Brain data are not just any data

Until recently neural data were a lab topic. Today they are also discussed for devices aimed at the general public, outside labs and hospitals.

The law is starting to notice.

Two signals

In April 2024 the Governor of Colorado signed HB24-1058, "Protect Privacy of Biological Data". It extends the notion of sensitive data in the Colorado Privacy Act to biological data, which include neural data. It defines them as information generated by measuring the activity of an individual's central or peripheral nervous systems that can be processed by or with the assistance of a device.

In November 2025 UNESCO Member States adopted the Recommendation on the Ethics of Neurotechnology. UNESCO presents it as the first global normative framework in this field.

These are different steps. One is a binding state law. The other is an international recommendation. But they say the same thing: these data deserve special protection.

The consent problem

Protection, however, almost always runs through a document. A privacy notice, a consent form, terms of use. This is where the problem becomes concrete.

In the chapter I wrote for Mente e Tecnologia, published by Springer Healthcare Italia, I presented an exploratory study. One hundred people read the documents used to consent to brain-computer interfaces while we measured their reading with EEG and fNIRS. We applied the LX Complexity Score. Syntactic density: 72 out of 100. Semantic distance: 68 out of 100. The experimental accessibility threshold was 45. No document was below the threshold.

It is an exploratory study, on a voluntary, non-representative sample, and the threshold is experimental, not legal. But it points in one direction: the texts meant to protect our most intimate data all exceed the experimental complexity threshold.

What is needed

Protecting neural data is not enough. We must protect the decision to hand them over. That requires documents designed to be understood, and a way to show that they are.

Understanding can be measured. The mind cannot be read. That is exactly why data about the mind deserve rules written to be understood.