Every privacy law currently on the books was written before the existence of devices that read thought-adjacent signals directly from the brain. That legislative lag is not an oversight. It is a structural failure with a ticking clock attached.

The GAO’s 2026 S&T horizon report is direct about the exposure: neural data may not be covered by HIPAA when collected outside clinical settings. There is no federal comprehensive privacy legislation. State-level patchwork protection is incomplete by definition. If an employer, insurer, or data broker can access a user’s neural implant data, the inferences available — about emotional state, attention, cognitive load, intent — represent a qualitatively different category of surveillance than anything that has previously existed.