Workplace technology that can read your brain activity is no longer hypothetical, and Illinois legislators want to make sure the Biometric Information Privacy Act (BIPA) keeps up.

What is Neural Data?

Neural data is information produced by measuring activity in a person's central or peripheral nervous system. Think of it as data drawn from the brain, spinal cord, or nerve pathways. Unlike fingerprints or facial scans, neural data can shed light on cognitive states, focus, fatigue, and emotional responses.

This is becoming relevant for employers because wearable neurotechnology — such as headbands that detect drowsiness or earbuds that track concentration — is increasingly being developed for workplace use. Employers who adopt these tools may be collecting neural data without fully realizing it.

Growing Wave of Legislation

California and Colorado were the first states to classify neural data as sensitive personal information in 2024. Connecticut, Montana, and others have since followed, and several more states have introduced their own bills. While most of these measures target consumer privacy, legislatures are beginning to focus on the workplace as well.

Illinois: HB 2984

In Illinois, HB 2984 would amend the Biometric Information Privacy Act (740 ILCS 14/10) to bring neural data within BIPA's reach. The bill would:

• Redefine "biometric identifier" to expressly include neural data; and

• Define "neural data" as information generated by measuring activity of an individual's central or peripheral nervous system that is not inferred from non-neural information.

Because BIPA already requires written notice, informed consent, and strict data handling for biometric identifiers — and carries a private right of action — this expansion would have real consequences for any employer using technology that captures neural activity.

What to Do Now

HB 2984 has not yet been enacted, but the trajectory is clear. Employers should review any workplace tools that monitor cognitive or physiological states and assess whether their BIPA compliance policies would need updating.

We will continue to provide updates as this area of the law evolves. In the meantime, we encourage employers to treat neural data privacy as an emerging priority rather than a future concern.