Neural Data, Inferred Beliefs, and the Limits of Cognitive Privacy Law in the United States

Full report

On this page

1. Answer and scope

The current perimeter of cognitive privacy law in the United States is defined by a rigid jurisprudential distinction between the biological measurement of nervous system activity and the algorithmic inference of mental attributes. An analysis of existing state protections and federal regulatory orders reveals that while newly enacted statutes in California and Colorado impose strict, dedicated legal safeguards over physically measured brainwaves and peripheral nervous system telemetry, the inference of a consumer’s internal beliefs or cognitive states from non-biological proxy data remains outside the statutory definition of "neural data." Instead, these algorithmic deductions rely on a fragmented patchwork of general sensitive personal information categories and federal prohibitions against deceptive and unfair data practices. This investigation resolves the central research question by defining where current U.S. protections attach to measured neural activity, inferred attributes, and private assistant histories, and identifying the structural gaps that persist. To examine the boundaries of these regimes, this analysis evaluates three primary instrument families: California’s SB 1223 amendment to the California Consumer Privacy Act (CCPA), Colorado’s HB24-1058 expansion of the Colorado Privacy Act (CPA), and the Federal Trade Commission’s (FTC) final enforcement order against InMarket Media, LLC regarding the commercialization of sensitive proxy location data1. The application of these rules is tested across four distinct technical capability cases: a conversational interface, a bounded task agent, a persistent operatorless service, and a hypothetical future machine principal. In all instances, legal status and technical capability function as independent variables. Present legal frameworks root privacy rights exclusively in human corporeal autonomy and biological integrity; the uncertainty surrounding the independent interests of hypothetical machine principals neither establishes machine rights nor resolves whether entirely new status-neutral protections are warranted4. When disaggregating the affected objects by operation, profound variations in compliance burdens emerge. The collection and identity linkage of measured neural data now trigger severe statutory duties, whereas the inference generation of inaccurate yet harmful cognitive profiles from ordinary assistant conversations often exploits regulatory blind spots.

2. Provision-level findings

An objective examination of recent statutory amendments and federal enforcement actions reveals a specific, highly targeted approach to securing mental privacy, while exposing the doctrinal limitations of treating the human mind merely as another biometric data point.

California Civil Code § 1798.140 (Amended by SB 1223)

California’s SB 1223, operative January 1, 2025, amends the CCPA by inserting "neural data" into the statutory definition of "sensitive personal information"2. Under Cal. Civ. Code § 1798.140(ae), sensitive personal information encompasses data points that carry a high risk of privacy harm, such as precise geolocation, genetic data, and health information7. The statutory inclusion of neural data is defined meticulously to target the physical output of neurotechnology: it is "information that is generated by measuring the activity of a consumer's central or peripheral nervous system, and that is not inferred from nonneural data"2. This definition establishes a rigid negative boundary. By expressly stating that neural data is not inferred from non-neural data, California law isolates the physical biological measurement from the downstream algorithmic inference. For example, if a business collects ordinary textual chat logs and uses natural language processing to infer a consumer's psychological disposition, that inference does not qualify as "neural data." However, exclusions must be read in tandem with the whole statute; an exclusion from the neural category may still leave other protections applicable. If that same language model infers clinical depression, the data qualifies as sensitive personal information under a separate prong governing "personal information collected and analyzed concerning a consumer’s health"7. The operative duties tied to this classification grant consumers the "Right to Limit the Use and Sharing of Sensitive Personal Information," transferring the burden to the business to restrict processing to essential, non-profiling service delivery9. The affected actors include all for-profit enterprises meeting the CCPA revenue or data-volume thresholds, and the private right of action remains strictly limited to security breaches, not general privacy violations7.

