On September 24, 2025, Ranking Member Cantwell (D-Wash.), Leader Schumer (D-NY), and Senator Markey (D-Mass.) announced they will introduce the “Management of Individuals’ Neural Data Act of 2025” (“MIND Act”). If enacted, the MIND Act will direct the Federal Trade Commission (“FTC”) to conduct a comprehensive study and report on the collection, processing, storage, sale, and transfer of neural data and related data, and to recommend a regulatory framework for their protection.
Expansion Beyond Current State Law
As discussed in previous posts[1], California, Colorado, Connecticut, and Montana have already taken steps to address concerns related to the collection, use, and disclosure of “neural data”. However, the MIND Act represents a significant step beyond current state privacy laws by requiring a federal study of regulatory gaps and mandating the development of a comprehensive framework for the protection and ethical use of neural data.
Unlike certain state laws, the MIND Act does not limit the definition of “neural data” to data collected for a specific purpose, such as identification of an individual. Instead, it defines “neural data” as “information obtained by measuring the activity of an individual’s central or peripheral nervous system through the use of neurotechnology”.
The MIND Act also covers “other related data,” such as biometric, physiological, or behavioral information that can be “processed, analyzed, or combined with other data” to infer cognitive, emotional, or psychological states, even if not directly measuring neural activity. For example, a consumer wearable that collects heart rate data used to infer a person’s excitement may be covered by the MIND Act.
The MIND Act further defines “neurotechnology” broadly as “a device, system, or procedure that accesses, monitors, records, analyzes, predicts, stimulates or alters the nervous system of an individual to understand, influence, restore, or anticipate the structure, activity, or function of the nervous system.”
Lawmakers’ Intentions
The sponsors of the bill state the MIND Act will “expand” on state precedent to:
- Increase protections against exploitation of neural data, such as by foreign actors or corporations.
- Require conversations between “representatives from federal agencies, the private sector, academia, civil society, consumer and patient advocacy organizations, labor organizations, and clinical research stakeholders” around neural data governance, policy gaps, and “responsible innovation.”
- Require the FTC to propose future action related to neurotechnology and neural data, including regulation.
- Identify high-risk “harmful applications of neural data, from AI-driven manipulation, insurance discrimination, and hyper-targeted ads, to data aggregation, risk[s] to children’s cognitive privacy, and national security risks.”
- Encourage innovations in “responsible neurotechnology development.”
- Require the Office of Science and Technology Policy to develop guidance and prohibit federal agencies from purchasing neurotechnology products that do not align with the FTC’s findings.
What Does This Mean for Businesses?
The MIND Act signals a move toward comprehensive federal regulation of neural data, with a focus on privacy, security, and ethical use. Key takeaways for businesses include:
- Businesses handling non-neural data that could reveal mental states may fall within the Act’s scope.
- Businesses should anticipate new federal standards and possible additional compliance obligations, even if current practices are governed by HIPAA or state law.
- Businesses should review and strengthen their privacy and security programs for neural and related data, as future regulations may require heightened safeguards, stricter consent standards, and enhanced access controls.
- Businesses engaged in data monetization, neuromarketing, or behavioral analytics should assess their practices for compliance risk.
- Businesses should map their vendor relationships and ensure that all third parties handling neural or related data meet robust privacy and security standards.
[1] https://www.alstonprivacy.com/california-joins-the-neural-data-bandwagon/; https://www.alston.com/en/insights/publications/2024/04/key-issues-raised-by-colorado
