Connecticut Just Made Your Brainwaves Legally Sensitive. Your Earbuds Already Read Them.
Five states now treat brain data as sensitive, and no two drew the line the same way. What your sleep earbuds really record, who gets to keep it, and what you can do tonight.
There is an object on my nightstand that I have stopped seeing. It sits next to the water glass and the book I keep meaning to finish. Every night I pick it up without thinking, settle it into place, and let it play a soft tone that fades out around the moment I stop noticing anything at all. In the morning it hands me a number for how much deep sleep I got — a number I have never verified and never doubted.
I had filed it mentally where I file my toothbrush. An object. A habit. Furniture.
Then, on the first of July this year, a Connecticut statute took effect that reclassified not the device but the file — the quiet nightly log of my own nervous system that thing has been writing while I was unconscious. As of that morning, under Connecticut law, that log is sensitive data: the statute's most protected tier, the category legislators reserve for things they assume no reasonable person hands over casually.
And there is the small jolt I want to talk about. I had been handing it over casually. Every night. For months. It took a state legislature to tell me what it was.
We have written before about what AI is doing to the inside of your head — which pathways thicken with use and which get quietly pruned. This is the companion question, and the stranger one: not what machines are doing to your brain, but who gets to keep the recording of it.
One sentence, and everything hanging off it
Start with the law, because the whole story compresses into one line of statutory text.
Connecticut's SB 1295 amended the state's data privacy act, and the statute's actual words define neural data as "any information that is generated by measuring the activity of an individual's central nervous system." That is the entire definition. No exceptions, no carve-outs, no list of qualifying technologies. The act then folds neural data into "sensitive data," and once something is sensitive, two things follow: a company cannot process it without your consent, and — a separate gate — it cannot sell it without your consent either.
Notice what that is. Not a list of devices — a description of an act: measuring.
To feel how large a shift it represents, look at where American biometric privacy started. The law that invented American biometric privacy — Illinois's, the one every other state has spent fifteen years copying or litigating — protects "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." Every item on that list is something you carry on the outside. Your face is public. Your fingerprints are on the door handle you just touched. Your voice is in the air of every room you have ever spoken in. Biometric law grew up around the surfaces of the body.
Neural data is the first category we have had to legislate that you never show anyone at all.
So far so good — except this would be a philosophical footnote if the sensors still lived in hospitals. They don't. In February 2026, NextSense started shipping consumer earbuds with six EEG sensors, four hundred dollars, shipping now — the company says they detect light sleep, deep sleep and the drift back toward waking in milliseconds. The lawyers advising on all this describe no consistent definition across jurisdictions, arriving exactly as EEG left the clinic; the same practitioners note InteraXon's Muse headband already steering meditation and sleep sessions with real-time brainwave feedback. These are not laboratory rigs wheeled in by a technician. They are consumer electronics with a return window.
That is precisely what the states noticed. Colorado, California and Montana all moved to safeguard brain data collected by devices outside of medical settings — headphones, earbuds and wearables sold to improve sleep, focus and aging by measuring electrical activity. Not implants. Not surgery. The thing on the nightstand.
And here is the part that surprised me most. A briefing note filed with Vermont legislators lays the four enacted laws side by side — Colorado in force August 2024, California January 2025, Montana October 2025, Connecticut July 2026 — and the vote counts are almost eerie. Montana's House: 99 to 0. Colorado's House: 61 to 1. California's Senate: 38 to 0. Connecticut's House: 127 to 15. In an era when legislatures struggle to agree on the day of the week, brain privacy is producing near-unanimous roll calls in states that agree on nothing else.
But can it actually read your mind? No. And that is the wrong reassurance.
Now the honest complication, because this is where the story usually goes wrong in both directions.
If you have seen the headlines about AI decoding thoughts from brainwaves, be careful. Purdue researchers took apart the dataset sitting underneath a whole run of those thought-decoding papers and found it contaminated — researchers trained in one field, as they put it, unaware of the pitfalls of another. That is not proof EEG can never decode anything. It is proof the most cinematic claims were built on sand.
The defensible position, as best I can read it, is this: consumer EEG today reliably tracks states — sleep stage, drowsiness, attention, arousal. It does not read sentences, images or memories. Your earbuds are not transcribing your thoughts. They are noticing that you are anxious, or fading, or wide awake at 3 a.m.
Industry makes a stronger version of the same argument: companies have argued that activity in the peripheral nervous system "simply is not capable of revealing someone's inner thoughts and mental processes." Legal scholars will tell you plainly that neither the technical scope nor the legal construction of neural data is settled, and that stakeholders genuinely disagree about why regulation is needed here at all. Fair. Though "our data cannot possibly reveal that" is a sentence usually delivered by someone with a stake in the answer.
Here is why the mind-reading question is the wrong one anyway. Colorado state senator Cathy Kipp, the lawmaker who wrote her state's version, framed it in one sentence that has been rattling around my head ever since: if you collect the data today, what can you read from it five years from now, because the technology is advancing so quickly?
That is the whole game. Nobody is legislating against a device that reads your mind tonight. They are legislating against a recording that sits in a bucket while the models pointed at it get better every eighteen months. The file does not decay. The tools do not stand still. And the consent you gave — if you gave one — was consent to the 2026 version of what that file meant.
The medical establishment is not neutral here either. The American Medical Association's House of Delegates, per that same testimony filed with Vermont legislators, held that neural data "is extremely sensitive, and can reveal intimate information about individuals, including information about health, mental states, emotions, and cognitive functioning." Doctors, not activists.
Meanwhile, the same earbuds change legal status when you cross a state line
Here is where it gets genuinely absurd, and where I think the real story lives.
Four states drew that definition four different ways. No two of them drew the line in the same place.
Connecticut, as we saw, stops at the central nervous system — brain and spinal cord. Privacy researchers at the Future of Privacy Forum call the whole exercise a Goldilocks problem, noting that Connecticut is the lone current law applying solely to CNS data — which narrows it considerably, likely to brain-computer interfaces, EEG devices and close cousins. Every definition is either too narrow to catch the device you are worried about or too broad to survive contact with a smartwatch.
Montana went the other way. Its law — an amendment to the state's Genetic Information Privacy Act, not a standalone brain statute — reaches the peripheral nervous system too, the nerve traffic running out through your body. Then it carves back out what it calls "nonneural information": the downstream physical effects of neural activity, explicitly naming pupil dilation, motor activity and breathing rate. Montana reaches further into you than Connecticut does, and then deliberately releases your pupils, your movement and your breath.
Colorado is different again. It routes neural data through a broader "biological data" category — but that only bites when the data is used, or intended to be used, for identification purposes. Collect a year of someone's sleep architecture in Colorado without using it to identify them, and you have arguably stepped around the statute entirely.
Now put one pair of EEG earbuds in the middle of that. In Connecticut, the recording is sensitive data requiring consent. In Colorado, it may not be regulated at all unless someone tries to identify you with it. In Montana, some of what the same earbud captures is covered and some of it specifically is not. Same device. Same buyer. Same night's sleep. Three legal identities, decided entirely by which state you happened to fall asleep in.
We have watched this pattern before, one layer out, when two governments looked at the same face-scanning technology and reached opposite conclusions on the same continent. The difference is that with faces, everyone at least agreed what a face was.
And the map is still moving. By the time Connecticut's rule switched on, Vermont had quietly passed its own — an act on neurological rights signed in May 2026 and effective the very same morning, 1 July. Two states' brain-data laws switched on at the same sunrise. But Vermont's did not arrive intact: a consent requirement before anyone could collect a resident's neural data, and a private right of action letting people sue, were both stripped out on the way through the Senate. The patchwork is widening and thinning at once — more states, weaker seams.
Now run the recording forward
None of what follows exists yet. All of it is plausible from where we stand.
Picture 2031. The sensors have done what sensors do — got cheaper, smaller, less noticeable. The band on the nightstand is gone, because the function migrated into the earbuds you already wear, then the glasses, then the pillow, then the headrest of the car that notices you driving home tired. Nobody bought a "brain device." They bought better sleep, better focus, a nudge before the crash.
Behind all of it sits half a decade of continuous nightly recordings from tens of millions of people — an archive of human nervous systems at rest, at a scale no research institution could have funded. Pointed at that archive is a class of model that did not exist when any of it was collected. The question is no longer whether a 2026 earbud can read your mind. It is what a 2031 model infers from six years of your 2026 sleep: early neurological decline, a medication you never disclosed, the month your marriage started failing.
Then the second-order effects begin, and those are the ones I would bet on. Sensor placement becomes a legal strategy — a hardware team moves a contact three millimeters off the scalp and onto the jaw, because a jaw signal is peripheral and a scalp signal is central, and Connecticut's one sentence stops at the central nervous system. Nobody in that room is a villain. They are optimizing against a boundary a legislature drew in 2025.
And the compliance map becomes a product map. Features ship in forty-five states and quietly grey out in five. Or — more likely, and worse — the terms of service gain one more paragraph nobody reads, the consent box moves into the setup flow you tap through at 11 p.m. while yawning, and everyone is technically compliant forever.
Who is worried — and from which direction
This is not a left-versus-right fight, which is exactly what makes it interesting.