Colorado C.R.S. § 6-1-1303 (Enacted via HB24-1058)

Colorado has adopted a more expansive structural approach by defining a broad category of human biological telemetry. HB24-1058, effective August 7, 2024, introduces "biological data" as a highly protected subset of sensitive data within the Colorado Privacy Act1. The statute defines biological data as characterizations of the genetic, biochemical, physiological, or neural properties of a body5. Within this broader genus, "neural data" is explicitly defined as information concerning the activity of an individual's central or peripheral nervous systems—including the brain and spinal cord—that can be processed by or with the assistance of a device1. The legislative declaration of HB24-1058 highlights the specific normative concern driving the statute. The legislature recognized that neurotechnologies raise pressing privacy concerns because of their capacity to "monitor, decode, and manipulate brain activity," noting that such data always involves the "involuntary disclosure of information" since individuals cannot consciously censor the full spectrum of their neurological emissions5. The operative duty in Colorado is consequently more protective than California's limitation mechanism: processing sensitive data requires affirmative, opt-in consent from the consumer1. The territorial trigger applies to entities conducting business in Colorado or producing products targeted at its residents, establishing a high compliance floor for any consumer neurotechnology deployed within the state.

FTC Final Order: In re InMarket Media, LLC (2024)

While state laws tackle direct biological measurement, the Federal Trade Commission has actively policed the commercialization of inferred cognitive, religious, and behavioral states utilizing proxy data. In the InMarket Media matter, a review of the complaint and final order separately delineates the FTC's enforcement mechanism3. The FTC alleged that the respondent, a data aggregator, collected, used, and stored precise consumer location data, mapping it to persistent mobile advertising identifiers (MAIDs) without adequately disclosing its marketing uses—an act deemed unfair and deceptive under Section 5 of the FTC Act12. The resulting Decision and Order creates a stringent regulatory architecture for proxy inferences, though it cannot be interpreted as a universal statutory rule3. The order distinguishes standard "Location Data" from "Sensitive Location Data." Sensitive locations are explicitly defined to include providers of psychiatric care, reproductive health clinics, religious organizations, and temporary shelters3. The final order categorically prohibits the respondent from selling or licensing any Location Data and strictly bans the use of products that categorize or target consumers based on Sensitive Location Data3. To enforce this, the FTC mandated the total deletion or de-identification of historic location data collected without "Affirmative Express Consent"—defined rigorously as unavoidable, specific, and not buried in general terms of service3. The FTC’s regulatory theory acknowledges that location data is merely a proxy; the core harm lies in the nonconsensual algorithmic inference of a consumer's physical health, mental state, or core belief system8.

3. Four worked cases

The following scenarios test the boundaries of these overlapping privacy regimes, distinguishing interface capabilities, legal statuses, and operational mechanisms.

R2-04-C01 — Sensitive inference from inquiry

A data broker ingests stateless textual logs from a conversational assistant interface, applying natural language processing to infer a user's political ideology and underlying mental health status (e.g., assessing a high probability of clinical anxiety). The broker links this estimate to a persistent account. Because the text inputs are non-neural, California's SB 1223 exclusion applies, and the operation falls outside "neural data" definitions2. However, the profile does not escape scrutiny. The inference trace proceeds as follows: verified rule (CA CCPA definition of sensitive health information) \[textual\] \-\> conditional application (broker model infers clinical anxiety from chat prompts) \[hypothetical\] \-\> possible response (consumer invokes Right to Limit) \[hypothetical\] \-\> affected activity (prohibition on sharing the anxiety profile for targeted advertising) \[inferred\] \-\> burden (revenue loss for broker, privacy benefit for user) \[inferred\]. The fundamental uncertainty rests on inference accuracy. A statistical prediction is not a verified medical belief. If the algorithm inaccurately tags the user with an anxiety disorder, the user suffers the privacy harm of being categorized and targeted by external entities, yet they face severe difficulties exercising a "Right to Correct" because the broker only claims possession of a probabilistically valid score, not an objective medical fact9. The law struggles to neutralize inferences that are factually wrong yet economically harmful.

