Your Brain Waves Are Up for Sale. A New Law Wants to Change That.

Consumers have become accustomed to the collection and resale of personal data, including email addresses, social contacts, browsing history, and genetic ancestry by the apps and digital services they use. Now, with the rise of consumer neurotechnologies, data collection is reaching more intimate levels, capturing brain activity for purposes such as meditation coaching, anxiety treatment, and enhancing dating app matches. Governor Jared Polis of Colorado signed a bill that, for the first time in the United States, aims to ensure the privacy of biological and neural data generated by the brain, spinal cord, and nervous system.

Quick Facts

• Colorado’s new law expands the definition of “sensitive data” to include biological and neural data
• It grants consumers the right to access, delete, and correct their data, as well as opt out of its use for targeted advertising
• Consumer-level brain technologies are the main target of the law

Consumers’ brains are now a focal point of data collection, with companies accessing records of users’ brain activity, including the electrical signals underlying thoughts, feelings, and intentions. The new law aims to protect people’s biological and neurological data, extending the same protections granted under the Colorado Privacy Act to other sensitive data. The legislation faced opposition but ultimately garnered bipartisan support, positioning Colorado as a pioneer in addressing data privacy related to consumer neurotechnologies.

The neurotechnology industry is poised for rapid expansion, with major tech companies such as Meta, Apple, and Snapchat getting involved. Investments in neurotechnology companies rose approximately 60 percent globally from 2019 to 2020, reaching about $30 billion in 2021. While these advancements have led to breakthrough treatments, concerns over the potential misuse and resale of sensitive neural data have prompted legislation and advocacy efforts to establish global standards for its protection. The new law in Colorado serves as a potential model for other states and may set the stage for future federal legislation, although its application is limited to certain types of consumer neurotechnology companies.

While the law has been hailed as a significant step forward, experts note that its scope may not cover all aspects of neural data collection and use, particularly for purposes other than identification. Advocacy groups are pressing for more stringent policies surrounding the collection, retention, storage, and use of all biometric data, including neural data. Tech companies, represented by organizations such as TechNet, have been involved in shaping the law, expressing concerns about its potential impact and advocating for specific focuses on regulating brain data used for identification.