Every privacy law currently on the books was written before the existence of devices that read thought-adjacent signals directly from the brain. That legislative lag is not an oversight. It is a structural failure with a ticking clock attached.

The GAO’s 2026 S&T horizon report is direct about the exposure: neural data may not be covered by HIPAA when collected outside clinical settings. There is no federal comprehensive privacy legislation. State-level patchwork protection is incomplete by definition. If an employer, insurer, or data broker can access a user’s neural implant data, the inferences available — about emotional state, attention, cognitive load, intent — represent a qualitatively different category of surveillance than anything that has previously existed.

Fewer than 70 people worldwide have used a brain-computer interface that reads and decodes their neural signals. That number, drawn from the GAO’s April 2026 horizon report, is a useful corrective to the hype cycle that has surrounded this technology for years. The commercial narrative has run far ahead of clinical reality.

The more mature category of neural implants — devices that send electrical signals into the brain to alter its activity — has a larger user base. More than 200,000 people have received deep brain stimulation devices for conditions like Parkinson’s disease and epilepsy. But these are strictly therapeutic, tightly regulated, and available only to patients who have not responded to other treatments. They are not precursors to consumer products. They are medical devices.