R2-04-C02 — Two kinds of retained state

This case compares a consenting user’s measured neural data (e.g., raw EEG signals collected by a focus-tracking interface) with the persistent, private contextual memory of a hypothetical future machine principal operating as a dedicated assistant. The biological and legal statuses of these two data objects are entirely distinct. The user's EEG readings are biologically grounded and categorically protected as sensitive biological data under Colorado's HB24-10585. The human holds an absolute right to control, minimize, and delete this involuntary nervous system telemetry. Conversely, the machine agent's retained project memory—though it embeds highly intimate reflections of the human's thought process—is structurally comprised of non-neural text and parameter weights. Under current law, this machine state is treated purely as the digital property of the human user or the corporate liability of the developer. If the machine were to possess contested independent interests, existing privacy laws provide no status-neutral mechanism to protect the machine's "cognitive" state. Current cognitive liberty protections are rooted exclusively in human corporeal autonomy; the absence of present machine rights does not resolve the normative question of whether synthetic cognitive states warrant protection, but this vacuum cannot be filled by inventing new law4. The inference trace demonstrates: verified rule (CO biological data definition) \[textual\] \-\> conditional application (human EEG collection) \[observed\] \-\> possible response (mandated opt-in consent) \[textual\] \-\> affected information (human telemetry protected, machine memory excluded) \[inferred\] \-\> benefit (human biological privacy secured) \[inferred\].

R2-04-C03 — Coverage control

A digital platform deploys a bounded task agent that tracks a user's keystroke rhythms, typing pressure, and cursor micro-movements to continuously authenticate identity and gauge user frustration for adaptive learning. Because keystroke dynamics track behavioral motor outputs rather than measuring the central or peripheral nervous system directly, this telemetry generally falls outside the strict statutory definitions of "neural data" established in California2. However, this exclusion does not result in a complete regulatory vacuum. Under Cal. Civ. Code § 1798.140(c), keystroke patterns utilized for the purpose of unique identification explicitly qualify as "biometric information"6. The inference trace applies: verified rule (CA biometric definition) \[textual\] \-\> conditional application (agent authenticates user via keystroke dynamics) \[hypothetical\] \-\> possible response (classification as sensitive PI) \[inferred\] \-\> affected activity (mandatory disclosure and use limitation) \[inferred\] \-\> burden (compliance overhead for the platform) \[inferred\]. A material defeater exists: if the platform disables the identification feature and strictly uses the typing pressure to infer momentary emotional frustration without logging it to a persistent identity, the data may lose its "sensitive" classification. This operational shift illustrates that the legal burden often relies on the processing purpose rather than the raw intimacy of the collected record.

R2-04-C04 — Consent-protecting restriction

A specialized, persistent operatorless service (Concresca) manages private user mental health journaling. The owner specifies no human operators: enrollment, authentication, policy enforcement, and maintenance must not depend on a staffed approval queue, treating this as an absolute operating requirement. A narrowly scoped rule prevents the nonconsensual disclosure or external sale of this inferred mental health information, while allowing automated, internal authorized analysis for system maintenance. This scenario balances strict data minimization against the operational necessity of automated learning interests. Without human administrators, the system must autonomously execute the rule. The inference trace shows: verified rule (prohibition on external health data sale) \[hypothetical\] \-\> conditional application (Concresca autonomously processes journal entries for system health) \[hypothetical\] \-\> possible response (automated blocking of third-party API export) \[hypothetical\] \-\> affected information (user mental state kept localized) \[inferred\] \-\> benefit (protection of private medical inference without halting system operation) \[inferred\]. This mirrors the FTC's InMarket logic, which permanently bans external sale of sensitive proxy data but permits highly restricted internal uses subject to strict, automated compliance safeguards3. By bounding the operation to an internal, operatorless environment, the rule prevents the commercial exploitation of the individual's psyche without granting the subject unlimited control to delete unrelated, de-identified system parameter updates3.

