The Management of Individuals’ Neural Data (MIND) Act of 2025 directs the Federal Trade Commission to conduct a comprehensive study on the collection, use, transfer, and risks of neural data and related biometric/behavioral signals, and to deliver a public report within one year that recommends governance frameworks, categorizations of risk, and potential safeguards. The bill defines key terms (neural data, neurotechnology, and other related data), requires multi-stakeholder consultation, authorizes $10 million for the effort, and obligates annual updates to account for technological change.
Beyond the study, the bill forces executive-branch action: OSTP must craft guidance for federal agency procurement and operational use of neurotechnology informed by the FTC report, OMB must turn that guidance into binding agency implementation instructions, and agencies are barred from procuring or operating neurotechnology inconsistent with those instructions (with the procurement prohibition taking effect one year after OMB issues its guidance). For industry, researchers, clinicians, and privacy teams, this bill signals the likely shape of near-term federal expectations and creates an early administrative route to restrict certain uses of neural and adjacent data across government operations.
At a Glance
What It Does
Directs the FTC to study neural data governance and publish a detailed report within one year; requires OSTP and OMB to develop and issue agency guidance that becomes binding; and conditions federal procurement on compliance with that guidance. The FTC report must include categorizations of data risk, prohibited use cases, security and export analyses, and recommendations for enforcement and incentives.
Who It Affects
Developers and sellers of neurotechnology and devices that capture neural or related biometric/behavioral signals; federal agencies that procure or operate such technology; health care providers and clinical researchers who use neural data; and data brokers, advertisers, and platform operators who process sensitive behavioral signals.
Why It Matters
This is the first narrowly targeted federal legislative push to define and catalog neural data risks while building a path to immediate administrative limits on government use. The study’s definitions and recommended frameworks could become de facto standards for industry and influence FDA, CMS, and privacy enforcement by other agencies.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The bill starts by stating Congressional concerns about the monetization and misuse of neural data and related biometric or behavioral signals, and then provides clear statutory definitions so that the study covers both direct measurements of nervous-system activity and proxy signals (like heart rate variability or eye tracking) that can reveal mental states.
It mandates that the Federal Trade Commission run a one-year study and consult broadly — including OSTP, FDA, and private-sector and civil-society representatives — to map how neural and related data are collected, shared, sold, and deployed. The statute lists specific report contents: ethical and legal landscape reviews, risk categorizations, recommended governance measures (from stricter consent rules to prohibited use cases), cybersecurity and export risk assessments, and incentives or sandboxes to encourage ethical innovation.The bill also builds a fast administrative pathway from study to action.
Within 180 days after the FTC report, OSTP must draft guidance for federal agencies about which neurotechnology uses are prohibited, permitted, or conditionally allowed and about required safeguards and consent mechanisms. OMB then must convert OSTP’s guidance into binding implementation instructions within 60 days.
One year after OMB issues that implementation guidance, federal agencies may not procure or operate neurotechnology inconsistent with it. Finally, the Commission must update its findings at least annually, and Congress has authorized $10 million to carry out the initial study.
The Five Things You Need to Know
The FTC must submit a public report to Congress within one year that includes recommended data categorizations, prohibited use cases, cybersecurity assessments, and enforcement proposals.
The statute defines 'neural data' as information measuring central or peripheral nervous system activity and expands coverage to 'other related data' (biometric, physiological, behavioral signals that can reveal mental states).
Congress authorized $10,000,000 to fund the FTC study.
OSTP must issue agency guidance within 180 days after the FTC report; OMB must issue binding implementation instructions within 60 days of OSTP’s guidance; agencies face a procurement prohibition one year after OMB issues that guidance.
The FTC must publicly update the report’s findings at least annually to reflect technological change and evolving risks.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Short title
Establishes the bill’s name as the 'Management of Individuals’ Neural Data Act of 2025' (MIND Act of 2025). This is boilerplate but useful because it anchors citations in subsequent rulemaking and agency materials.
Sense of Congress
Lays out Congressional findings: neural and related data can be monetized, influence behavior, and are not well-governed by current law; vertical integration raises transparency and accountability problems; and privacy, civil liberties, national security, and equity are at stake. While nonbinding, these findings frame the policy priorities the FTC is expected to address and will shape how agencies interpret the report's recommendations.
Definitions (neural data, neurotechnology, other related data)
Provides working definitions that determine the study’s scope. 'Neural data' targets direct measures of nervous-system activity; 'neurotechnology' covers any device, system, or procedure that accesses, monitors, or alters the nervous system; and 'other related data' intentionally sweeps in biometric and behavioral proxies (heart rate variability, eye tracking, voice analysis, sleep patterns). These statutory definitions make the study—and any future guidance—likely to reach many consumer wearables and platform-provided signals, not only clinical brain‑computer interfaces.
