Colorado Governor Jared Polis signed H.B. 24-01058 into law on Wednesday, April 17, 2024. The law amends the definition of personal information protected by the state’s privacy law to include protections for data generated by activity in the nervous system. The intent of the law is to require companies that collect, use, and disclose consumers’ neurodata to protect it as sensitive information, along with the other sensitive data elements included in the law.

The law exempts neurodata that is collected by companies that must follow other privacy and security laws, including health care providers who are regulated by HIPAA. The remainder of the privacy law remains intact.

The law will go into effect in 90 days.