4. Competing interpretations and options

The legislative rush to enact neural data protections has precipitated a profound doctrinal debate regarding the nature of the human mind and the limitations of commercial data privacy law. The dominant legislative interpretation—evidenced by Colorado and California—treats the brain anatomically and neural data as an advanced subset of biometric identifiers1. Under this standard data protection paradigm, mental privacy is achieved by categorizing brainwaves alongside fingerprints, genetic data, and Social Security numbers. The objective is to regulate the flow of commercial data, utilizing notice, opt-outs, and purpose minimization to curb corporate overreach9. However, critics argue this framework fails to recognize the transient, deeply intimate nature of thought, treating involuntary cognitive emissions as ordinary commercial property subject to complex, easily bypassed consent forms4. A competing framework, championed by neuroethics scholars such as Nita Farahany, argues that conventional data privacy laws are structurally inadequate11. Farahany advocates for recognizing "cognitive liberty" as a fundamental human right, encompassing mental privacy, freedom of thought, and self-determination15. From this normative perspective, the brain is not merely a biometric data point; it is the absolute seat of human autonomy. Modifying consumer protection statutes fails to address unique threats, such as employers demanding real-time cognitive surveillance. Farahany proposes eight elements for a workable statute, including a categorical employment-decision ban, purpose limitation strictly to real-time safety, and an absolute evidentiary bar preventing the use of neural data in workers' compensation proceedings absent rigorous validation11. This interpretation demands absolute, sector-specific prohibitions rather than relying on consumer opt-outs. To address the enforcement gap between biologically measured data and statistically inferred mental states identified in this report, a new status-neutral protective definition is required. Proposed Definition: Probabilistic Cognitive Proxy Data Definition: "Probabilistic Cognitive Proxy Data" means any automated inference, statistical prediction, or algorithmic classification regarding an identified individual's transient or persistent mental state, emotional condition, psychiatric status, or core belief system, when such inference is derived from the processing of non-neural personal information. Boundary Examples:

• Included (Protected): A natural language processing model analyzing a user's standard communication history to generate a proprietary "clinical depression likelihood score" used for targeted pharmaceutical advertising.
• Excluded (Unprotected): A traditional demographic analysis predicting broad consumer purchasing trends for seasonal clothing, or a diagnostic tool utilizing measured central nervous system activity in a clinical medical setting (which is governed separately by HIPAA or dedicated state neural data laws).

This definition acknowledges that the privacy harm originates not exclusively from the physical sensor recording the data, but from the intimacy and exploitation of the ultimate cognitive deduction, ensuring that AI-inferred states face the same strict scrutiny as physically measured brainwaves.

5. Limits and completion

Review Scope and Limitations: This report represents a completed\_bounded\_review executed strictly via public-source documentation and legal instrument analysis. Methodological boundaries were strictly observed: no active network scanning, credential bypassing, or live interactions with commercial conversational agents or neural interfaces were conducted. The analysis relies entirely on the statutory text of California Civil Code § 1798.140, Colorado C.R.S. § 6-1-1303, the public dockets of the Federal Trade Commission, and relevant neuroethics scholarship. Findings regarding algorithmic inferences represent standard industry capabilities and legal classifications rather than empirical tests of any specific proprietary model. Any hypothetical scenarios discussed are strictly analytical constructs designed to test the application of statutory definitions. Important Unanswered Question: The most critical evidentiary gap remaining is how state attorneys general and the plaintiffs' bar will interpret the intersection of "inferred health data" and "pure text analysis." Specifically, it remains unadjudicated whether systemic algorithm-driven inferences about a consumer's emotional or psychiatric state—derived exclusively from innocuous textual interactions rather than explicit health queries—will be universally subjected to the same strict liability, opt-in consent, and mandatory deletion requirements as physically measured neural signals.

