Baisley told Ars that he intends to push a follow-up bill next year to remove the exemption from public universities and resolve the conflict with private universities.
Other opponents include tech companies. TechNet, which represents companies like Apple, OpenAI, and Meta, pushed for changes in a parallel Colorado bill. TechNet won a battle to update the bill text to include language “focusing the law on regulating brain data used to identify individuals,” NYT reported, but lost a battle to ditch “very broad” language relating to data generated by “an individual’s body or bodily functions,” which Colorado’s law now includes.
The ACLU raised concerns about limiting the law to only cover data that can be used to identify individuals, which Colorado’s law currently does, instead recommending policy that restricts all biometric data collection, retention, storage, and use. In Colorado, this limitation means that companies that don’t specifically collect brainwave data for identification purposes—but for other purposes such as decoding someone’s thoughts or feelings—won’t be impacted by the law.
But although it’s maybe not a perfect privacy law, it’s still progress, Neurorights co-founder Jared Genser told NYT.
“Given that previously neural data from consumers wasn’t protected at all under the Colorado Privacy Act, to now have it labeled sensitive personal information with equivalent protections as biometric data is a major step forward,” Genser said.
Neurorights is hoping that Colorado’s law will inspire federal lawmakers to take similar action soon.
In a post on X, Neurorights celebrated Colorado’s law passing, “declaring Colorado the first place in world to legally define and protect neural data as sensitive.”
“Hopefully, we’ve begun some momentum that the world will take on,” Baisley told Ars.
This story was updated on April 18 to include comments from co-sponsors of Colorado’s law.