Colorado has amended its privacy statute, the “Colorado Privacy Act,” to explicitly protect “neural data.” The new amendment, signed into law by Governor Jared Polis on April 17, 2024, adds both “neural data” and “biological data” as defined terms under its umbrella of “Sensitive Data” to be protected in accordance with the statute, and which cannot be collected without first obtaining the consumer’s consent.

The new amendment defines “neural data” as “information that is generated by the measurement of the activity of an individual’s central or peripheral nervous systems and that can be processed by or with the assistance of a device.” “Biological data,” which was a previously undefined term under the statue, now means “data generated by the technological processing, measurement, or analysis of an individual’s biological, genetic, biochemical, physiological, or neural properties, compositions, or activities or of an individual’s body or bodily functions,” if the data is “intended to be used, singly or in combination with other personal data, for identification purposes.” The amendment further clarifies that “biological data” includes “neural data.”

Notably, the definition of “biological data” is confined to information used or intended to be used for identification purposes, but “neural data” contains no such confinement in its definition. Thus, it could potentially include applicable information regardless of whether it is collected or used for identification purposes.

The Colorado Privacy Act does not contain a private right of action, and vests sole enforcement authority with the Colorado Attorney General. It remains to be seen how the Attorney General will enforce this amendment. Regardless, this amendment may start a trend in favor of protecting neural data and including it in existing biometric definitions.