California’s new workplace-surveillance law and other state proposals related to neural data illustrate how regulators are responding to privacy issues created by smart devices.
New laws and legislative proposals related to neural devices and their use in employment are extending privacy issues far beyond the healthcare system.
Privacy-related risks are extending beyond traditional privacy laws such as the Health Insurance Portability and Accountability Act (HIPAA), which protects specific health information held by certain entities. Smart devices such as watches, phones, glasses, and vehicles can collect and share vast amounts of health data, including information related to the user’s heart rate, location, sleep patterns, speech, and movement.
Although those capabilities can improve wellness, safety, and convenience, regulators are concerned that such sensitive information could be exposed or used in unexpected ways. Lawmakers are increasingly focusing on what type of data smart devices collect, what medical or private information regarding an individual can be inferred from that information, and how the resulting data is used by employers and others.
California’s newly enacted AB 1883—signed into law on September 30, 2026—illustrates that shift in the employment context. The law regulates how employers use workplace surveillance tools with AI-enabled features and, subject to specified exceptions, prohibits employers from using those tools on employees to recognize, infer, or predict an individual’s emotional state or to collect neural data. Neural data, in turn, means information “generated by measuring the activity of an employee’s central or peripheral nervous system, and that is not inferred from nonneural information.” For more information on AB 1883 and other new California workplace AI laws, see our LawFlash, California Enacts New Laws Governing Employer Use of AI.
Other states, including Illinois, are considering similar legislation. Illinois Senate Bill 2994 would amend the state’s Genetic Information Privacy Act to cover neurotechnology data and would, among other things, restrict employers from requesting or requiring such data, requiring the use of neurotechnology as a condition of employment, or making certain employment decisions based on neurotechnology data. The bill remains pending.
Both Illinois’ and California’s measures reflect growing scrutiny of how employers obtain and use information generated by technologies that interact with the nervous system.
These new developments illustrate that legal risk increasingly turns not on whether a device creates a traditional medical record, but on what type of data the device collects, what information the device detects, what the software infers, and how the resulting information is used.
HIPAA is not the whole framework.
HIPAA remains a core starting point for healthcare providers, health plans, healthcare clearinghouses, and their business associates. However, the growth of consumer and workplace devices makes the boundaries of HIPAA increasingly important, particularly because health-related data collected through those technologies may fall outside HIPAA while remaining subject to other privacy laws and other legal frameworks.
Falling outside HIPAA, however, does not mean that the collection or use of the data is unregulated. State consumer health and privacy laws may impose separate requirements. Washington’s My Health My Data Act, for instance, illustrates how those laws can apply to consumer health data derived or extrapolated from nonhealth data when that information is used to associate or identify a consumer with health-related information, including through location, browsing activity, purchases, device signals, and sensor data.
California’s AB 1883 underscores that information need not resemble a traditional medical record to raise privacy concerns in the workplace. Voice, movement, location, or video in the workplace may not independently appear particularly sensitive or suggestive of health data, but those signals can still be used to generate sensitive conclusions about an individual.
The same data can carry different legal consequences as it moves between people and settings.
Consider a patient who enters urgent care wearing a smartwatch and smart glasses and carrying a GPS-enabled phone. The watch records their heart rate and movement, the phone records their location, and the glasses may process audio, video, or objects in view.
Inside the clinic, those devices may also encounter information about other patients, including names on a triage screen, discharge instructions, prescriptions, conversations, or other protected health information. Privacy considerations may depend on whether information merely appears in a device’s field of view, is processed temporarily, is intentionally recorded, or is transmitted and retained. Device ownership alone does not resolve those questions. Who holds the information, the purpose for which it was collected, and how it is used or disclosed can change the legal analysis.
Providers should consider their own obligations to safeguard protected health information within the environment, including rules governing incidental disclosures and the need to develop practical rules that staff can follow and patients can understand.
Similar issues arise outside healthcare. Employee use of smart glasses and other wearable recording technology may implicate confidentiality, trade secrets, privacy and recording rules, workplace safety, disability accommodations, and labor-law considerations. Employers may therefore need policies addressing when and where recording or AI-enabled features may be used and how captured information may be transmitted or stored.
Context and inference also matter.
Smart devices can generate sensitive information through inference even when they do not collect information that resembles a traditional medical record. A person wearing smart glasses in a drugstore might ask whether a medication is safe to take with an antidepressant. Combined with the product in view, location, account information, and device history, that ordinary question may reveal meaningful health-related information even though no physician or insurer is involved.
Contextual data collection also raises bystander concerns. Smart glasses, vehicle sensors, microphones, cameras, and other connected products may process information about people who never chose to interact with the device. Those concerns may be heightened in healthcare facilities, pharmacies, schools, workplaces, and other sensitive settings, particularly where contextual clues identify a person or support a health-related inference. Saying “we do not collect medical records” could be accurate but still miss the broader privacy issue.
The same principle applies in the workplace. California’s AB 1883 defines workplace surveillance tools to include systems, applications, instruments, and devices that collect or facilitate the collection of employee data, activities, communications, actions, biometrics, or behaviors without direct human observation. The law does not prohibit every wearable, camera, headset, or connected system. The analysis depends in part on how the employer uses the technology. A wearable or communications headset may be used for an ordinary operational purpose, but the analysis changes if AI is used to recognize, infer, or predict emotional state, or to collect neural data. The device’s stated purpose alone may not resolve the question.
Effective governance helps manage legal risk.
Organizations using smart devices or health-related data should implement governance that reflects how the products actually work. For example, what information each device and feature collects, which vendors and AI systems receive the information, what inferences are generated, what decisions are made based on the information collected and inferences generated, and whether those practices require any updates to privacy notices, consent flows, contracts, employee policies, or product screens.
The review should also cover secondary uses such as advertising, analytics, sharing, sale, and model training, and it should address derived data, not only raw data. A company may closely control access to a field labeled “heart rate” but should pay equal attention to outputs labeled “fatigue,” “stress,” “engagement,” or “risk” because a derived output may be just as important as the underlying sensor reading. AB 1883 reinforces that point by regulating emotional-state inferences and neural-data collection.
For more healthcare, privacy, AI, and smart device news, subscribe to Health Law Scan.