Montana on the Brain: A Bold Step for Neural Privacy

Montana has now become the third state in the US, following Colorado and California, to enact a privacy law that specifically protects neural data – that is, data collected from activity of the central or peripheral nervous system. The law was passed by the Montana Legislature with an overwhelming majority and became law on May 2, after 10 days passed without the governor signing or vetoing it. It will become effective on October 1, 2025. 

This is an important development in mental privacy because neural data can be used to derive private information about a person’s mental states, emotions and cognitive functioning, and, according to the Montana Legislature, can even be used to manipulate brain activity.

Montana Senate Bill 163 amends Montana’s Genetic Information Privacy Act to add provisions that apply to neural data in addition to genetic information. Montana legislators passed this bill recognizing that the use of neurotechnologies outside of medical settings was not covered by health data privacy laws, and therefore was left unregulated. 

However, it may surprise HIPAA-covered entities and business associates that this new Montana law not only applies to consumer neurotech, but also to neurotech used in medical settings, because of some conditions it places on its Health Insurance Portability and Accountability Act (HIPAA) exception.  

The Montana law also might have an implication for the Colorado law. In the bill’s declarations, the legislature recognizes that each human brain is unique, and that neural data is specific to the individual from whom it is collected. Because it contains distinctive information about the structure and functioning of an individual’s brain and nervous system, the Montana Legislature declared, neural data can be linked to an identified or identifiable individual. This finding is relevant under other laws – the Colorado Privacy Act, for example – that only apply to biological data that is used or intended to be used to identify a specific individual, leaving it unclear whether it applies to neural data. The Montana Legislature apparently thinks that it should.  

What the new Montana law requires for neural data 

The new Montana law protects the neural data of Montana residents. Neural data is defined as information that is generated by the measurement of the activity of an individual’s central or peripheral nervous system, and that can be processed by or with the assistance of a device. 

The new Montana law imposes several requirements on entities that handle neural data of Montana residents:

• Entities must safeguard the privacy, confidentiality, security and integrity of neural data by providing clear and complete information to consumers regarding their policies and procedures for their collection, use and disclosure of neural data. In particular, they must make available to the consumer two different privacy policies. The first is a high-level privacy policy overview that includes basic essential information about the entity’s collection, use and disclosure of neural data. The second is a prominent publicly available privacy notice that includes, at least, information about the entity’s data collection, consent, use, access, disclosure, transfer, security, retention and deletion practices for neural data.
• Entities must obtain initial express consent for the collection, use or disclosure of a consumer’s neural data. Such consent must specify how the entity may share the neural data.
• Entities must obtain a consumer’s separate express consent to transfer or disclose a consumer’s neural data to any third party other than the entity’s processors. This consent must include the name of the third party to which the neural data is transferred or disclosed.
• Entities must obtain a consumer’s separate express consent to use neural data beyond the primary purpose and inherent contextual uses. 
• Entities must obtain a consumer’s informed express consent to transfer or disclose a consumer’s neural data to third persons for research purposes.
• Entities must obtain a consumer’s express consent to market to the consumer based on the consumer’s neural data.
• Entities must obtain a consumer’s express consent to sell the consumer’s neural data in exchange for valuable consideration. 
• Entities must comply with applicable law requiring valid legal process before disclosing neural data to law enforcement or any other governmental agency, absent a consumer’s express consent. 
• Entities must develop, implement and maintain a comprehensive security program to protect consumers’ neural data against unauthorized access, use and disclosure.
• Entities must provide a process for consumers to access and delete their neural data, and revoke any consent provided by the consumer with regard to their neural data.
• Neural data collected in Montana may not be stored within the territorial boundaries of any country currently sanctioned by the US or designated as a foreign adversary of the US.
• Neural data of Montana residents collected in Montana may only be transferred or stored outside of the US with the consent of the consumer.
• Entities may not disclose a consumer’s neural data to any entity offering health insurance, life insurance or long-term care insurance, or to the consumer’s employer, absent the consumer’s express consent.

There are several exceptions to the law’s applicability:

• The law does not apply to protected health information under HIPAA that is collected by HIPAA-covered entities or business associates, assuming that separate informed consent was obtained for the collection, use and dissemination of the neural data, and that, if outside the context of a clinical research trial, the covered entity or business associate gives the consumer a process to access and delete their neural data and revoke their consent with regard to their neural data. 
• The law does not apply in the context of certain regulated research. 
• The law does not apply to uses of neural data by a governmental agency. However, the law limits government agencies’ use of neural data. Any collection, storage, use or dissemination of neural data by a governmental agency must be performed either in accordance with a specific state law or executed through a search warrant or investigative subpoena. Governments may not obtain neural data without a search warrant or investigative subpoena issued by a court on a finding of probable cause, unless the consumer previously waved their right to privacy in the information.

Montana’s groundbreaking neural privacy law goes beyond the Colorado and California laws’ requirements and sets a new standard for the protection of mental data in both consumer and medical contexts. By recognizing the uniquely sensitive nature of neural data and requiring strong safeguards and informed consent, the law positions Montana as a national leader in mental privacy. As neurotechnology continues to evolve, other states and stakeholders will be closely watching Colorado’s, California’s and Montana’s approaches.

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.