Brain-Scanning Privacy Protections Get California Consideration

California would be one of the first states in the nation to put safeguards around brain-scanning technology under legislation being considered by state lawmakers.

The California measure (S.B. 1223) is similar to legislation in Colorado that is poised to be signed by Gov. Jared Polis (D). Both measures would establish privacy rights for consumers to protect their data from such devices and their software. Minnesota legislators also are considering stand-alone protections.

Lawmakers share the concerns of privacy advocates about a new arena of technology that is rapidly growing without regulations in place. Neural devices can include sleep-monitoring gadgets that track the brain’s electrical activity or interfaces that help physically disabled people move. Elon Musk’s Neuralink said in January that it had implanted its first brain-to-computer device, allowing one to use their thoughts to play games or complete other tasks on the computer.

Neural devices can monitor or manipulate brain activity, according to an article in the Frontiers in Systems Neuroscience. Such patterns in how one thinks or feels can be gathered and processed as data.

The goal is to force a national debate over regulating neurotechnology, and California is a crucial component given its status as the home to many Big Tech companies, Jared Genser, counsel for the Neurorights Foundation, said. The nonprofit group advocates for the technology’s ethical use.

“California is especially important because there’s enormous research, innovation, and development of companies in Silicon Valley in the field of neurotechnologies,” he said. “And the California Consumer Privacy Act is really viewed as one of the most important national consumer privacy laws.”

Gap in Privacy Protections

The foundation supports both the California and the Colorado measures, which would enshrine neural data into a more protected category of “sensitive personal information.” Consumers under the California bill would be able to limit the use and disclosure of their neural data alongside other privacy rights, such as opting out of the sale and sharing of their data.

Current law doesn’t entirely cover neural data, Genser said. Health privacy rules typically cover medical procedures such as neural surgical implants. A gap exists, however, with consumer devices used outside medical settings—such as headbands that help increase focus—that don’t have to comply.

The foundation plans to release a report soon on gaps between the privacy policies of 30 neurotech companies and existing privacy standards. The risk of companies improperly using and sharing brain data is already here, Genser said.

Advancements in artificial intelligence can further increase that risk, state Sen. Josh Becker (D) said. Becker is the bill’s author.

“One of our primary concerns with neurotechnology is that one day corporations will have access to vast repositories of brain scans that can be easily analyzed with the help of generative AI,” Becker said. “These analyses could reveal medical conditions or identify an individual against their will.”

The tech industry is watching the measure closely. Meta Platforms Inc. and Apple Inc. are eyeing the technology for products such as earphones that can measure brain activity. TechNet, which represents tech companies including Apple, remained neutral on the Colorado measure and is likely to do the same with the California bill.

The trade group simply wants to ensure the definition of neural data doesn’t apply too broadly, such as to devices that track only body movement like Fitbits.

Expanding ‘Sensitive’ Data

Genser said he hopes the California measure will pass without much opposition, noting how Colorado legislators passed their bill by overwhelming votes, with the Colorado Senate clearing the measure on a 34-1 tally.

“When you’re talking about neural data, you’re talking about really the most sensitive data that a person has,” he said. “All of who we are as humans is generated by our brains, as well as all our cognitive functions, our thoughts, our dreams, our fears, our memories, who we are as a person.”

If enacted, the Becker bill would be part of a growing movement where California and other states are expanding the definition of “sensitive personal information,” a level where such data receives more protections. California lawmakers added immigration status last year to that expanded definition. The California Privacy Protection Agency is considering minors’ data as a similar addition.

The trend will pose compliance challenges for businesses, which will have to build out systems to identify and provide more consumer rights for such sensitive personal data, Keir Lamont, director of US legislation at the Future of Privacy Forum, said. The group is a privacy think tank.

“There is a degree to which multiple states having different definitions of sensitive data can add complexity to the overall landscape to compliance programs,” Lamont said. “If you have to put in tweaks for different states, the privacy notices we encounter every day might actually get longer and longer.”