Neural data laws guard brain chips. Your phone already reads your mind

Short answer: The new "neural data" privacy laws protect signals read off your nerves by implants and headsets, a market with 21 Neuralink trial participants. They leave alone the thing that already infers your mood, personality and weak moments: the phone that 3.64 billion people use to open a Meta app every day. California's law says it in plain text. Neural data is information "not inferred from nonneural information." Inference is the business, and inference is exempt.

TL;DR: Colorado (2024), California (2024) and Connecticut (2025) added neural data to their privacy laws, and a federal MIND Act was filed on Sep 29 2025 for a $10 million FTC study that has not moved since. Meanwhile published research shows Facebook Likes alone sort men by sexual orientation correctly 88% of the time and party loyalty 85% of the time, and ads matched to a personality inferred from behavior drew up to 50% more purchases across 3.5 million people. Meta made $17.72 per user in Q3 2026, up 23% in a year, off that behavioral signal. The brain chip is the decoy; the feed is the mind reader, and the fix is software you own that never ships your behavior out.

Key numbers

What	Number	Source, checked Oct 25 2026
Neuralink trial participants worldwide	21 (Jan 2026)	Reuters via Wikipedia
People using a Meta app daily	3.64 billion (Sep 2026)	Meta 10-Q, Q3 2026
Meta revenue per person, one quarter	$17.72 (Q3 2026, +23%)	Meta 10-Q, Q3 2026
Meta total revenue, 2025	$200.97 billion	SEC EDGAR XBRL
Men's sexual orientation predicted from Likes	88% correct (58,000 volunteers)	Kosinski et al., PNAS 2013
Purchase lift from ads fit to inferred personality	up to 50% (3.5M people)	Matz et al., PNAS 2017
State neural-data laws covering inferences from behavior	0 of 3	CA SB 1223, CO HB24-1058, CT PA 25-113
Federal lobbying filings naming "neural data", 2023 to 2026	1 (the AMA)	Senate LDA

The laws exempt the exact thing they say they fear

Read the definition before you read the press release. California's SB 1223, signed on Sep 28 2024, adds neural data to the state's list of sensitive personal information. Then it defines the term: information "generated by measuring the activity of a consumer's central or peripheral nervous system, and that is not inferred from nonneural information."

That last clause is the whole story. If a company reads your mood from your typing rhythm, your scroll speed or what you lingered on at 2 AM, that is an inference from nonneural information. It is outside the neural-data rule by design.

Colorado got there first, signing HB24-1058 on Apr 17 2024. Its neural data sits inside "biological data," which the bill summary limits to data "used or intended to be used, singly or in combination with other personal data, for identification purposes." Reading your emotional state to sell you something is not identification. Connecticut followed with Public Act 25-113, signed Jun 24 2025, and narrowed the definition further to "the activity of an individual's central nervous system." Our reading: the peripheral signals that Meta's new wristband reads from your muscles are an easy argument outside Connecticut's line.

So three states have written neural-data rules, and the count that covers mental states inferred from behavior is zero.

The receipts: behavior already reads you, no headset needed

This is not a theory about the future. It is a decade of published results.

In 2013, Michal Kosinski, David Stillwell and Thore Graepel took the Facebook Likes of more than 58,000 volunteers and ran them through a plain regression model. It told gay from straight men correctly in 88% of cases, Democrats from Republicans in 85%, and African Americans from Caucasian Americans in 95%. For the trait "Openness," it came close to the test-retest accuracy of a standard personality test. That was Likes. Not brain waves.

In 2017, Sandra Matz and colleagues took the next step: three field experiments reaching over 3.5 million people with ads matched to a personality inferred from digital footprints. Matched ads drew up to 40% more clicks and up to 50% more purchases than mismatched or generic ones. Inference was not just accurate. It paid.

Keyboards talk too. A 2018 BiAffect study in the Journal of Medical Internet Research logged 626,641 keystrokes of phone keyboard metadata (timing and rhythm, not the words) from people with bipolar disorder and predicted their clinician-rated depression scores with a conditional R squared of 0.63. Your phone does not need to read your thoughts. It reads how fast you type them.

