Neurotechnology is moving into the workplace, with companies developing tools capable of monitoring attention, cognitive load, and emotional states in real time. These technologies could help individuals understand and manage their own productivity. But employer access raises questions around surveillance, consent, and ethics. It also raises wider questions about whether existing regulatory frameworks can govern neurotechnology within and beyond the clinic.
Assembly Bill 1883 is progressing through the California legislature and would restrict employers’ use of surveillance tools, including those capable of collecting neural data. The bill passed the Assembly earlier this year and was ordered to a third Senate reading on August 17, before being amended on August 21 and returning to second reading. Its progress has coincided with Assembly Bill 1542, which aims to prevent the sale or sharing of sensitive data, including neural data. Both build on California’s 2024 decision to classify neural data as sensitive under existing privacy laws.
Assembly Bill 1883 (AB 1883) would prohibit employers from using AI-enabled workplace surveillance tools to collect neural data or recognize an individual’s emotional state, with limited exceptions. The bill defines neural data as information generated by measuring the activity of a worker’s “central or peripheral nervous system” that cannot be inferred from nonneural information. AB 1883 marks a shift from adding neural data to existing privacy laws towards more specific workplace regulation.
Montana and Colorado are among other US states that have designated neural data as sensitive. Jose M Muñoz, founding director of the International Neurotechnology Governance Observatory and member of the International Center for Neuroscience and Ethics, highlights that while interstate approaches appear similar, protections may vary depending on factors such as how neural data is defined: “there’s convergence on the label but risk of fragmentation on scope.”
State privacy laws sit alongside federal oversight of areas such as medical devices. The MIND Act, a federal bill introduced in late 2025, would direct the FTC to study how data obtained from neurotechnology is handled, suggesting federal involvement in neurotechnology regulation is gaining momentum. Muñoz notes that “[MIND] is a useful first step, but what’s ultimately needed is a federal floor states may exceed, not a ceiling that preempts them.”
Focusing regulation on access to neural signals may overlook where much of the risk occurs. According to Muñoz, “the characteristic harm in this domain occurs downstream, in the inference and in the decision taken on the basis of it.” AB 1883 addresses both. Alongside limiting neural data collection, it would restrict employers from making “inferences or predictions about an individual’s emotional state” using surveillance tools, pointing towards regulation of inferences as well as data collection.
Good regulation may therefore depend less on prohibiting specific devices and more on preventing harmful uses. The same consumer EEG system may pose little concern in a game but become far more consequential in a job interview. AB 1883 reflects this context-based approach by treating the workplace as an environment requiring greater protection. Rather than relying on employee consent, which can be complicated by workplace power dynamics, it places direct restrictions on employers’ use of surveillance tools.
Regulation also needs to be verifiable. As Muñoz puts it, “a framework is worth not what it declares but what it obliges someone to demonstrate, and to whom.” Companies should be able to show how their systems generate and use neural inferences, while regulators need the ability to audit them. AB 1883 is relatively clear about what employers cannot do, but less prescriptive about demonstrating compliance. In Muñoz’s words, “A regulator that cannot audit an inference drawn from neural data is not regulating; it’s trusting.”
Chile provides an example of neurotechnology protections moving from principle into enforcement. In 2023, the Chilean Supreme Court ruled against Emotiv and ordered the company to delete brain data collected from a user, applying the country’s recently established constitutional protection of brain activity and related information.
Europe faces a different challenge. Existing rules on data protection, medical devices, and AI provide broad coverage, but gaps may remain between them. These are particularly relevant for consumer neurotechnology that falls outside medical device rules or high-risk AI classifications. At the international level, UNESCO’s 2025 Recommendation on the Ethics of Neurotechnology provides technology-neutral guidance covering both medical and non-medical applications, although it is not legally binding.
Overall, neurotechnology regulation is broadening beyond data privacy to address the inferences drawn from neural data and how those inferences are used. If enacted, AB 1883 would be a step towards regulating not only access to neural data, but also how and where that information can be used. Ultimately, regulation should preserve cognitive liberty, allowing neurotechnology to give individuals greater insight into their own brains while preventing that information from being used against them.
.svg)
.jpeg)
