On Saturday, Governor Gavin Newsom of California signed a new law that aims to protect people’s brain data from being potentially misused by neurotechnology companies.A growing number of consumer technology products promise to help address cognitive issues: apps to meditate, to improve focus and to treat mental health conditions like depression. These products monitor and record brain data, which encodes virtually everything that goes on in the mind, including thoughts, feelings and intentions.The new law, which passed both the California State Assembly and the Senate with no voter opposition, amends the state’s current personal privacy law — known as the California Consumer Privacy Act — by including “neural data” under “personal sensitive information.” This includes data generated by a user’s brain activity and the meshwork of nerves that extends to the rest of the body.“I’m very excited,” said Sen. Josh Becker, Democrat of California, who sponsored the bill. “It’s important that we be up front about protecting the privacy of neural data — a very important set of data that belongs to people.”With tens of thousands of tech startups, California is a hub for tech innovation. This includes smaller companies developing brain technologies, but Big Tech companies like Meta and Apple are also developing devices that will likely involve collecting vast troves of brain data.“The importance of protecting neural data in California cannot be understated,” Sen. Becker said.The bill extends the same level of protections to neural data that it does for other data already considered sensitive under the California Consumer Privacy Act, such as facial images, DNA and fingerprints, known as biometric information.Users can now request, delete, correct and limit what data a neurotech company collects on them. They can also opt out from companies selling or sharing their data.Unlike medical devices, which must abide by federal health laws, consumer neurotechnology devices go largely unregulated, experts say.An April report from the Neurorights Foundation, an advocacy group pushing for laws to protect people’s brain data around the world, including in California, examined policy documents of 30 companies and concluded that almost all have access to their user’s neural data and do not have meaningful limitations to restrict access. More than half explicitly allow user data to be shared with third parties.The new law is “a big step forward,” said Jared Genser, general counsel for the foundation, and follows similar legislation enacted in Colorado in April.The foundation is in conversation with lawmakers in other major states, including Florida, Texas and New York, Mr. Genser said.The law comes at a critical moment, experts say. Scientists have already been able to decode people’s thoughts and feelings with startling accuracy, said Rafael Yuste, a neuroscientist at Columbia University and the chair of the Neurorights Foundation.In one study, researchers were able to analyze people’s brain activity to reconstruct what they had seen in videos. In another, scientists used the brain activity of a paralyzed woman to help her convey speech and facial expressions through an avatar on a screen.“That which used to be science fiction, it’s actually not science fiction anymore,” Mr. Yuste said.The California bill gained widespread support from several medical and privacy regulatory organizations, including the American Academy of Neurology, which represents more than 40,000 neuroscientists and neurologists across the country.But some experts question whether neural data was already covered by other sections of the bill linked to biometric information, even if was not stated explicitly.“Biometric data is pretty much everything that we’ve already talked about,” said Morris Hoffman, a retired Colorado judge who conducts research on neuroscience and law. “So this does nothing except make that explicit.”Other experts said the bill was overly limited on regulating neural data when instead it should focus on preventing companies from being able to make intrusive inferences about people’s thoughts and emotions, regardless of whether the data was neural or the kind of technology used.“What matters is that you are doing a type of inference that is extremely infringing upon my privacy rights,” said Marcello Ienca, a professor of ethics of artificial intelligence and neuroscience at the Technical University of Munich, in Germany, who was not involved in crafting the bill. Whether that inference involves facial recognition, neurotechnology, biosensors or other technology is unimportant, he said.A better approach, he added, would be to regulate the algorithms underpinning these predictions, rather than targeting neural data and neurotechnology companies specifically.TechNet, a network representing tech companies like Meta, Apple and OpenAI, also pushed back against the bill, arguing that including the peripheral nervous system — the array of nerves that extend from the brain and spinal cord to the rest of the body — in the bill would “sweep too broadly and ensnare nearly any technology that records anything about human behavior.”The final draft of the bill kept the language about the peripheral nervous system but stipulated that information inferred through non-neural data would not be covered by the law. In effect, devices that measure other features of the human body, like a person’s heart rate, blood pressure, glucose or hormone levels, are left uncovered by the bill, Mr. Genser said.“I think this amendment strikes a good balance of trying to protect consumers while also allowing some space for businesses complying with the law to provide services that consumers want,” said Owen Jones, a professor of law and biology at Vanderbilt University who was not involved in the bill.The bill, Sen. Becker said, set a precedent for the tech industry globally.“California is really a technology leader for the world,” Mr. Becker said. “And so for California to step forward and say, ‘Hey, this is important, we are going to protect this information,’ I think it is really important.”