signed by Governor Newsom on September 28, 2024, and effective January 1, 2025.

What California Covers

SB 1223 adds “consumer’s neural data” to the CCPA’s definition of “sensitive personal information.” California defines neural data as:

Information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information.

The exclusion for inferred data is significant. If a device generates neural data directly — through EEG electrodes, implanted sensors, or wearable neural interfaces — that data is covered. But if a company infers cognitive states from non-neural inputs (such as typing speed, mouse movement, or voice analysis), that inferred data does not qualify as neural data under California’s definition, even if the inference concerns a neural or cognitive state.

California’s Consent Model and Use Limitations

The CCPA’s treatment of sensitive personal information is more nuanced than the opt-in regimes in other states. Under the CCPA as amended by the California Privacy Rights Act (CPRA), sensitive personal information triggers heightened protections primarily when it is used “for the purpose of inferring characteristics about a consumer.” In that use case, consumers have the right to limit the use and disclosure of sensitive personal information, and companies must provide a clear disclosure mechanism and honor opt-out requests.

For neural data collected for its own sake — to deliver a wellness feature, provide feedback, or enable a BCI function — the standard protections of the CCPA apply (transparency, access, deletion rights, sale opt-out), but the heightened sensitive information regime applies most directly when that data is used to draw inferences.

California also enacted final regulations in July 2025 (effective January 1, 2026) requiring mandatory cybersecurity audits for certain business categories and risk assessments for automated decision-making technology — an additional compliance layer for neurotech companies using AI to process neural data.

Who Is Covered by California’s Law

The CCPA applies to for-profit businesses that do business in California and meet at least one of three thresholds: annual gross revenue exceeding $25 million; buy, sell, receive, or share the personal information of at least 100,000 consumers or households per year; or derive 50% or more of annual revenue from selling consumers’ personal information. The CCPA’s revenue threshold means that some early-stage startups may not yet be covered — though if you share or sell neural data to third parties, the revenue-from-sale threshold may bring you in earlier than you expect.

Montana: SB 163 and the Genetic Information Framework

Montana took a different structural approach. Rather than amending a general consumer privacy law, the Montana Legislature passed Senate Bill 163 (effective October 1, 2025), which amends Montana’s existing Genetic Information Privacy Act (GIPA) to add neurotechnology data alongside genetic data.

What Montana Covers

Montana’s law covers “neurotechnology data,” defined as information capable of “recording, interpreting, or altering the response of an individual’s central or peripheral nervous system” to its external environment.

Montana’s definition is broader in one important respect: it covers data capable of altering neural responses, not just measuring them. This means that closed-loop neural devices — systems that read neural signals and deliver stimulation or feedback in response — are squarely within Montana’s coverage even when used in a purely therapeutic context.

Montana’s Consent Requirements

Montana’s framework is the most extensive of the four state laws. Entities collecting neurotechnology data must:

1. Provide clear, accessible privacy policies specifically describing the collection and use of neurotechnology data.
2. Obtain express consent from consumers before collecting neurotechnology data.
3. Obtain separate consent before using neurotechnology data for marketing purposes.
4. Obtain consent before conducting research using neurotechnology data.
5. Obtain consent before disclosing or transferring neurotechnology data to third parties.
6. Obtain consent before selling neurotechnology data.
7. Implement robust security programs protecting the data from unauthorized access.
8. Allow consumers to access, delete, and request destruction of their neurotechnology data.

The multi-consent structure is particularly demanding: a company cannot obtain a single omnibus consent at onboarding and rely on it for all subsequent uses. Each materially different use — marketing, research, third-party sharing, sale — requires its own consent.

Montana also contains a notable law enforcement provision: government agencies may not access DNA or neural technology data from private consumer databases without a search warrant or an investigative subpoena based on probable cause. This limits the risk that a neurotechnology company could be compelled to share user data with law enforcement without judicial authorization.

Deidentified neural data used for research purposes is expressly exempted from Montana’s requirements.

Who Is Covered by Montana’s Law

Montana’s statute is structured differently from the general consumer privacy laws in other states — it does not have the same employee count or revenue thresholds. Entities that collect neurotechnology data from Montana residents are covered regardless of business size. This is consistent with the structure of GIPA, which similarly does not contain revenue-based carve-outs. Small neurotech companies serving Montana users should not assume they are exempt.

Connecticut: SB 1295 and the LLM Disclosure Overlay

Connecticut Governor Lamont signed Senate Bill 1295 on June 24, 2025, amending the Connecticut Data Privacy Act (CTDPA) with provisions taking effect July 1, 2026.

What Connecticut Covers

Connecticut adds “neural data” to its definition of “sensitive data” under the CTDPA. Connecticut’s definition is narrower in scope than some other states: it covers information generated by measuring activity of an individual’s central nervous system — and notably does not extend to peripheral nervous system data. This is a meaningful distinction for peripheral neural interfaces and some wearable devices that capture peripheral rather than central nervous system signals.