FTC study and required report content
Directs the FTC to study authorities needed to regulate neural and related data and to recommend best practices and additional protections. The statute specifies consultations (OSTP, FDA, other agencies, private sector, academia, civil society, labor, patient groups, clinicians) and an extensive list of required report elements: uses of data, ethical and legal landscape, risk categorizations tied to governance options (from heightened oversight to prohibited uses), computational-model standards when AI is involved, sectoral risk analyses (employment, education, insurance, neuromarketing, law enforcement), security and export considerations, incentives for ethical innovation, and a proposed enforcement framework. This section is unusually prescriptive about what the Commission must analyze, narrowing the scope of its discretion and laying out topics stakeholders should address in comments and consultations.
Updates and funding
Requires annual public updates to the report to account for rapid technological change and authorizes $10 million to carry out the study. The annual-update mandate creates a standing requirement for continued monitoring, not a one-off inventory, but it does not specify funding beyond the initial authorization.
OSTP/OMB guidance and conditional federal procurement prohibition
Creates a post-report administrative pathway to constrain federal acquisition and operational use of neurotechnology. OSTP must draft guidance within 180 days after the FTC report; OMB must convert OSTP’s guidance into binding implementation guidance for agencies within 60 days. Agencies are prohibited from procuring or operating neurotechnology inconsistent with that guidance, with the prohibition becoming effective one year after OMB issues it. Practically, this makes FTC’s study the linchpin for near‑term limits on government purchases and use of neural-data technologies.
This bill is one of many.
Codify tracks hundreds of bills on Privacy across all five countries.
Explore Privacy in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Consumers and individuals concerned about mental privacy — the bill creates a formal federal review and a path to limits on government use of neural data and recommendations to restrict invasive commercial practices.
- Patients and clinical populations — the study’s focus on distinguishing beneficial medical uses from higher‑risk commercial applications can protect therapeutic innovation while calling for standards to secure medical data and post‑trial support.
- Civil society and consumer advocates — mandated consultations, public reporting, and annual updates create repeated opportunities to press for transparency, consent standards, and restrictions on manipulative uses.
- Policy-makers and agencies — OSTP, OMB, and agency leaders receive a structured, cross‑cutting analysis and a standardized framework to guide procurement and operational decisions instead of ad hoc approaches.
Who Bears the Cost
- Neurotechnology firms, device makers, and data brokers — anticipated categorizations, prohibited uses, heightened consent and cybersecurity rules, and export or transaction scrutiny will impose compliance costs and potentially limit revenue models (advertising, resale).
- Platform operators and advertisers that use behavioral signals — the bill’s reach into 'other related data' puts common ad-targeting and profiling techniques at risk of restriction or redesign.
- Federal agencies — agencies must change procurement practices, implement new consent and transparency requirements, and align operations with OMB implementation guidance, generating administrative and programmatic costs.
- Healthcare providers and researchers — if the study’s recommendations push clinical data into new regulatory regimes or tighten sharing rules, providers and academic researchers could face new barriers to data access and collaboration.
- Taxpayers and the federal budget — the $10 million authorization covers the initial study but broader implementation, enforcement, interagency coordination, and ongoing updates will require additional staff time and appropriations.
Key Issues
The Core Tension
The central dilemma is balancing protection of autonomy and mental privacy against the social and medical value of neurotechnology: strong, enforceable limits reduce risks of manipulation and discrimination but can also blunt beneficial research, clinical care, and commercial innovation—there is no technical bright line separating harmless data uses from problematic inference or influence, and the bill delegates much of that line-drawing to agency analysis and administrative guidance.
The bill chooses a study-to-guidance pathway rather than creating a new statutory private‑rights regime or direct regulatory standards enforceable against private actors. That design raises questions: the FTC report will be influential but nonbinding for private sector behavior unless subsequent rulemaking occurs.
By contrast, OSTP/OMB guidance is binding on federal agencies only—private-sector compliance would remain governed by existing laws (FTC Act, HIPAA, COPPA, FDA rules) unless agencies or Congress adopt new regulatory instruments.
Operationally, the statutory definitions sweep broadly. 'Other related data' can encompass common wearable and smartphone signals; translating the report’s recommended categorizations into workable compliance rules will be technically and legally difficult. The bill also packs many policy domains into one study—privacy, consumer protection, cybersecurity, export controls, competition, and incentives—yet authorizes only $10 million initially, which risks underfunding a genuinely cross‑agency analysis.
Finally, the interplay between recommended prohibitions 'regardless of individual consent' and established consent regimes (for example, research consent or HIPAA) is unresolved: the statute asks for recommendations but leaves open who will decide if and how those prohibitions become binding for private actors.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.