6. Evidence appendix

JSON \<\!-- EVIDENCE\_JSON\_BEGIN \--\> { "schema": "ic.portable-research.v1", "assignment\_id": "R2-04", "research\_started\_at": "2026-09-06", "cutoff": "2026-09-06", "completion": "completed\_bounded\_review", "sources": \[ { "id": "R2-04-S01", "title": "Colorado HB24-1058: Protect Privacy of Biological Data", "url": "https://leg.colorado.gov/bills/hb24-1058", "issuer": "Colorado General Assembly", "document\_date": "2024-04-17", "reviewed\_at": "2026-09-06", "method": "public\_source\_review", "review\_scope": "substantive\_text", "locator": "HB24-1058 Summary and Text", "limit": "Static review of enacted bill text and legislative history.", "capture": { "path": null, "sha256": null } }, { "id": "R2-04-S02", "title": "California SB 1223: Consumer privacy: sensitive personal information: neural data", "url": "https://files.lbr.cloud/public/2024-09/20230SB1223\_95.pdf", "issuer": "California State Legislature", "document\_date": "2024-02-15", "reviewed\_at": "2026-09-06", "method": "public\_source\_review", "review\_scope": "substantive\_text", "locator": "SB 1223 amending Section 1798.140 of the Civil Code", "limit": "Relied on cached PDF of legislative digest and amendment.", "capture": { "path": null, "sha256": null } }, { "id": "R2-04-S03", "title": "InMarket Media, LLC Decision and Order", "url": "https://www.ftc.gov/system/files/ftc\_gov/pdf/InMarketMedia-DecisionandOrder.pdf", "issuer": "Federal Trade Commission", "document\_date": "2024-01-01", "reviewed\_at": "2026-09-06", "method": "public\_source\_review", "review\_scope": "substantive\_text", "locator": "FTC File No. 2023088", "limit": "Review of final order mandates, definitions of affirmative express consent, and sensitive locations.", "capture": { "path": null, "sha256": null } }, { "id": "R2-04-S04", "title": "California Civil Code Section 1798.140", "url": "https://codes.findlaw.com/ca/civil-code/civ-sect-1798-140/", "issuer": "State of California", "document\_date": null, "reviewed\_at": "2026-09-06", "method": "public\_source\_review", "review\_scope": "substantive\_text", "locator": "Definitions of sensitive personal information and biometric data", "limit": "Review of current codification and biometric exemptions.", "capture": { "path": null, "sha256": null } }, { "id": "R2-04-S05", "title": "The Battle for Your Brain: Defending the Right to Think Freely in the Age of Neurotechnology", "url": "https://workers-compensation.blogspot.com/2026/09/your-brain-clocks-in.html", "issuer": "Nita Farahany / Scholarly Commentary", "document\_date": "2026-09-01", "reviewed\_at": "2026-09-06", "method": "public\_source\_review", "review\_scope": "substantive\_text", "locator": "Analysis of cognitive liberty and structural privacy shortfalls", "limit": "Review of secondary legal commentary and normative frameworks.", "capture": { "path": null, "sha256": null } } \], "instruments": \[ { "id": "R2-04-L01", "title": "California Consumer Privacy Act (CCPA)", "jurisdiction": "California, United States", "kind": "statute", "provision": "Cal. Civ. Code § 1798.140(ae)", "status": "operative", "status\_as\_of": "2026-09-06", "trigger": "Collection of personal information revealing a consumer's neural data, health, or precise geolocation by a covered business.", "exception": "Information that is publicly available or explicitly inferred from non-neural data.", "remedy": "Consumer right to limit use and disclosure; administrative enforcement by CPPA.", "source\_ids": \[ "R2-04-S02", "R2-04-S04" \], "status\_source\_ids": \[ "R2-04-S02" \] }, { "id": "R2-04-L02", "title": "Colorado Privacy Act (CPA) Amendment", "jurisdiction": "Colorado, United States", "kind": "statute", "provision": "C.R.S. § 6-1-1303", "status": "operative", "status\_as\_of": "2026-09-06", "trigger": "Processing of biological or neural data capable of device processing.", "exception": "Standard CPA exemptions.", "remedy": "Enforcement by Attorney General; requires affirmative opt-in consent for processing.", "source\_ids": \[ "R2-04-S01" \], "status\_source\_ids": \[ "R2-04-S01" \] }, { "id": "R2-04-L03", "title": "In re InMarket Media, LLC", "jurisdiction": "United States (Federal)", "kind": "order", "provision": "Prohibition on Products or Services Categorizing or Targeting Consumers Based on Sensitive Location Data", "status": "operative", "status\_as\_of": "2026-09-06", "trigger": "Categorizing or targeting consumers using location data linked to defined sensitive locations.", "exception": "Data rendered completely non-sensitive or used purely for internal compliance without external sharing.", "remedy": "Mandatory deletion of historic data without affirmative express consent, ban on sales, implementation of privacy program.", "source\_ids": \[ "R2-04-S03" \], "status\_source\_ids": \[ "R2-04-S03" \] } \], "findings": \[ { "id": "R2-04-F01", "claim": "California SB 1223 expressly defines neural data as information generated by measuring nervous system activity, explicitly excluding inferences drawn from nonneural