States Move to Regulate Brain Data Collected by Wearable Consumer Devices

According to a CBS News report, Colorado, California and Montana have recently enacted measures to require safeguarding of such information captured outside of a medical setting.

A report by the Neurorights Foundation, which advocates for protections against the misuse of neurotechnology, found that 29 of 30 companies that sell consumer products that collect brain data “provide no meaningful limitations to this access.” Nearly all also sell or share such data with third parties.

In June, the American Medical Association adopted a resolution calling for “legislative and regulatory efforts to protect the privacy and security of individuals’ neurological data.” The resolution also opposed “any efforts to broaden the consensus medical definition of neural data to include data inferred from nonneural information gathered by biosensors (including biometric devices),” such as wearable fitness trackers or heartrate monitors.

While the current generation of neurotechnology devices collect fairly basic data, such as sleep states, data protection advocates worry that future advanced devices, such as AI-powered brain implants, could collect far more detailed and intimate information about cognitive states, CBS reports.

Read more: Crypto’s Big Week: House Votes Could Reshape Digital Asset Oversight

“If you collect the data today, what can you read from it five years from now, because the technology is advancing so quickly?” said Colorado Democratic state representative (now Senator) Cathy Kipp, who sponsored the state’s 2024 neural data protection bill while still in the House.

The issue gained urgency when it appeared Congress was poised to impose a 10-year ban on enforcing state laws regulating AI technology as part of the recently passed budget reconciliation bill.

The laws in Colorado, California, and Montana regulate the data being collected, not the devices themselves. But neurotechnology and AI go hand in hand, Sean Pauzauskie, a neurologist and medical director of the Neurorights Foundation told CBS News. “A lot of what these devices promise is based on pattern recognition. AI is really driving the usability and significance of the patterns in the brain data,” he said.

The ban on state laws was ultimately dropped from the budget bill before it was sent to President Trump for his signature.

Pauzauskie said he became concerned about the handling of brain and neurological data four years ago when he noticed that devices used by his epilepsy patients were also being sold directly to consumers online and would not be covered by Health Insurance Portability and Accountability Act (HIPAA) protections.

The Colorado, California and Montana bills were all passed unanimously, or with near unanimity, in a rare instance of bipartisanship.

“I want a very hard line in the sand that says, you own this completely,” Montana state Sen. Daniel Zolnikov, who sponsored his state’s neural data bill and other privacy laws, told CBS. “You have to give consent. You have the right to have it deleted. You have complete rights over this information.”