5 states. 0 federal laws.
Status as of September 14, 2026. 5 states have written neural data into statute; Vermont did it twice, once as a rights declaration with no enforcement and once inside a privacy act that takes effect in 2028. 9 bills in 6 states were introduced in the first six weeks of 2026. The federal bill is a study bill with no hearing. Arkansas has introduced nothing.
Enacted state law
| State | Bill | Signed | Effective | What it does | Definition of neural data | Enforcement |
|---|---|---|---|---|---|---|
| Colorado | HB 24-1058 (Session Laws ch. 68) | April 17, 2024 | August 7, 2024 | Amended the Colorado Privacy Act to add "biological data," expressly including neural data, to sensitive data. First state to do so. Opt-in consent before processing; access, deletion and correction rights; opt-out of sale, targeted advertising and profiling. | Information generated by the measurement of the activity of an individual’s central or peripheral nervous systems and that can be processed by or with the assistance of a device. | Attorney General and district attorneys. No private right of action. |
| California | SB 1223 (Stats. 2024, ch. 887) | September 28, 2024 | January 1, 2025 | Amended the California Consumer Privacy Act to add neural data to sensitive personal information. Consumers may limit use and disclosure to what is reasonably necessary; opt-out of sale or sharing; access, deletion and correction rights. | Information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information. | California Privacy Protection Agency and Attorney General. |
| Montana | SB 163 | May 1, 2025 | October 1, 2025 | Amended the Genetic Information Privacy Act to cover neurotechnology data. Express consent before collection, use or disclosure; separate consent for transfer to third parties, marketing, sale, disclosure to insurers or employers, and storage outside the United States. Passed 49 to 1 in the Senate and 99 to 0 in the House. | Information captured by neurotechnologies, generated by measuring the activity of an individual’s central or peripheral nervous systems, or data associated with neural activity, and that is not nonneural information. | Attorney General; actual and statutory damages. No private right of action. |
| Connecticut | SB 1295 (Public Act 25-113) | June 24, 2025 | July 1, 2026 | Amended the Connecticut Data Privacy Act to add neural data to sensitive data and removed the volume threshold for controllers that process sensitive data. Opt-in consent before processing; separate consent before sale. | Any information that is generated by measuring the activity of an individual’s central nervous system. Narrowest of the five; wrist-worn nerve-to-muscle sensing falls outside it. | Attorney General. No private right of action; no mandatory cure period. |
| Vermonttext to confirm | S. 71 (Act No. 145), Vermont Data Privacy and Online Surveillance Act | June 16, 2026 | January 1, 2028 | Vermont’s comprehensive consumer privacy law. Lists neural data among the categories of sensitive data that require consent before processing; access, deletion, correction and opt-out rights. | Activity measured from the central nervous system (paraphrase; verbatim statutory text not yet confirmed). | Attorney General exclusively; 60-day cure period through June 30, 2029. No private right of action. |
| Vermontrights statute | H. 814 (Act No. 101), 18 V.S.A. § 1891 | May 18, 2026 | On passage | Created a "Neurological Rights" chapter recognizing six rights, including mental and neural data privacy, freedom of thought, and protection from unauthorized access to or manipulation of brain activity. No definitions section, no obligations binding on private parties, no enforcement specified; the state AI Advisory Council reports by January 15, 2027. | None. The act has no definitions section. | None specified. |
Introduced, not enacted
The federal bill and the 2026 state bills, with where each one stopped.
| Jurisdiction | Bill | Status |
|---|---|---|
| United States | S. 2925, MIND Act of 2025 (Schumer; Cantwell, Markey) | Introduced and referred to Senate Commerce September 29, 2025. No hearing, no markup, no House companion as of September 14, 2026. A study bill: directs the FTC to examine neural-data governance and recommend standards. |
| California | AB 1883 (workplace surveillance tools) | Passed both chambers; presented to the Governor September 10, 2026, deadline September 30, 2026. Would bar employers from AI surveillance tools that collect neural data or identify a worker’s emotional state. |
| California | AB 1542 (CCPA amendment) | Passed the Legislature August 31, 2026; awaiting the Governor. Would prohibit the sale or sharing of sensitive personal information, including neural data. |
| Massachusetts | H.103, folded into the Massachusetts Data Privacy Act (S.2619) | Senate 40 to 0 (September 25, 2025); House 146 to 0 (June 4, 2026); in conference committee since June 17, 2026. Not enacted. |
| New York | S9088A (data broker registration; defines neural data) | Passed Senate 51 to 10 on June 3, 2026; died in the Assembly at session end. |
| Alabama | HB 263 (neural data from health and fitness apps) | Passed House 103 to 0 on February 26, 2026; died on the Senate calendar. |
| Illinois | SB 2994 and HB 5179 | SB 2994 died in committee (May 22, 2026). HB 5179 failed in House Judiciary-Civil, 3 to 14, March 26, 2026. |
| Arkansas | None | No neural-data bill has been introduced. Biometric data has been personal information under the Personal Information Protection Act since Act 1030 of 2019. |
Courts and the rest of the world
United States Supreme Court
Held that the government's acquisition of historical cell-site location records from a carrier is a Fourth Amendment search, rejecting the argument that a person gives up all privacy in data merely because a company holds it.
Chile
Amended Article 19 No. 1 of the Constitution so that scientific and technological development must "especially safeguard brain activity, as well as the information derived from it." Law 21.719 treats neurodata as sensitive personal data. In Girardi v. Emotiv (August 9, 2023) the Supreme Court ordered Emotiv to delete the plaintiff’s brain data.
UNESCO
Non-binding. Covers mental privacy and neural data, freedom of thought, the inviolability of the human mind, non-therapeutic use in children, and workplace monitoring.
European Union
Prohibits AI systems that infer the emotions of people in workplaces and schools from biometric data, with penalties up to EUR 35 million or 7 percent of global turnover. Transparency duties for emotion-recognition systems from August 2, 2026.
Why a written refusal matters while the law is unsettled
Each state law above turns on consent. A company that collects neural data from a resident of those states without consent has a compliance problem. A written refusal, delivered to the company's registered agent and signed for before any collection, is the clearest record of non-consent a person can create. In the 45 states without such a law, the same document fixes the date on which the company knew.
None of this is legal advice, and none of it predicts how a court would treat a notice. Ediflo.AI, LLC is not a law firm.