And the platforms have tested pushing on the dial, not only reading it. Facebook's 2014 "emotional contagion" study changed the mix of positive and negative posts in the feeds of about 689,000 users and measured the mood of what they posted back. In 2017 a leaked Facebook Australia document, reported by The Australian and The Guardian, described how the company could monitor posts and photos in real time to tell when young people felt "stressed," "defeated," "worthless" and "insecure." Facebook first apologized, then called the story misleading and said it does not "offer tools to target people based on their emotional state." The capability was in its own slide deck either way.

21 people vs 3.64 billion

Now look at where the laws point. Neuralink, the face of the brain-chip panic, said in January 2026 that it had 21 participants enrolled in trials worldwide. Meta's Neural Band, the EMG wristband sold with Ray-Ban Display glasses from $799 since September 2025, is a first-generation gadget. Meta says it was trained on nearly 200,000 research participants.

The phone feed is a different order of magnitude. Meta reported 3.64 billion daily active people across Facebook, Instagram, Messenger and WhatsApp in September 2026.

The ratio is about 170 million users of the inference machine for every person with a Neuralink implant. Lawmakers wrote rules for the 21.

Follow the money: who wins, who loses

Here is the flow nobody draws. Your taps, scrolls, Likes and pauses go in. Models infer mood, personality and the moments you are easiest to sell to. Ad revenue comes out. Meta's 10-Q says its ads rely on "data signals from user activity on websites and services that we do not control, as well as signals generated within our products." That is the inference pipeline, in the company's own words.

The meter keeps rising. Meta's average revenue per person was $12.29 in Q3 2024 and $17.72 in Q3 2026, up 23% in the last year alone, while daily users grew only 3%. Total revenue hit $200.97 billion in 2025. The extra money is not coming from more people. It is coming from knowing each person better.

Meanwhile the brain hardware loses money. Meta's own filing says Reality Labs, the division that builds the glasses and the wristband, cut its 2025 operating profit by about $19.19 billion, and it expects $18 to $19 billion more in 2026. A law that fences off neural signals fences off the part of the business that does not pay. The part that pays stays open.

Watch the lobbying, too. Meta reported $26.29 million of in-house federal lobbying in 2025 (about $30.0 million counting its outside firms, our sum with amendments removed). Across every lobbying disclosure filed from 2023 through 2026, we found exactly one that names neural data: the American Medical Association, Q3 2025, under "AI/use of neural data." No big tech company bothered to lobby on it. You do not spend money fighting a rule that does not touch your revenue.

Who wins: the ad platforms, whose core inference engine just got a fresh story about how privacy is being handled. Lawmakers, who get a futuristic bill signing without picking a fight with the biggest advertisers in the country. Who loses: everyone whose 2 AM scroll is worth more than their brain waves, which right now is everyone.

Why the brain chip is the perfect decoy

A chip in your skull is a great villain. It is visible, a little gross, and owned by a billionaire people love to argue about. A regression model running on your scroll speed has no face.

The attention data says the decoy works. In 2025, the English Wikipedia page for Neuralink drew 663,235 human views. "Targeted advertising" drew 34,142. "Digital phenotyping," the field name for reading mental state from phone behavior, drew 3,635. People looked up the brain chip 19 times as often as the ad machine and 182 times as often as the science of reading minds from phones.

When the public is staring at the implant, a law about the implant reads as a win. That is the play. Nobody has to conspire for it to work; every incentive points the same way. Legislators get credit, platforms get cover, and the press gets a Musk headline.

Even the federal bill admits the gap and then walks past it. Senator Schumer's MIND Act, cosponsored by Senators Cantwell and Markey, says "related biometric and behavioral data that can reveal mental states may pose similar risks." Its answer is to fund a $10 million FTC study due a year after it becomes law. It was referred to committee on Sep 29 2025, and that is its only recorded action.

The best case for the headset laws, and why it fails

The strongest argument on the other side is real. Direct neural signals are a new frontier. A brain-computer interface could, in time, read intent before you act on it, and that data cannot be changed like a password. Writing rules early, before the market exists, is how you avoid the mess we got with social media. The senators behind the MIND Act make that case in its findings.