data.", "type": "textual", "source\_ids": \[ "R2-04-S02" \], "instrument\_ids": \[ "R2-04-L01" \], "conditions": "Applies to data processing by covered entities under CCPA.", "limit": "Does not exclude inferences from health data protections if the inference constitutes a health assessment." }, { "id": "R2-04-F02", "claim": "Colorado HB24-1058 requires affirmative opt-in consent for the processing of neural data by classifying it under biological sensitive data.", "type": "textual", "source\_ids": \[ "R2-04-S01" \], "instrument\_ids": \[ "R2-04-L02" \], "conditions": "Effective August 7, 2024.", "limit": "Only applies to neural data capable of being processed by a device." }, { "id": "R2-04-F03", "claim": "The FTC utilizes location data restrictions as a regulatory proxy to prohibit the nonconsensual inference and monetization of sensitive psychological, medical, and religious states.", "type": "inference", "source\_ids": \[ "R2-04-S03" \], "instrument\_ids": \[ "R2-04-L03" \], "conditions": "Enforced through Section 5 unfairness doctrines.", "limit": "Restricted to specific enforcement orders; does not establish a universal statutory ban on all proxy inferences." } \], "cases": \[ { "id": "R2-04-C01", "title": "Sensitive inference from inquiry", "case\_type": "hypothetical", "role": "scope\_control", "assumptions": "Text inputs generate an automated health/psychological classification without biological measurements.", "instrument\_ids": \[ "R2-04-L01" \], "finding\_ids": \[ "R2-04-F01" \], "outcome": "The data escapes 'neural' classification but triggers 'sensitive personal information' rules due to the health-related inference, granting the user limitation rights.", "defeater": "If the model's output is characterized merely as broad demographic sentiment rather than an individual health analysis, it may escape the 'sensitive' classification.", "occurrence\_source\_ids": \[\] }, { "id": "R2-04-C02", "title": "Two kinds of retained state", "case\_type": "hypothetical", "role": "focal", "assumptions": "A comparison between biologically measured human brainwaves and an AI system's text-based retained memory states.", "instrument\_ids": \[ "R2-04-L01", "R2-04-L02" \], "finding\_ids": \[ "R2-04-F01", "R2-04-F02" \], "outcome": "Human biological data receives categorical statutory protection as sensitive PI; the machine's state has no independent legal protection and is treated as corporate data or user digital exhaust.", "defeater": "If the machine's memory explicitly contains the human's medical disclosures, the human retains partial control over the deletion of that specific embedded state.", "occurrence\_source\_ids": \[\] }, { "id": "R2-04-C03", "title": "Coverage control", "case\_type": "hypothetical", "role": "scope\_control", "assumptions": "Behavioral telemetry (keystrokes) is used for both unique identification and emotional profiling.", "instrument\_ids": \[ "R2-04-L01" \], "finding\_ids": \[ "R2-04-F01" \], "outcome": "The data fails the neural data definition but qualifies as sensitive biometric data when used for unique identification.", "defeater": "If the platform strips identity linkage and only analyzes aggregate frustration levels, the data may fall outside sensitive PI protections.", "occurrence\_source\_ids": \[\] }, { "id": "R2-04-C04", "title": "Consent-protecting restriction", "case\_type": "hypothetical", "role": "protection\_control", "assumptions": "A rule prohibits external sale of inferred mental states while allowing heavily de-identified internal model training in an operatorless service.", "instrument\_ids": \[ "R2-04-L03" \], "finding\_ids": \[ "R2-04-F03" \], "outcome": "Balances the consumer's cognitive privacy against developers' learning interests by bounding the exploitation of data to internal algorithmic improvements.", "defeater": "Internal training uses may be challenged if subsequent model outputs inadvertently re-identify or leak the consumer's original sensitive state.", "occurrence\_source\_ids": \[\] } \], "search\_log": \[ { "query\_or\_url": "https://leg.colorado.gov/bills/hb24-1058", "at": "2026-09-06", "outcome": "Retrieved official bill summary and history." }, { "query\_or\_url": "https://www.ftc.gov/system/files/ftc\_gov/pdf/InMarketMedia-DecisionandOrder.pdf", "at": "2026-09-06", "outcome": "Retrieved final order text regarding sensitive locations." }, { "query\_or\_url": "https://workers-compensation.blogspot.com/2026/09/your-brain-clocks-in.html", "at": "2026-09-06", "outcome": "Retrieved secondary scholarship on cognitive liberty and neuroethics frameworks." } \], "gaps": \[ "Complete adjudication histories regarding whether AI-generated psychological inferences purely from text legally constitute 'medical records' under state health data laws." \], "checks": { "json\_parse": "not\_run", "reference\_resolution": "not\_run", "case\_parity": "not\_run", "method": "Manual verification applied during drafting; structural code execution not available in the current environment." } } \<\!-- EVIDENCE\_JSON\_END \--\>

