Brain data protected by law

How far are laws that protect neural data from consumer brain devices?

Chile wrote protection for brain activity into its constitution in 2021, and in 2023 its Supreme Court ordered a consumer headset maker to delete stored brain data for one user. Colorado and California added neural data to their privacy laws in 2024. Montana did so in 2025, and InsideBCI lists Connecticut as a fourth state, with its year not confirmed. UNESCO's 2025 Recommendation asks governments to treat neural data as sensitive, but the page does not describe it as binding. The protections are narrow, enforcement is largely untested, and no EU or US federal rule names neural data specifically.

AI illustration · Illustrative scene, not a photograph of the specific device or experiment.
WHERE WE AREPilots

Close. Early pilots are running in the real world.

Legal protection for neural data is in force in a few places: Chile's constitution and Supreme Court ruling, four US states, and a UNESCO recommendation that asks Member States to act. Enforcement is thin. The sources reviewed report no regulator fine or enforcement action under the US state laws, and the Chilean court ruling was clearest on stored data only. Protection exists in a handful of jurisdictions rather than as a common regime, so the stage is pilot.

The tech tree

Everything recorded on Vrulum that this future needs, oldest foundations at the top and the goal at the bottom. Lines show what each step requires.

What it takes: Brain data protected by law Unlocked Being researched Locked
  1. 2019Brain-computer interfacesPilot and early commercial Unlocked.
  2. 2020Consumer brain-sensing wearablesPilot and early commercial Unlocked.
  1. 2021Constitutional protection for brain activity in ChileDone Unlocked.
  2. 2023Chilean Supreme Court orders a consumer headset maker to delete stored brain dataDone Unlocked.
  3. 2024Colorado and California add neural data to sensitive-data rulesDone Unlocked.
  4. 2025Montana and Connecticut add neural data rulesDone Unlocked.
  5. 2025UNESCO Recommendation on the Ethics of NeurotechnologyDone Unlocked.
  6. Date not recordedChile's implementing law for neurorightsIn progress Being researched.
  7. Date not recordedEnforcement under the US state neural data lawsNot started Locked.
  8. Date not recordedFederal law in the United StatesNot started Locked.
  9. Date not recordedNeural data named in EU lawNot started Locked.
  1. GoalBrain data protected by lawGoalRequires: Consumer brain-sensing wearables, Brain-computer interfaces, Constitutional protection for brain activity in Chile, Chilean Supreme Court orders a consumer headset maker to delete stored brain data, Colorado and California add neural data to sensitive-data rules, Montana and Connecticut add neural data rules, UNESCO Recommendation on the Ethics of Neurotechnology, Chile's implementing law for neurorights, Enforcement under the US state neural data laws, Federal law in the United States, Neural data named in EU law. Locked.

The road so far

5 of 9 steps done, 1 in progress.

  1. Done · 2021Constitutional protection for brain activity in Chile

    Law 21.383 amended Article 19 of Chile's Constitution. It adds a paragraph saying scientific and technological development must respect life and physical and psychological integrity, and that the law will regulate use on people, especially safeguarding brain activity and the information derived from it. Carey Abogados says the law was published on 25 October. The article is dated 2021, and the page's date header is ambiguous about the day and month. [1]

  2. Done · 9 Aug 2023Chilean Supreme Court orders a consumer headset maker to delete stored brain data

    On 9 August 2023 the Supreme Court ruled in a case brought by Guido Girardi Lavin against Emotiv, which sells the Insight headset. Stanford's 2026 analysis says the court ordered Emotiv to delete stored brain-activity data linked to the claimant, and that the ruling was clearest on storage. The authors of a 2024 Frontiers in Psychology paper say the ruling does not address neurophysiological identification or device security. [2][3]

  3. Done · 17 Apr 2024Colorado and California add neural data to sensitive-data rules

    Colorado HB 24-1058 was signed on 17 April 2024 and took effect on 7 August 2024. It adds biological data, which includes neural data, to the sensitive data category of the Colorado Privacy Act. California SB 1223 was chaptered as Chapter 887 of the 2024 Statutes on 28 September 2024. It adds neural data to the California Consumer Privacy Act's sensitive personal information category, and excludes information inferred from nonneural information. [4][5]

  4. Done · May 2025Montana and Connecticut add neural data rules

    Montana SB 163 became law on 2 May 2025 without the governor's signature, and took effect on 1 October 2025. It covers data from measuring central or peripheral nervous system activity and requires express consent before collecting, using or disclosing it, with separate consent before sharing with third parties. InsideBCI lists Connecticut among four enacted US state neural data laws and gives its effective date as 1 July. It does not give the year, bill number or signing date for Connecticut, and the enacted text was not read, so the Connecticut year is unresolved. [6][7]

