Editor's note: The IAPP is policy neutral. We publish contributed opinion and analysis pieces to enable our members to hear a broad spectrum of views in our domains.
Three U.S. senators have introduced a notable bill, S.2925, in Congress that aims to address concerns surrounding the rapid development of neurotechnologies capable of interfacing with the human mind.
Senate Majority Leader Chuck Schumer, D-N.Y., Senate Committee on Commerce, Science and Transportation Ranking Member Maria Cantwell, D-Wash., and Sen. Ed Markey, D-Mass., are proposing the Management of Individuals' Neural Data Act of 2025.
The MIND Act will cover both implanted brain-computer interfaces and wearable neurotech devices, such as headbands, earbuds, helmets and wristbands, which can detect activity from the central or peripheral nervous system. The proposed legislation directs the U.S. Federal Trade Commission to take into account both the potential benefits and risks of neurotechnologies and determine the need for regulation.
Neurotechnologies are being used to tangibly help people; for example, it enables paralyzed individuals to operate their exoskeletons and helps those who cannot speak to communicate through a brain-computer interface. However, neural data can also be used to deduce sensitive personal information about an individual, including their emotions, whether they are paying attention, and, in some research studies, even their inner speech.
These technologies can not only monitor brain activity but also stimulate the brain, thereby influencing its functions. Brain stimulation is used, for example, to treat depression. However, it could theoretically be used to induce an emotion in a person that they would not have experienced without the stimulation.
In the 1960s, Spanish researcher Dr. José Delgado shocked the research community by using a remote control to stimulate the brain of a bull and lead it to become docile in the midst of charging toward Delgado holding a red cape. When Delgado stopped the brain stimulation, the bull began its charge again. It is easy to envision how such a technology could be applied in warfare, sports or various other use cases.
Brain-computer interfaces promise enormous benefits to those who need them. By recording and stimulating the brain in a targeted manner, BCIs can drastically improve the lives of individuals impacted by injuries and ailments. Consider the following cases.
- After sustaining a spinal injury in a car accident, a man living with quadriplegia was fitted with a set of electrode arrays that could read neural impulses; he can now use the computer, play video games and manipulate a robotic arm.
- A stroke survivor left paralyzed and unable to talk could once again speak and make facial expressions through a virtual avatar thanks to an implanted BCI that can rapidly decode her neural data.
- A person with a paralyzed hand from a spinal cord injury achieved typing speeds of 90 characters per minute due to a BCI that decodes their thoughts as they imagined writing by hand.
These examples highlight the transformative potential of BCIs.
The senators' press announcement of the bill reflects their desire for the FTC to explore regulating use cases that are concerning, not the many beneficial uses. The MIND Act references several specific concerns that the senators want the FTC to explore, including mind and behavior manipulation, monetization of neural data, neuromarketing, erosion of personal autonomy, discrimination, exploitation, surveillance, and access to the minds of U.S. citizens by foreign actors.
The legislators are also concerned about misuse of neural data across sectors such as employment, health care, financial services, housing and education industries as well as law enforcement and the criminal justice system. They specifically ask the FTC to identify any gaps in the protection of children and teens and want the commission to analyze potential security risks associated with neurotechnology.
Throughout the MIND Act, it is clear the senators recognize the many benefits of neurotech. They ask the FTC to weigh those benefits against the risks and determine ways to mitigate risks while still realizing the many groundbreaking benefits of neurotechnologies, which include detecting epileptic seizures, enabling a person with ALS to communicate and helping a paralyzed person use their limbs.
The MIND Act also acknowledges that certain applications of neurotechnology — though not explicitly defined — may warrant prohibition, even with individual consent, if the potential harms outweigh the anticipated benefits.
Four U.S. state laws currently expressly protect neural data, as well as the federal Health Insurance Portability and Accountability Act that offers some protection for neural data collected in a health care service setting. There are also federal clinical trial regulations that only protect neural data in narrow circumstances. There is currently no comprehensive legal regime to protect the sensitive personal information that can be collected from brains using neurotechnologies.
The MIND Act would require the FTC to spend one year conferring with stakeholders to explore whether the existing legal regime adequately addresses neurotechnology, whether there are any gaps in current laws, and what additional protections should be implemented to protect individuals from neurotechnologies that can be used in harmful ways.
At the end of the year, the FTC is to report its findings to Congress and the public and annually repeat the study. The MIND Act would allocate USD10 million to the FTC for its work.
Among the many noteworthy aspects of the MIND Act, the law would apply not only to data collected from the nervous system, but also to other data that can infer, predict, or reveal cognitive, neurological conditions or emotional or psychological states. This could include heart rate variability, eye movement, voice analysis, facial expressions and sleep patterns.
The MIND Act's collaborative provisions are refreshing — it requires the FTC to confer with a wide array of stakeholders as it conducts its yearlong study, including relevant federal agencies, the private sector, academia, civil society, consumer advocacy organizations, labor organizations, patient advocacy organizations and clinical researchers.
It's important to note that even if Congress passes the MIND Act, it will not impose any obligations on businesses or researchers. It will merely require the FTC to conduct a study on the topic and report the results to Congress and the public.
The senators hope the MIND Act will incentivize companies to self-regulate — that is, "to help shape responsible standards so innovation can thrive safely." Businesses operating in this space would be well served by proactively establishing self-regulatory standards, even in the absence of laws. By doing this, they may or may not stave off legislation, but they would likely shape the ultimate legislation.
To incentivize neurotech businesses to self-regulate, the MIND Act asks the FTC to explore several financial incentives, such as research and development tax credits, financial support, and expedited regulatory pathways for product approvals.
Finally, the MIND Act recognizes the extraordinary risk today's participants in BCI research studies take to help businesses develop technology that will benefit future patients with conditions like ALS, stroke or paralysis. The act asks the FTC to explore policies that would offer long-term support for participants in BCI research studies so they can continue to enjoy the benefits of their implant after a study's completion. Such policies could include interoperability standards between various BCI technologies and post-trial BCI maintenance.
One-hundred and eighty days after the FTC's report to Congress, the MIND Act would require the director of the Office of Science and Technology Policy, in consultation with the FTC and the Office of Management and Budget, to develop guidance on federal government agency use of neurotechnologies. Sixty days later, the OMB will make those guidelines binding on all federal agencies.
As the MIND Act progresses through the legislative process, it is crucial all stakeholders stay informed and engaged. That includes neurotech companies, researchers, clinicians and individuals who use, and in some cases rely on, neurotechnology.
Regardless of whether Congress passes the MIND Act, it underscores the importance of examining the implications of this technology as it evolves, literally, into our minds, yielding remarkable benefits while also presenting possibilities that can seem like science fiction.
Kristen Mathews, CIPP/US, is a partner in the cybersecurity, data protection and privacy practice group at Cooley LLP.
