California law: California passes law protecting consumer brain data

A growing number of consumer technology products promise to help address cognitive issues: apps to meditate, to improve focus and to treat mental health conditions such as depression. These products monitor and record brain data, which encodes virtually everything that goes on in the mind, including thoughts, feelings and intentions.

The new law, which passed both the California Assembly and the Senate with no voter opposition, amends the state’s current personal privacy law — known as the California Consumer Privacy Act — by including “neural data” under “personal sensitive information.” This includes data generated by a user’s brain activity and the meshwork of nerves that extends to the rest of the body.

“I’m very excited,” said Sen. Josh Becker, a Democrat, who sponsored the bill. “It’s important that we be up front about protecting the privacy of neural data — a very important set of data that belongs to people.”

With tens of thousands of tech startups, California is a hub for tech innovation. This includes smaller companies developing brain technologies, but Big Tech companies such as Meta and Apple are also developing devices that will probably involve collecting vast troves of brain data.

“The importance of protecting neural data in California cannot be understated,” Becker said.

Discover the stories of your interest

The bill extends the same level of protections to neural data that it does for other data already considered sensitive under the California Consumer Privacy Act, such as facial images, DNA and fingerprints, known as biometric information. Users can now request, delete, correct and limit what data a neurotech company collects on them. They can opt out from companies selling or sharing their data.

Unlike medical devices, which must abide by federal health laws, consumer neurotechnology devices go largely unregulated, experts say.

An April report from the Neurorights Foundation, an advocacy group pushing for laws to protect people’s brain data around the world, including in California, examined policy documents of 30 companies and concluded almost all have access to their user’s neural data and do not have meaningful limitations to restrict access. More than half allow user data to be shared with third parties.

The new law is “a big step forward,” said Jared Genser, general counsel for the foundation, and follows similar legislation enacted in Colorado in April.