Legislatures rarely move early. On neural data, three of them did. Colorado passed HB24-1058 in 2024, amending its consumer privacy act to require express consent before neural data is collected or used, separate consent or an opt-out before it goes to a third party, and a route for a person to have it deleted. California did the same through SB 1223, folding neural data into the categories its privacy act treats as sensitive. Montana went further from a different direction, adding neural data to its genetic information privacy act, effective October 2025. What is notable is not the content but the margins: these passed unanimously or nearly so, in a period when almost nothing does. A category of information most people have never heard of was given statutory protection by bipartisan votes in three states. Either those legislatures were persuaded that a capability exists worth regulating, or they were persuaded one is close enough that waiting was the greater risk. The record shows the votes. It does not show which of those two it was.
- Colorado HB24-1058 (2024): express consent to collect or use neural data; separate consent or opt-out for third-party disclosure; deletion route
- California SB 1223: neural data added to the sensitive categories of the state consumer privacy act
- Montana LC0005, effective October 2025: neural data added to the state genetic information privacy act
- All three passed unanimously or near-unanimously
Open questions
- A law existing does not establish that the harm it anticipates has occurred. Legislatures also regulate in advance.
- None of the three statutes names a specific incident as its cause, so the record cannot say what persuaded the votes.
- This concept does not address whether the definitions these laws use are technically adequate, which is itself contested.
References
- Colorado HB24-1058 — bill text
- States pass privacy laws to protect brain data — KFF Health News
- Who owns what your brain emits?
- We cannot prove which came first, the law or the system
The last link is method, and it applies directly here: this record cannot establish whether law followed capability or anticipated it.
Not independently verified
This concept reports enacted legislation. It does not establish that any neural data harm has occurred in any of the three states, nor what motivated any legislator's vote.
Topics: Proposed solutions · Technology · Law enforcement & government