Connecticut just made brain and neural data a protected privacy category

A wave of consumer gadgets now reads signals that were once locked inside a person’s skull. Meditation headbands that track focus, earbuds that monitor sleep stages, and gaming controllers that respond to concentration all generate a stream of information drawn from the nervous system. As of July 1, 2026, Connecticut treats that stream as some of the most sensitive data a company can hold.

The change arrives through an expansion of the state’s existing privacy statute, which folds brain and nervous-system readings into the same protected tier as health records, precise location, and biometric identifiers. The result is one of the clearest legal statements yet that the electrical activity of a brain is not ordinary commercial data to be collected, packaged, and resold at will.

What the law now protects

Connecticut amended its Data Privacy Act to add neural data to the definition of sensitive information, a category that triggers the strictest handling rules in the statute. The law defines neural data as information generated by measuring the activity of an individual’s central nervous system, a scope that centers on the brain and spinal cord while deliberately excluding readings from muscles, organs, and skin, according to an analysis of the amendments by Recording Law. That boundary matters because it aims squarely at the emerging market for consumer neurotechnology rather than sweeping in ordinary fitness sensors.

Because the data is now classified as sensitive, companies cannot simply collect it by default. A business that processes brainwave readings from a Connecticut resident must obtain explicit opt-in consent before doing so, and residents gain rights to access, correct, delete, and port that information. The framework also lets people opt out of having their neural data fed into targeted advertising or automated profiling, extending the same controls that already apply to other sensitive categories under the state’s regime.

Why lawmakers singled out the brain

The concern driving the change is that neural signals can reveal far more than a user intends to share. Patterns in brain activity may hint at emotional states, attention, cognitive load, and early signs of neurological conditions, all inferred without a person ever typing or speaking a word. Privacy scholars warn that this makes neural data uniquely revealing, and that defining it precisely is difficult because the same sensors can capture both trivial and deeply personal signals, a tension the Future of Privacy Forum describes as the neural data definition problem.

The commercial context sharpens the stakes. Brain-computer interface products have moved from research labs into retail, and the companies building them collect readings that, unlike a password, cannot be changed if they leak. Legal analysts note that this permanence is part of why neural information is being grouped with biometrics, since both describe traits a person cannot easily reset, a parallel drawn out in commentary from Bass, Berry & Sims.

Part of a growing state patchwork

Connecticut did not act in isolation. Colorado and California moved first to classify neural data as sensitive, and other states have advanced or enacted similar measures, producing a patchwork of rules that varies in scope and definition from one jurisdiction to the next. Firms tracking the trend describe a rapidly expanding map in which the same neurotechnology product may face materially different obligations depending on where a customer lives, a fragmentation detailed in a survey of the landscape by Cooley.

That inconsistency is significant for companies and consumers alike. A device maker selling nationwide must reconcile Connecticut’s central-nervous-system definition with the differing language other states use, and a resident’s protections can shift the moment data crosses a state line. In the absence of a single federal standard for neural information, the state-by-state approach is likely to keep defining the rules for the foreseeable future.

What it means for people using neurotech

For a Connecticut resident wearing an EEG headband or sleep-tracking earbud, the practical effect is a set of enforceable choices that did not clearly exist before. Consent must be affirmative rather than assumed, so a device that wants to process brain readings has to ask first, and a separate consent is required before that data can be sold to a third party. The right to delete and to opt out of profiling gives users a way to pull their information back or keep it out of advertising systems.

The reach of the law is limited by geography and by the definition of a covered business, so not every product or every user falls under it. Still, the practical takeaway for anyone using consumer neurotechnology is that the terms of collection are now a live question rather than a foregone conclusion, and the consent screens and privacy settings on these devices carry real legal weight in the state. Reading those disclosures before pairing a new headset determines exactly how much of a person’s brain activity ends up in a company’s database.

The broader significance is that a category of information once confined to hospitals and research studies is entering everyday products, and at least one state has decided it belongs behind the highest privacy guardrails. Whether other jurisdictions converge on the same definition or continue to diverge will shape how neurotechnology companies build their products, and how much of the mind consumers are asked to hand over in exchange for convenience.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview