On April 17, 2024, Governor Polis signed House Bill 24-1058 into law, which amends the Colorado Privacy Act (the “Act”) to include “neural data” – defined as information processed by a device and that is “generated by the measurement of the activity of an individual’s central or peripheral nervous systems” – within the scope of “sensitive data,” making Colorado the first U.S. state to extend privacy protections to such data.
Colorado’s general assembly found that neural data contains distinctive information, unique to the structure and function of a given individual’s brain and nervous system, that “can reveal intimate information about individuals, including… about health, mental states, emotions, and cognitive functioning,” which is inherently sensitive information. Thus, the amendment is intended to address “particularly pressing privacy concerns” related to neurotechnological advances that enable companies to collect information about a person’s bodily and mental functions via devices, which are no longer confined to hospitals in a research and rehabilitation setting, but rather are increasingly available to consumers.
The new provisions in the Act will take effect 90 days after the general assembly’s final adjournment, unless a referendum petition is filed, at which point the new provisions will take effect upon approval by Colorado voters in the November 2024 general election.
Colorado General Assembly – HB24-1058 (2024 Regular Sessions) | Colorado Privacy Act – HB24-1058