Connecticut’s Consent Model

Under the amended CTDPA, sensitive data — including neural data — cannot be sold without the consumer’s consent. Processing neural data requires opt-in consent. The CTDPA’s consent standard follows the same “freely given, specific, informed, and unambiguous” formulation used in Colorado and other state laws.

Connecticut’s law also lowers the applicability threshold for the CTDPA generally: SB 1295 reduces the consumer data processing threshold from 100,000 to 35,000 consumers per year, pulling a larger set of mid-size businesses and regional companies into scope.

The LLM Disclosure Requirement — Connecticut’s Unique Contribution

Connecticut is the first state in the nation to explicitly require companies to disclose whether personal data — including neural data — is used to train large language models (LLMs). This requirement is addressed in detail in a separate post in this series (Post 100), but the key compliance obligation is worth noting here:

Under the amended CTDPA, privacy notices must include a “clear and conspicuous statement” disclosing whether the controller collects, uses, or sells personal data for the purpose of training LLMs — and must keep that disclosure current. The requirement applies regardless of whether the company currently engages in such activity (a company that does not train LLMs must say so).

For neurotech companies developing or planning to develop AI models trained on neural data, this disclosure requirement is highly material. The intersection of neural data and generative AI development creates compliance obligations that no other state has yet explicitly addressed — though other states are likely to follow.

Comparing the Four Frameworks: Key Differences

Building a Unified Consent Architecture

A neurotech or wearable company with users across all four states needs a compliance program that satisfies the most demanding requirements of each. The good news is that building to the most protective standards generally satisfies all four frameworks. Here is how to approach it.

Step 1: Map Your Data Flows

Before designing consent architecture, you need to know exactly what neural data you collect, how it is processed, where it is stored, what third parties receive it, and whether it is used for any secondary purposes (marketing, research, AI training). This mapping is foundational — you cannot design consent disclosures for uses you have not identified.

Step 2: Adopt a Multi-Purpose Consent Structure

Following Montana’s lead (the most demanding framework), separate your consent flows by purpose:

• Collection consent: before any neural data is collected.
• Marketing consent: before neural data is used in connection with advertising or marketing targeting.
• Research consent: before neural data is used in research studies, internal or external.
• Third-party sharing consent: before neural data is shared with any third party, including analytics providers, research partners, and cloud processors.
• Sale consent: before neural data is sold to any third party.
• LLM training consent: before neural data is used to train AI or machine learning models (Connecticut-required, best practice everywhere).

Each consent form must meet the “freely given, specific, informed, and unambiguous” standard applicable in all four states. Avoid bundled consents that sweep multiple purposes into one acceptance event.

Step 3: Draft a Neural Data-Specific Privacy Notice

General privacy notices are not adequate. Your privacy notice needs a neural data section that:

• Specifically identifies neural data as a category of sensitive data you collect.
• Describes what devices generate the data and how it is measured.
• Explains each purpose for which neural data is used.
• Discloses whether neural data is shared with or sold to third parties, and the categories of those third parties.
• Discloses whether neural data is used to train AI or LLMs (Connecticut-required; best practice for all states).
• Describes your security practices for neural data.
• Explains how consumers can exercise access, deletion, and correction rights.

Step 4: Build Consumer Rights Infrastructure

All four states grant consumers rights over their neural data. At minimum, you must provide mechanisms for:

• Access: consumers can request a copy of their neural data.
• Deletion: consumers can request deletion of their neural data.
• Correction: consumers can request correction of inaccurate neural data.
• Portability: where required, consumers can request their neural data in a portable format.
• Opt-out of sale: consumers can prohibit the sale of their neural data to third parties.

Step 5: Conduct Data Protection Assessments

Colorado specifically requires data protection assessments before processing sensitive data. California requires risk assessments for automated decision-making that involves sensitive data. Even where not explicitly required, conducting documented assessments before deploying neural data processing demonstrates the reasonable care that is central to legal defensibility.

Step 6: Implement Security Controls

Neural data is sensitive health-adjacent information. Your security program should reflect that. At minimum: encryption at rest and in transit, access controls limiting who within your organization can access raw neural data, audit logging of access to neural data, incident response procedures specifically addressing neural data breach scenarios, and contractual security requirements flowing down to third-party processors.

The Compliance Burden Is Worth It

Neural data privacy compliance is not cheap or simple. It requires legal analysis, product engineering to implement consent flows and rights infrastructure, and ongoing monitoring as laws continue to evolve — additional states are proposing neural data bills, and federal legislation through the proposed MIND Act may ultimately preempt or supplement state frameworks.

But the cost of non-compliance is higher. Colorado’s attorney general has enforcement authority over the CPA. California’s Privacy Protection Agency can bring enforcement actions and impose civil penalties. Montana and Connecticut have attorney general enforcement as well. And beyond regulatory exposure, companies that mishandle neural data face reputational damage that is disproportionately severe in a market where consumer trust in intimate data handling is the core of the value proposition.

For technology companies building products that interface with the human nervous system, thoughtful neural data privacy compliance is not just a legal obligation — it is a competitive advantage.

This post is for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. If you have questions about your specific situation, consult a qualified attorney.