California Adds Neural Data to Consumer Privacy Law Protections

California updated its privacy law over the weekend to include protections for neural data, or information conveyed via a person’s nervous system. In the Golden State, consumers’ brain waves now receive the same level of protection afforded to other sensitive information, like genetic or geolocation data.

Governor Gavin Newsom approved the amendment to the California Consumer Privacy Act (CCPA) of 2018 on Saturday. Introduced on Feb. 15, the amendment tacks neural data onto a list of data types—personal, financial, geolocation, communication, genetic, and ethnic or religious—California residents can choose to limit, delete, or correct. The amendment specifies that neural data “means information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from non-neural information.”

Before Newsom could offer his signature, the amendment underwent a vote at the California State Assembly. Of the state’s 76 assemblymembers, 56 voted, all in favor of the amendment.

A lab technician holding a tray of Neuralink implants.
Credit: Neuralink

“This important change will protect your brain information from privacy violations,” said Rebecca Bauer-Kahan, an attorney and California State Assembly representative. “Devices are being made that will read your brain waves. And we want to make sure that’s protected.”

As simple as Bauer-Kahan’s comment is, it’s no exaggeration. Perhaps the most recognizable modern brain-computer interface is Elon Musk’s Neuralink, a series of implantable electrodes that use neural signals to drive a computer. The device was recently tested in a quadriplegic volunteer who proved capable of playing video games via Neuralink; now the company is in the early stages of its second trial. The controversial interface has inspired other neuroscience startups to introduce their own brain-reading systems, from those that “read minds” to those that control Amazon’s Alexa.

Under the amended CCPA, California residents have the right to be notified by any business that collects their neural data. As with any other form of CCPA-protected information, residents can limit the ways in which businesses use that data, opt out of the sale or sharing of their data, correct inaccurate information, and request data deletion. Nonprofit and government organizations are not required to comply with the CCPA.