A new frontier of data privacy in the US - your brain

Electronic devices that capture and analyse brain signals are becoming more mainstream, with brain-reading meditation apps, brain-computer video game interfaces and even attention-tracking headphones hitting the consumer market.

Meta, the owner of Facebook and Instagram, last month publicly tested an augmented reality interface where users navigate the world with neurological signals picked up from a wristband.

A law signed by California Governor Gavin Newsom in September will add new layers of protection for the kinds of data these devices capture.

It is one the most significant advances in privacy regulations for this emerging strata of consumer data, said Josh Becker, the state senator who authored the bill.

"This is a new frontier of privacy rights,” he told the Thomson Reuters Foundation.

The law defines neurological data as ”sensitive personal information,” a class of data that includes DNA, precise geolocation and other highly protected data in California.

According to Becker, companies will now have to disclose how they intend to use that data, and Californians will now be able to request companies delete it or direct them to limit sharing it, among other protections.

It will not bar companies from collecting the data or offering products and services that rely on it. "These are common sense restrictions,” he said.

California — the most populous US state and home to Silicon Valley — often sets the bar for national tech policy.

"We hope these new rights become the floor for how authorities look to regulate neural data going forward,” said Jared Gensler, a lawyer with the non-profit Neurorights Foundation, a privacy advocacy group that helped draft the legislation.

Brain rights go international

Efforts to protect neurological data have proliferated in recent years, as electronic devices available directly to consumers become capable of capturing medical-grade brain data similar to what neurologists would use to diagnose patients.

Experts at the Neurorights Foundation and other groups say sensitive data could be used to decode users' mental states without their permission.

Chile enacted legal and constitutional protection for brain privacy in 2021, and similar rules have been proposed in other Latin American countries, including Mexico, Brazil and Uruguay.

Last year, Chile’s Supreme Court became the first in the world to order a neurotechnology company to delete a user's data.

The UN Educational, Scientific and Cultural Organisation (Unesco) too is taking up the issue.

In August, a panel of Unesco experts released a new draft of recommendations for how countries around the world should devise legal protections for the brain in the face of rapid technology advances — particularly in artificial intelligence — that enable the reading and decoding of brain information.

State battles

The law in California came on the heels of a similar bill in Colorado, which was also backed by the Neurorights Foundation.

In both states, the laws saw pushback from tech industry groups, and there was significant disagreement among experts about what the law should cover.

Earlier in the year, the Neurorights Foundation released a report analysing the privacy policies of 30 consumer neurotech devices and found major privacy gaps. Half allowed companies to broadly share a user's brain data with third parties.