Washington has noticed, in its fashion. In September 2025, three senators introduced a bill conceding that a growing wave of consumer wearables is "quietly harvesting sensitive brain-related data with virtually no oversight and no limits on how it can be used," and that beyond a few state laws, very few rules govern it. Note what the MIND Act would actually do: it is a bill, not a law, and its operative ask is that the Federal Trade Commission go study the problem. In 2026, the federal response to brain data is a homework assignment.
On the advocacy side, somebody did the unglamorous work. The Neurorights Foundation read all thirty privacy policies of thirty consumer neurotech companies in a 2024 audit. Twenty-nine reserved access to the buyer's neural data with no meaningful limitation. Twenty-nine could, in practice, pass it to third parties. Sixty percent told buyers nothing whatsoever about how their neural data is handled or what rights they have over it.
Now the other side, taken seriously. The free-market objection is not that brain data should be free for the taking. It is geometric: absent federal clarity, state approaches become de facto national standards, forcing developers to design for the most restrictive regime in the country — and wearables are already edging into neural and neuromuscular signals for accessibility and safety functions people genuinely need. The coming fight over what counts as neural data is, from the policy-shop side, squarely about startups: many fear broad definitions will land hardest on small developers doing legitimate work.
Even the AMA files a limiting principle in the same breath as its warning — opposing efforts to broaden the consensus medical definition to sweep in data merely inferred from nonneural biosensors. Everyone agrees brain data is sensitive. Nobody agrees where the sentence should stop.
Which brings us to the prognosis. More of these bills are moving right now, and what the lawyers tracking them find notable about early 2026 is not only the volume of proposals but the range of regulatory strategies carrying them — neural data is being regulated across a variety of sectors and statutory frameworks at once, which is the polite way of saying no two states are building the same machine. What the practitioners expect is a patchwork of obligations and a complex compliance maze. Not a standard. A maze.
What does this mean for you?
You are not going to move to Connecticut over this. So here is the version that fits in a normal life.
Find out what your device actually keeps. Open the privacy policy of anything you wear that measures your body and search it for the word "neural." In that 2024 audit, most companies said nothing at all. The silence is the finding.
Use the consent, where you have one. In Connecticut, California, Colorado, Montana or Vermont — five states as of July 2026 — you now have statutory footing to ask what neural data a company holds, to refuse processing, and, in Connecticut, to separately refuse its sale. In the other forty-five, that recording of your nervous system is legally just another file on a server. Rights you never exercise are indistinguishable from rights you never had.
Ask the five-year question before you tap "agree." Not "what can this read today?" — that is the reassuring question. Ask what a much better model could pull out of six years of this, and whether you would still say yes.
Refuse both fairy tales. Your earbuds are not reading your thoughts; the panic version is wrong. But "it's only sleep data" is equally wrong, because sleep data is health data, and health data is the most valuable thing about you outside your bank balance.
Say something to your statehouse while the sentence is still being written. With bills moving through statehouses around the country right now, yours may be drafting one — and the definitions chosen this year will be inherited by devices nobody has built yet. Almost nobody writes to a legislator about brain sensors, which is exactly why a letter that does gets read.
The lesson, as I see it
For fifteen years, biometric privacy law has been an argument about surfaces: your face, your fingerprint, your voice, your gait. Things you emit into the world constantly, that a camera can take from across a street. Those laws were about capture.
Brain data breaks the frame, because nothing captures it from across the street. You have to invite it in — buy it, charge it, put it on your own head. And you will, gladly, because it helps you sleep, and sleeping badly is genuinely awful. The consent will be real. It will just be consent to something whose meaning changes after you have given it.
That is why the definitional patchwork matters more than it looks. It is tempting to read four states with four definitions as a bureaucratic mess for Congress to tidy up later. I think it is the opposite. This is the last window in which the sentence can be written wide — before an industry with real revenue has a real reason to keep it narrow, and before the first billion recorded nights make the question moot in practice.
My vote? Write it broad, and argue the exceptions afterward. Every law that started narrow and promised to grow later has done the second part badly. Meanwhile I will keep wearing the thing on my nightstand, because it works, and because pretending I would trade a good night's sleep for a principle would be a lie. But I have stopped calling it furniture. It is a recording device pointed at the one part of me I never show anyone — and now, in five states out of fifty, the law finally agrees.
If you know someone who falls asleep in earbuds — the friend chasing a better sleep score, the sibling with the meditation headband — send them this one. It is a strange, quiet thing to hand over a nightly recording of your nervous system without ever deciding to, and I would rather people decided. That is the whole reason the HAIA Foundation writes these, and why the Substack exists.
