The Colorado Senate voted unanimously Tuesday for what, if signed by the governor, would be a first-in-the-nation law to enshrine privacy rights for human brain waves.
The bill would update the state’s existing consumer privacy law to include biological data — including neural data — as a form of sensitive data deserving the highest privacy protections. The Senate Business, Labor & Technology Committee advanced it last week on a unanimous vote. The House passed the bill, sponsored by Rep. Cathy Kipp (D), overwhelmingly last month.
Giving the legislation final passage puts the state at the head of a nascent movement by state lawmakers to respond to growing concern about new consumer-grade wearable devices that can capture brain activity but are not covered by federal health privacy protections.
“Although this sounds a bit like an episode of ‘Black Mirror,’ it is not. We can go online today and buy these devices,” Stephen Damianos, director of technology and human rights at the Neurorights Foundation, told a Colorado Senate committee, referring to the British sci-fi television show that features neurotechnology.
Damianos said he and his colleagues are preparing to release a report that identifies at least 30 devices currently on the market that can collect neuro data. These include wearable hats, helmets and headbands primarily marketed in the wellness space for such purposes as guided meditation.
“These can actually scrape extremely sensitive information from us,” Damianos testified. “And we found that almost all of the companies can share your data with third parties.”
Read more: Next frontier in privacy protections: brain waves
While wearable devices are the primary focus now, there is growing concern about the future of implantable devices that could read and interpret a person’s inner-most thoughts and potentially even manipulate their behavior. Cutting-edge technologies already allow people who are paralyzed to communicate and control computers via devices that read their brain waves.
Neuralink, a company founded by Tesla and X owner Elon Musk, last week live streamed video of its first brain implant patient moving chess pieces on a computer using his brain. The patient, who is paralyzed from the shoulders down, received the implant in January. The Food and Drug Administration last year granted approval for Neuralink to test its implant in patients.
Columbia University researcher Rafael Yuste, the Neurorights Foundation’s chair and co-founder, testified in Colorado that he had experienced an “Oppenheimer moment” when his team was able to use neurotechnology to manipulate the brain activity of lab mice “to the point that we were running them like puppets.”
“I realized that whatever we can do in a mouse today, we can do in a human tomorrow, and that’s when I decided to become an advocate of the regulation of neurotechnology,” Yuste said.
California Sen. Josh Becker (D) introduced legislation similar to Colorado’s that would amend his state’s privacy law.
Jamie Daves, co-founder and board member of the Neurorights Foundation, said the bill would “make sure brain data is treated properly, so that scientists, entrepreneurs, investors, and consumers can have the certainty and trust necessary to advance innovations to help people even further and faster.”
A pair of neurodata rights bills have also been introduced in Minnesota but have not advanced.
Chile in 2021 was the first country to adopt a constitutional amendment protecting neural data rights. Neurorights laws have been proposed in other Latin American countries, including Argentina, Costa Rica, Colombia, Mexico and Uruguay, according to a recent blog post from the Future of Privacy Forum. The issue is under discussion in Europe, Israel and South Korea.
“I’m happy that this issue is getting a lot of attention … now as opposed to five years from now when it might be too late,” said Jameson Spivack, a senior policy analyst for immersive technologies at FPF who co-authored the blog post. “That said, I think that it’s important that whatever legislation is crafted should be done very carefully.”
Spivack said that while neurotechnology raises privacy concerns, it also holds promise for major breakthroughs that could improve wellness and quality of life, especially for people living with disabilities or chronic conditions.
Backers of the Colorado legislation agree. Sean Pauzauskie, a Fort Collins, Colo., neurologist, told lawmakers about a patient he called “Jane” who lost cognitive function due to a heart attack.
“Jane could certainly benefit from advances in neurotechnology,” Pauzauskie told the committee. “Devices on the market now that can collect her brain data and help guide her towards better mood, better sleep, better memory. The technology is here now.”
But, Pauzauskie warned, “I fear right now, without guardrails, that Jane could be exploited, identified or biased against in unprecedented ways based on brain data that she might share.”
Apple, Meta and others are developing neurotechnology devices and other brain-computer interfaces. At the Colorado Senate hearing last week, tech industry lobbyists said they were neutral on the bill but hoped for amending language to clarify how the law would apply to their member companies.
Ruthie Barko with the trade group TechNet warned that the bill could capture non-neural data and ensnare products that do not read neural activity as part of what she called a “just-in-case provision” in the legislation.
“We have to look at this bill and its potential impacts to everything from virtual reality, augmented reality, automated safety technologies, any device that measures or tracks a body movement,” Barko testified. “One day in the future perhaps your VR or AR headset will also be scanning your brainwaves, but they cannot do that now.”
Proponents of the bill say getting ahead of the technology is precisely their goal. Pauzauskie, who first brought the issue of neuro rights to Kipp earlier this year, described neurotechnology as being in the “dial-up” phase.
“We’re trying to get out ahead of any potential abuses,” Pauzauskie told the Senate committee. “Nobody wants to see any abuses of data that is this sensitive.”
This story was updated to reflect the Senate vote Tuesday.