Fine. Protect the implant. But a rule that covers the future device and explicitly exempts the present one is not "early." It is late on the thing that already happened and early only on the thing that has not. Mental-state inference from behavior has been published, scaled and monetized for more than ten years. The FTC already had to make BetterHelp pay $7.8 million in 2023 for sharing answers to its mental health intake questions with Facebook and Snapchat for ads. The harm has a docket. The headset does not.

And the line between "neural" and "behavioral" is about to disappear. Meta's wristband turns muscle signals into commands; its glasses watch what you look at; the same company runs the feed. Once the inference model eats both streams, the California clause tells you which half is protected: not the half doing the work.

Our bet: the mind-reading device stays in your pocket

Here is our call, stated plainly. For the next five years, the device that knows your mental state best will not be a headset or an implant. It will be the phone and the AI assistant on it, reading the same behavioral exhaust it reads today, now with models that are cheaper and sharper every quarter (we track that price slide on our LLM price pages). Neural-data laws will keep multiplying, and they will keep not touching it.

The quiet tell to watch: when a platform's revenue per user keeps climbing while its user count stalls, it is getting better at reading the users it already has. Meta's numbers say that is happening right now. This is the same pattern we found when sleep trackers turned 4.8 billion nights into a sale, when data brokers built a private social credit score, and when the platforms that sold isolation started selling the AI friend. The scary future thing is the headline. The boring present thing is the business.

What this means for you

Stop waiting for a neural-data law to protect your mind. It was written not to. Do three things this week. Turn off ad personalization and off-platform activity in your Meta and Google settings. Move the apps you use when you are tired, anxious or alone (journals, mood trackers, budgets) to tools that run on your device and never send behavior to a server. And if you build software, build local-first: the strongest privacy policy is never having the data.

That last one is the freedom move. Own the tool, own the signal. If you want to build your own private tools with AI instead of renting someone else's feed, the $29 AI Builder Kit gives you five offline apps that keep your AI building what you meant, on any model including one running on your own machine. If it does not get your AI building what you meant, we keep working with you at no extra cost until it does.

More arguments like this one live on our opinion page and in every opinion piece, including why "protect the kids" laws build an ID database.

Sources

• California Legislature, SB 1223 (Becker), Chapter 887, approved Sep 28 2024, checked Oct 25 2026
• Colorado General Assembly, HB24-1058, signed Apr 17 2024, checked Oct 25 2026
• Connecticut General Assembly, SB 1295, Public Act 25-113, signed Jun 24 2025 (act text), checked Oct 25 2026
• Congress.gov, S.2925 MIND Act of 2025, text and actions, checked Oct 25 2026
• Meta Platforms, Form 10-Q for the quarter ended Sep 30 2026, SEC EDGAR, checked Oct 25 2026
• SEC EDGAR XBRL company facts, Meta Platforms, checked Oct 25 2026
• Meta Newsroom, Meta Ray-Ban Display and Meta Neural Band, Sep 17 2025, checked Oct 25 2026
• Wikipedia, Neuralink (citing Reuters, Jan 28 2026), checked Oct 25 2026
• Kosinski, Stillwell, Graepel, "Private traits and attributes are predictable from digital records of human behavior," PNAS 2013, abstract via Europe PMC, checked Oct 25 2026
• Matz, Kosinski, Nave, Stillwell, "Psychological targeting as an effective approach to digital mass persuasion," PNAS 2017, checked Oct 25 2026
• Zulueta et al., "Predicting Mood Disturbance Severity with Mobile Phone Keystroke Metadata: A BiAffect Digital Phenotyping Study," JMIR 2018, checked Oct 25 2026
• Kramer, Guillory, Hancock, "Experimental evidence of massive-scale emotional contagion through social networks," PNAS 2014; participant count via Wikipedia, Criticism of Facebook, checked Oct 25 2026
• The Guardian, Sam Levin, "Facebook told advertisers it can identify teens feeling 'insecure' and 'worthless'," May 1 2017, checked Oct 25 2026
• Wikipedia, BetterHelp (FTC settlement, Jul 14 2023), checked Oct 25 2026
• U.S. Senate Lobbying Disclosure Act database, Meta Platforms 2025 filings and "neural data" issue search 2023 to 2026, Tensorust pull, Oct 25 2026
• Wikimedia Pageviews API, human views 2020 to 2025, Tensorust pull, Oct 25 2026