California Passes Groundbreaking Law to Protect Consumer's Brain Data

"They can't now intercept your thoughts, without your consent" says Bilawal Sidhu, our Honorary Tech Adviser.

California Enacts Law to Protect Brain Data

On 29th September 2024, California Governor Gavin Newsom signed a landmark piece of legislation aimed at safeguarding consumer brain data, marking a significant step in addressing the growing concerns around neurotechnology. As devices and applications that monitor brain activity become increasingly widespread, California has expanded its privacy protections to include "neural data" as sensitive personal information, akin to biometric data such as fingerprints or facial recognition. This law sets a global standard and reaffirms California's leadership in technology and privacy. "They can’t now intercept your thoughts without your consent," says Bilawal Sidhu, our Honorary Tech Adviser, based in Austin, Texas.

The Growing Role of Neurotechnology

Neurotechnology is rapidly evolving, with an increasing number of consumer products offering services to monitor brain activity, from meditation apps to focus-enhancing tools and devices for mental health treatment. These technologies promise to help users tackle cognitive issues like depression, anxiety, and attention disorders. But as these devices capture and store brain activity data—ranging from thoughts and emotions to intentions—they pose significant privacy risks. Neural data encodes highly sensitive information, making it more vulnerable to misuse by companies that collect, store, or share it with third parties for profit.

Senator Josh Becker, who sponsored the bill, said, “It’s important that we be up front about protecting the privacy of neural data—a very important set of data that belongs to people.” This emphasis on transparency and consumer rights reflects growing concerns about how data-driven businesses, especially tech giants like Meta and Apple, handle neural data.

Expanding the California Consumer Privacy Act (CCPA)

The new law amends California's existing Consumer Privacy Act (CCPA) by explicitly recognising neural data as "personal sensitive information." This expansion means that companies collecting brain data must adhere to stricter privacy standards. Consumers can now request to see what neural data is being collected, delete or correct it, and prevent companies from selling or sharing this data without explicit consent. By including neural data alongside other biometric data, such as DNA and facial images, the law ensures that consumer brain activity is protected under the same stringent conditions.

Unlike medical devices, which are regulated by federal health laws, consumer neurotechnology products have largely operated in a regulatory grey area. This gap has raised concerns about the unchecked collection of brain data. A report by the Neurorights Foundation revealed that most neurotech companies do not impose meaningful restrictions on their access to users’ neural data, and more than half of these companies explicitly allow data sharing with third parties. The new law seeks to close this loophole by bringing these products under the CCPA’s umbrella.

Privacy and Ethics Concerns

While the law is celebrated as a major leap forward in consumer privacy, some experts question its scope. Critics argue that the protections offered by the bill may still be too limited. Marcello Ienca, a professor of ethics in artificial intelligence and neuroscience at the Technical University of Munich, said that the law should focus less on the kind of data being collected—whether neural or not—and more on the types of inferences companies are able to make about individuals’ thoughts and emotions. “What matters is that you are doing a type of inference that is extremely infringing upon my privacy rights,” Ienca noted. He advocates for regulating the algorithms that analyse this data, as they present the biggest risk to consumer privacy.

Additionally, some have raised concerns about the inclusion of peripheral nervous system data in the law. TechNet, a coalition representing companies like Meta and OpenAI, argued that extending protections to the body's nerves, which transmit signals from the brain to the rest of the body, would “sweep too broadly and ensnare nearly any technology that records anything about human behaviour.” This criticism highlights the fine balance lawmakers must strike between protecting consumers and allowing space for technological innovation.

Implications for the Tech Industry

The impact of this legislation could ripple far beyond California’s borders. As a global leader in tech innovation, California’s actions often set the tone for national and international regulations. Neurotechnology is expected to play an even larger role in consumer markets in the coming years, and this law could serve as a blueprint for other states and countries. Already, similar legislation has been enacted in Colorado, and lawmakers in states like Florida, New York, and Texas are reportedly considering introducing comparable protections.

Rafael Yuste, a neuroscientist at Columbia University and chair of the Neurorights Foundation, emphasised the urgency of these measures. He explained that scientists are now capable of decoding people’s thoughts and feelings with startling accuracy. In one study, researchers were able to reconstruct images people had seen based on their brain activity. In another, scientists helped a paralyzed woman express speech and facial expressions through an avatar. “That which used to be science fiction, it’s actually not science fiction anymore,” Yuste stated, underlining the need for strict oversight in this rapidly advancing field.

A New Era for Consumer Privacy

California’s law represents a significant turning point in how society views and regulates brain data. As neurotechnology becomes more embedded in everyday life, the potential for misuse of neural data grows, making laws like this essential for safeguarding personal privacy. Owen Jones, a professor of law and biology at Vanderbilt University, commented on the broader implications of the law, stating, “I think this amendment strikes a good balance of trying to protect consumers while also allowing some space for businesses complying with the law to provide services that consumers want.”

By tackling neural data directly, California is laying the groundwork for future regulatory frameworks that could provide even more comprehensive protections in the evolving digital landscape. As a global leader in technology, this law may become the blueprint for safeguarding personal brain data worldwide. The implications extend far beyond current applications, potentially influencing technologies like Meta’s smart glasses, which could tap into personal data from the internet in far more profound and intrusive ways¹. This law aims to prevent such technologies from accessing our thoughts and cognitive processes without explicit consent, ensuring deeper protections in an increasingly connected world.

Acknowledgements

Adapted from multiple sources, including the New York Times article.

1.