On Saturday, California Governor Gavin Newsom signed a groundbreaking piece of legislation aimed at protecting consumers’ neural data, potentially setting a benchmark for similar regulations globally. This new law seeks to protect brain data collected by increasingly popular neurotechnological devices that are used in various consumer products designed to improve cognitive function, mental health, and overall well-being.
The legislation amends the current California Consumer Privacy Act to include neural data – data derived from brain activity and the nervous system – as part of “sensitive personal information.” This legal adjustment gives neural data the same level of protection as other types of sensitive data, such as biometric identifiers including facial recognition data, DNA, and fingerprints.
Sen. Josh Becker, a California Democrat who sponsored the bill, expressed enthusiasm for the law’s proactive approach to privacy. “Protecting our mental privacy is paramount, and this law ensures that the intimate details encoded in our neural data are treated with the utmost care,” he said.
The context for this legislation is California’s vibrant tech ecosystem, home to thousands of startups, including those developing neurotechnology, as well as major tech companies like Meta and Apple. These companies are at the forefront of technologies capable of collecting extensive neural data.
Reflecting on the significance of the law, Senator Becker highlighted the critical need for such protective measures in today’s technology-driven society. “This law sets a global standard for the protection of personal neural information,” he said.
The law grants people the right to access, correct, delete or limit how neurotech companies use their neural data. It also allows consumers to opt out of having their data sold or shared. This is especially relevant since, unlike medical devices, consumer neurotech devices have historically operated with minimal regulation.
Jared Genser, general counsel of the Neurorights Foundation, praised the legislation as significant progress. “With this law, California is making great strides toward safeguarding personal privacy in the digital age,” he noted. The Neurorights Foundation previously highlighted the need for such protections in a report that highlighted the lack of restrictions on access to neural data among neurotechnology companies.
Challenges remain, however, as some experts argue that the law should focus more on regulating inferences drawn from collected data, rather than simply categorizing the data itself. Marcello Ienca, a professor at the Technical University of Munich, suggested that a more effective regulatory approach could target the underlying algorithms used in data analysis.
Despite these discussions, the law marks a proactive step in addressing privacy concerns associated with emerging technologies, setting a precedent for future legislation both in the United States and internationally.
