Colorado Passes America’s First Brainwave Privacy Bill

Colorado has become the first state in the US to pass a law that protects a user’s sensitive neural data. Colorado Governor Jared Polis approved a bill on April 17th, extending the same level of protection to brainwave data as is afforded to biometric data like fingerprints or facial images under the current privacy law.

The rationale behind introducing the bill was the swift advancement of consumer-level neurotechnology devices and their practices of gathering, storing, and trading consumer brainwave data.

For instance, from 2019 to 2020, global investment in neurotech increased by over 60%, according to one market analysis. In recent years, big tech companies have also made significant, profit-driven investments in developing mass-market proprietary neurotechnology products.

For instance, the first human brain chip implant by Elon Musk’s Neuralink enables users to manipulate a device using their thoughts. Others like Meta and Snap have been making significant investments in developing neural-linked augmented and virtual technology, too.

Developed for commercial uses, these products can help companies amass large stores of data that can be used for various purposes, including regenerating lost brain function. Despite the potential promise of neurotechnologies, one cannot underscore the adverse effects on data privacy and other potential risks.

“The things that people can do with this technology are great,” said State Representative Cathy Kipp, a primary sponsor of this legislation. “But we just think that there should be some guardrails in place for people who aren’t intending to have their thoughts read and their biological data used.”

The new Colorado legislation mandates that companies collecting neural data, especially through consumer products, must secure explicit consent from users prior to processing the acquired information from their brainwaves. Notably, this law excludes neurotechnologies in medical contexts, as they are already subject to regulation under health data privacy laws.

The Neurorights Foundation, which published a 100-page report on April 17 highlighting the privacy practices followed by neurotechnology companies, also supported the ratification of the Colorado bill.

Elsewhere around the world, several countries like Chile have either implemented or are taking steps towards implementing consumer protection laws on neural data.