Commercial neurotechnology cannot read your thoughts. The headsets sold today detect electrical signals on the scalp or measure blood flow in the cortex. They decode attention levels, emotional arousal, and simple commands like yes or no. They do not reconstruct sentences, images, or memories. The gap between what these gadgets actually measure and what their privacy policies permit is where the real story sits.
In April 2024, Colorado Governor Jared Polis signed HB 24-1058, an amendment to the Colorado Privacy Act that explicitly extends its protections to biological and neural data. Colorado became the first US state to include neural data in a comprehensive privacy law. The law defines neural data as information generated by measuring the activity of an individual's central or peripheral nervous systems that can be processed by or with the assistance of a device. That definition covers EEG headsets, fNIRS headbands, and any future wearable that reads nervous system signals.
No federal US law protects neural data. The Colorado amendment matters because it creates a regulatory floor. Other states are watching. The law treats neural data as sensitive personal information, which means firms must obtain explicit consent before collecting or sharing it. For an industry built on selling hardware and, often, the data it produces, that is a structural change.
What Consumer Neurotech Actually Decodes
The hardware reality
Invasive brain computer interfaces require surgery to implant electrodes in or on the brain tissue. They have been used in clinical trials to let paralyzed patients control cursors or robotic arms. Non-invasive wearables use electroencephalography or functional near-infrared spectroscopy to measure neural activity through the skull and scalp. They can detect changes in attention, relaxation, and emotional valence. They cannot read complex thoughts. The signal is too coarse, and the brain encodes language and imagery in distributed patterns that scalp electrodes cannot resolve.
Big tech steps back, then watches
Meta abandoned its BCI headset project in 2021. The firm had been developing a device that could detect neural signals through the scalp but concluded that the technical path to a useful product was too long. Apple filed a patent in 2023 for future AirPods with electrodes capable of measuring biosignals including EEG. The patent does not mean the product exists. It means Apple is exploring the possibility.
What the privacy policies actually say
In April 2024, the Neurorights Foundation analyzed the privacy policies of 30 non-invasive neurotech gadgets. It found that 29 of those policies allowed the maker to share neural data with third parties. Many did not provide meaningful encryption. The products in the study measured focus, stress, and sleep. The data they collect can be re-identified and used to infer medical conditions, personality traits, or cognitive decline. The technical limits of the hardware do not limit the market value of the signal.
Chile's Constitutional Ruling on Neural Data
A landmark court order
In August 2023, the Supreme Court of Chile ruled in favor of former senator Guido Girardi, ordering the neurotech firm Emotiv to delete his neural data. The case was the first time a court had ordered a brain-interface business to delete a user's brain data. Girardi had used an Emotiv headset and later argued that the outfit had not adequately informed him about how his neural data would be stored, processed, and potentially shared.
No special statute required
The Chilean court did not base its ruling on a specific neural data statute. Chile has no such law. Instead, the court applied existing constitutional protections for personal data and bodily integrity. The ruling established that neural data, even when collected by a commercial product, falls under the same legal protections as medical records or biometric identifiers. Emotiv complied with the order.
From academic concept to enforceable right
The case has been cited by neurorights advocates as a precedent for treating neural data as a fundamental rights issue rather than a customer data issue. Marcello Ienca and Roberto Andorno formally introduced the term neurorights in a 2017 paper published in Life Sciences, Society and Policy. The concept has since been taken up by the Neurorights Foundation and by lawmakers in several countries, but Chile's Supreme Court is the only judicial body that has enforced it directly.
Kernel's Bankruptcy and the Commercial Reality
A high-profile flameout
Kernel, a neurotech startup founded by Bryan Johnson, ceased operations and filed for Chapter 7 bankruptcy in April 2024. Its assets were acquired by a new entity named Flow Neuroscience. Kernel had raised more than USD 100 million to build non-invasive brain measurement devices. It shipped a product, the Kernel Flow, a wearable that used fNIRS to measure blood flow in the prefrontal cortex. But the business did not achieve market traction.
Why the signal wasn't enough
Kernel's failure is instructive. The technology worked in the sense that it could measure neural activity. The problem was that the signal was not useful enough for people to buy the device and not specific enough for clinicians to replace existing diagnostic tools. The startup had positioned itself at the intersection of wellness and neuroscience, but that market did not materialize at the price point required to sustain the business.
The clinical pivot
Flow Neuroscience, the acquirer, operates in a narrower space. It makes a device that uses transcranial direct current stimulation and an app to treat depression. That is a regulated medical device market with a clear value proposition. Flow's acquisition of Kernel's assets suggests that the future of non-invasive neurotech may lie in clinical applications rather than general wellness.
The Policy Gap and What Comes Next
State-level momentum
Colorado's HB 24-1058 is the first US state law to explicitly include neural data in a comprehensive privacy framework, but it is not the only legislative effort. California, Washington, and New York have introduced bills that would classify neural data as sensitive personal information. The US Congress has not passed a federal neural data privacy law. A proposed update to the Americans with Disabilities Act that would cover neural data has not advanced.
Twenty-nine out of thirty
The Neurorights Foundation's April 2024 report on 30 non-invasive products showed that 29 of them allowed data sharing with third parties. That figure is the policy reality. Businesses write privacy policies that permit data sale and sharing because no law prohibits it. The Colorado law changes the calculus for firms that operate in that state, but enforcement mechanisms and long-term effectiveness are not yet established.
Sensitive health data or a new category?
The question that remains unresolved is whether neural data should be classified as sensitive health information, which would place it under HIPAA in the United States, or as a new category of personal data with its own regulatory framework. HIPAA only covers data held by covered entities like hospitals and insurers. Most brain-sensing ventures are not covered entities. The Colorado approach, treating neural data as sensitive personal data under a general privacy law, is the most advanced model in the United States as of May 2024. Whether other states or the federal government follow that model will determine the trajectory of an industry that has not yet found its product-market fit.
Key Facts
- First US state to protect neural data: Colorado, via HB 24-1058 signed April 2024
- First court order to delete neural data: Supreme Court of Chile, August 2023, against Emotiv
- Consumer neurotech devices sharing data: 29 out of 30 analyzed by Neurorights Foundation, April 2024
- High-profile neurotech bankruptcy: Kernel filed Chapter 7 in April 2024, assets acquired by Flow Neuroscience
- Major platforms exiting BCI: Meta abandoned its consumer BCI headset in 2021
Frequently Asked Questions
Can consumer neurotechnology devices read my thoughts?
No. Non-invasive EEG and fNIRS headsets can detect attention levels, emotional arousal, and simple commands, but they cannot decode complex thoughts, sentences, or images. The signal is too coarse and the brain's encoding of language and imagery is too distributed to be resolved through the scalp.
What does the Colorado neural data law actually do?
HB 24-1058 amends the Colorado Privacy Act to treat neural data as sensitive personal information. Companies must obtain explicit consent before collecting or sharing neural data. The law defines neural data as information generated by measuring the activity of an individual's central or peripheral nervous systems, processed by or with the assistance of a device.
Is there a federal law protecting neural data in the United States?
No. The US Congress has not passed a federal neural data privacy law. A proposed update to the Americans with Disabilities Act that would cover neural data has not advanced.
What happened to Kernel?
Kernel filed for Chapter 7 bankruptcy in April 2024. Its assets were acquired by Flow Neuroscience, a company that makes a regulated medical device for treating depression using transcranial direct current stimulation.
