Mental Privacy in the Age of BCIs: What the Law Doesn't Yet Cover

Where the law currently protects you

Federal U.S. law protects your medical information (HIPAA), some financial information (GLBA), some children's information (COPPA), and — depending on state — some biometric information (BIPA, Texas, Washington, and a growing list).

These laws share two assumptions:

1. The data being protected is collected by an entity in a defined relationship with you (your provider, your bank, your child's school).
2. The data is itself sensitive (a diagnosis, an account balance, a fingerprint).

Both assumptions break for brain data.

Where the gap opens

Brain data and mental-state inference are different in three ways:

1. The collector doesn't need to be your provider. A consumer EEG headband is not a medical device. The company that sells it is not a HIPAA-covered entity. Nothing about the doctor-patient relationship applies. The same is true for the company that ships your VR headset, your meditation app, or your car's drowsiness-detection camera.

2. The collected data isn't always recognizably "sensitive." Your typing cadence isn't sensitive. Your scroll velocity isn't sensitive. Your gaze pattern isn't sensitive. The inference drawn from them — that you are depressed, that you are about to make a purchase, that you are politically swayable — is sensitive. Existing law largely protects raw data and largely ignores inferences.

3. The consent flows are broken. "By using this app you consent to..." is the universal mechanism for transferring brain-state inferences from you to a company. Courts have begun pushing back, but the default still holds.

What's actually been litigated

A short, partial list as of 2026:

• In re BIPA litigation against multiple AR/VR firms. Eye-tracking data treated as biometric in Illinois.
• Colorado HB24-1058 enforcement actions. First state-level enforcement of "neural data" as a regulated category.
• FTC consent decrees against several wellness apps for sale of inferred mental-health categories to ad networks.

What has not been litigated successfully (yet):

• Inference from non-neural signals to mental state, treated as protected
• Workplace neural monitoring as a § 1981 / Title VII matter
• Brain-data evidence in criminal proceedings
• Algorithmic manipulation as a tort

Each of these is a frontier. Each will be decided over the next decade.