Privacy & Cybersecurity Law Blog

On September 28, 2024, California Governor Gavin Newsom signed into law a pair of bills (A.B. 1008 and S.B. 1223) that amend the California Consumer Privacy Act of 2018 (“CCPA”) by adding a “consumer’s neural data” to the definition of “sensitive personal information” and specifying that “personal information” can exist in various formats, such as “abstract digital” formats.

Under the amendments, “neural data” means “information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information.” Other types of sensitive information under the CCPA include genetic, biometric and health data. In focusing on brain data, California joins Colorado, which previously amended the Colorado Privacy Act (“CPA”) to extend the protections of the CPA to neural data.

In addition, the amendments clarify that “personal information” can exist in various formats, including, but not limited to, all of the following: (1) physical formats, including paper documents, printed images, vinyl records, or video tapes; (2) digital formats, including text, image, audio or video files; and (3) abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.

The amendments are anticipated to become operative on January 1, 2025.