  5. Done · 11 Nov 2025UNESCO Recommendation on the Ethics of Neurotechnology

    UNESCO's General Conference adopted the Recommendation on 11 November 2025 in Samarkand, at its 43rd session. Paragraph 85 says neural data and related data should be treated as sensitive personal data, and paragraph 49 requires prior, free and informed consent for collecting, processing or sharing neural data, with life-threatening medical emergencies as the only exception named. Paragraph 2 asks Member States to apply it through whatever legislative or other measures may be required. The page does not describe the Recommendation as binding. [8]

  6. In progressChile's implementing law for neurorights

    Stanford's April 2026 post names Bill 13.828-19 as the implementing law for Chile's neurorights. The bill had passed the Senate and, as of April 2026, was before the Chamber of Deputies, whose commission was still considering it and had scheduled expert hearings. [2]

  7. Not startedEnforcement under the US state neural data laws

    The sources reviewed report no state enforcement action under the Colorado, California, Montana or Connecticut neural data rules. InsideBCI does not say whether any has occurred. The main enforcement example found is the Chilean court ruling. [7]

  8. Not startedFederal law in the United States

    The federal MIND Act was introduced in late 2025. In the sources reviewed it had not moved beyond committee, and no federal neural data law is in force. [7]

  9. Not startedNeural data named in EU law

    The GDPR does not name neural data. Article 9 lists genetic data, biometric data and data concerning health as special categories, and neural data may fall under one of these, depending on how it is processed. No EU rule in the sources reviewed names neural data specifically. [10]

Why it matters

Consumer headsets and wellness devices now record brain signals outside clinics. The rules decide whether a company can keep, share or sell that data, and whether a person can refuse. The UN Secretary-General's 2026 report warns that brain signals recorded by consumer devices could one day be used as evidence in court, so gaps in these rules affect people well beyond the users of one device.

What stands in the way

  • Chile's constitutional protection still depends on an implementing law, which was before the Chamber of Deputies in April 2026.
  • The Chilean ruling was clearest on stored data. Stanford's analysis says courts do not by themselves identify a clear regulator for non-medical software that produces outputs from neural data.
  • State definitions differ. California excludes information inferred from nonneural data, while Montana covers central and peripheral nervous system activity.
  • No federal US law on neural data is in force, and the MIND Act had not moved beyond committee in the sources reviewed.
  • UNESCO's recommendation is not described as binding, and the UN Secretary-General's October 2026 report says neurotechnology is advancing faster than the laws meant to protect human rights.

Signals to watch

  • A vote in Chile's Chamber of Deputies on Bill 13.828-19, the implementing law for neurorights.
  • The first regulator fine or court order under the Colorado, California, Montana or Connecticut neural data rules.
  • Movement on the federal MIND Act beyond committee.
  • State neural data bills pending in March 2026, as reported by InsideBCI, such as Virginia HB 654 and New York S9008, reaching enactment.
  • Court or regulator decisions on whether outputs inferred from consumer devices, such as scores drawn from brain signals, count as neural data.

Sources

  1. news
    Law No. 21.383: Constitutional reform to establish the Scientific and Technological Development at the Service of the People is published
    Guillermo Carey. Carey Abogados, 2021.
  2. other
    Even Chile's Neurorights Leave Inferred Mental Data in a Gray Zone
    Bo Hyoung Lee. Stanford Law School, Law and Biosciences Blog, 27 Apr 2026.
  3. peer reviewed paper
    Chilean Supreme Court ruling on the protection of brain activity: neurorights, personal data protection, and neurodata
    María Isabel Cornejo-Plaza, Roberto Cippitani, Vincenzo Pasquino. Frontiers in Psychology, 27 Feb 2024.
  4. government report
    HB24-1058: Protect Privacy of Biological Data
    Colorado General Assembly, 17 Apr 2024.
  5. other
    SB 1223: Consumer privacy: sensitive personal information: neural data
    CalMatters Digital Democracy, 28 Sept 2024.
  6. news
    Montana on the Brain: A Bold Step for Neural Privacy
    Cooley LLP, 13 May 2025.
  7. news
    US States Build Patchwork of Neural Data Privacy Laws as BCI Market Accelerates
    Velco Dar (editor). InsideBCI, 3 Apr 2026.
  8. standard
    Recommendation on the Ethics of Neurotechnology
    UNESCO, 11 Nov 2025.
  9. news
    Could your brain data be used against you? UN calls for limits on neurotechnology
    UN News, 15 Oct 2026.
  10. standard
    Article 9 GDPR: Processing of special categories of personal data
    gdpr-info.eu, 27 Apr 2016.

Last reviewed 21 Oct 2026.