Neural Data Privacy Bills Sweep Across US States as Consumer Brain-Reading Devices Outpace Federal Regulation
At least nine bills across six states have been introduced in 2026 to regulate the collection of brain and nervous system data, as consumer neurotechnology devices proliferate and the federal MIND Act awaits action in Congress.
A Wave of State Legislation
In the first weeks of 2026, lawmakers in at least six US states introduced nine bills aimed at regulating how companies collect, store, and sell data generated by measuring brain and nervous system activity. Alabama, California, Illinois, New York, Vermont, and Virginia have all put forward proposals that would impose consent requirements, purpose limitations, and deletion rights on what regulators increasingly call “neural data” — information that, unlike conventional biometrics, can reveal not just identity but what individuals think, how they think, and when they intend to act.
The bills arrive as the neurotechnology market accelerates toward a projected valuation exceeding $38 billion by 2032. Consumer-grade electroencephalogram (EEG) headbands, earbuds, and wristbands that monitor sleep, focus, and stress are already on the market, with roughly 30 different wearable neurotechnology devices available for consumer purchase. One meditation device maker, Muse, has collected over 100 million hours of consumer neural data, and Apple has filed patent applications for EEG scanners in future AirPods.
What the Bills Propose
The state proposals reflect several distinct regulatory strategies. Virginia’s HB 654 and Connecticut’s SB 5 fold neural data into existing privacy frameworks by classifying it as either biometric or sensitive data, which triggers heightened consent and protection requirements already on the books. Alabama’s HB 263 takes a different path, creating standalone protections that apply broadly to any entity maintaining or licensing neural data, with penalties of up to $3,000 per violation enforced by the state attorney general.
California’s AB 1883 targets the workplace specifically, restricting employers from using surveillance tools that collect neural data for performance evaluation or for inferring protected characteristics such as emotional state. Illinois’s SB 2994 folds neural data into the state’s existing Genetic Information Privacy Act, prohibiting insurers from using neurotechnology data in underwriting decisions and barring employers from requiring neural data collection, with statutory damages of up to $15,000 per intentional violation.
Vermont’s H 814 stands out for including a prohibition on what the bill terms “conscious bypass” — using brain-computer interfaces to manipulate a person’s brain activity without their awareness. The bill requires written informed consent for any collection of data through brain-computer interfaces and mandates data destruction within 10 days of consent revocation.
A Patchwork Without Federal Guardrails
Four states — California, Colorado, Montana, and Connecticut — have already enacted neural data protections, but their definitions and scope vary significantly. Colorado’s law applies only when neural data is used for identification purposes, while California’s extends to peripheral nervous system activity. Connecticut’s upcoming law, taking effect in July 2026, covers only the central nervous system, the narrowest scope among the four.
At the federal level, Senators Chuck Schumer, Maria Cantwell, and Ed Markey introduced the Management of Individuals’ Neural Data (MIND) Act in September 2025, which would direct the Federal Trade Commission to study the neural data landscape and recommend regulatory frameworks. The bill defines neural data as “any information obtained by measuring the activity of an individual’s central or peripheral nervous system through the use of neurotechnology” and would require the FTC to consult with the Office of Science and Technology Policy, the FDA, academic stakeholders, and civil liberties organizations.
However, the MIND Act calls for a study and recommendations rather than immediate binding rules, leaving the states as the primary arena for enforceable regulation. The existing federal framework offers limited coverage: HIPAA does not protect neural data collected by consumer devices outside clinical settings, and the FTC’s existing authority under the FTC Act has not been tested against neurotechnology companies.
Industry Concerns and the Privacy Gap
A 2024 report by the Neurorights Foundation found that 29 of 30 companies with consumer neurotechnology products had user agreements permitting unrestricted data downloading, use, and third-party transfer. Only one company, Unicorn, kept data locally without accessing it. The finding underscores the gap between the sensitivity of the data being collected and the protections currently in place.
Current consumer EEG devices can decode thought-to-text at roughly 10 to 15 words per minute at 40 to 50 percent accuracy, while implantable devices have reached 80 words per minute at 95 percent accuracy. Researchers project that wearable technology could approach implantable-level performance within three to four years, a timeline that adds urgency to the regulatory debate.
The emerging state-by-state approach mirrors the broader pattern of US data privacy regulation, where the absence of a comprehensive federal law has produced a patchwork of state requirements. For neurotechnology companies, the diverging definitions of neural data across jurisdictions — particularly disagreements over whether peripheral nervous system activity and inferred data qualify — create compliance complexity that could shape where and how products reach consumers.