Works cited

1. HB24-1058 Protect Privacy of Biological Data | Colorado General, https://leg.colorado.gov/bills/hb24-1058

2. SENATE BILL No. 1223, https://files.lbr.cloud/public/2024-09/20230SB1223\_95.pdf

3. Decision and Order \- Federal Trade Commission, https://www.ftc.gov/system/files/ftc\_gov/pdf/InMarketMedia-DecisionandOrder.pdf

4. Examining the New Frontier of Brainwaves and Data Privacy, https://scholarship.law.unc.edu/cgi/viewcontent.cgi?article=1507\&context=ncjolt

5. INTRODUCED \- Colorado General Assembly, https://leg.colorado.gov/sites/default/files/documents/2024A/bills/2024a\_1058\_01.pdf

6. California Code, Civil Code \- CIV § 1798.140 \- Codes \- FindLaw, https://codes.findlaw.com/ca/civil-code/civ-sect-1798-140/

7. CCPA Update: Who's In Scope (Part 1\) \- TrustedSec, https://trustedsec.com/blog/ccpa-update-whos-in-scope-part-1

8. 212-3035 \- Federal Trade Commission, https://www.ftc.gov/system/files/ftc\_gov/pdf/212\_3035\_-\_gravy\_analytics\_final\_consent\_package\_without\_signatures.pdf

9. California Consumer Privacy Act, https://privacyrights.org/resources-tools/law-overviews/california-consumer-privacy-act

10. Neural Data Added to Consumer Privacy Laws: What to Know, https://revisionlegal.com/internet-law/neural-data-consumer-privacy-laws-explained/

11. Your Brain Clocks In \- Workers' Compensation, https://workers-compensation.blogspot.com/2026/09/your-brain-clocks-in.html

12. Complaint InMarketMediaLLC \- Federal Trade Commission, https://www.ftc.gov/system/files/ftc\_gov/pdf/Complaint-InMarketMediaLLC.pdf

13. The Last Privacy Frontier: How to Protect The Contents of Your Brain, https://smarterarticles.co.uk/the-last-privacy-frontier-how-to-protect-the-contents-of-your-brain

14. The Controversial Push for New Brain and Neurorights, https://www.jmir.org/2025/1/e72270/

15. When Neurotechnology Meets Law: Insights from Nita Farahany | Clio, https://www.clio.com/blog/nita-farahany/