Could Your Employer Own Your Dreams by 2030?

Short answer: no law in force today lets an employer claim ownership of your dreams. Six jurisdictions — Chile, California, Colorado, Montana, Connecticut, and UNESCO — now explicitly protect neural data. But these rules lock down the raw signal a sensor measures, not the inference built on top of it: what an AI deduces about your sleep, your mood, or your fatigue remains, in almost every case, a purchasable gray zone — and five of these six jurisdictions explicitly carve out the employment relationship entirely.

TL;DR

• No one is “reading” dreams. Consumer neurotechnology detects broad states — sleep, attention, stress — and EEG headset marketing consistently overstates what EEG can actually reveal.
• Chile remains the only country where an employee could plausibly win in court: a constitutional amendment in 2021, the Girardi v. Emotiv ruling in 2023, and a comprehensive data law in December 2024.
• In the United States, four states now have a law naming neural data — Colorado (2024), California (2024/2025), Montana (2025), and Connecticut (amendments effective July 1, 2026). Only one of the four, California, covers employees. The other three exclude the employment relationship by design.
• Inference is the central legal loophole, even in the one law that covers workers: California’s own definition excludes data “inferred from non-neural information” — precisely what workplace tools produce. A landmark 2024 paper in Neuron by Magee, Ienca, and Farahany argues the category “neural data” is already obsolete, proposing “cognitive biometrics” as the more honest regulatory target.
• The UNESCO Recommendation on the Ethics of Neurotechnology, adopted November 12, 2025 in Samarkand, contains the only explicit global rules on employer use — with no binding force.

The 2030 scenario, without the science fiction

Picture your 2030 annual review. Your manager pulls up a dashboard: “Overnight recovery score has dropped three nights this week. The insurance partner is offering a sleep-coaching program. In the meantime, we’re pulling you off the high-vigilance rotation.”

You never signed anything unusual. You simply wore, like a growing number of employer-equipped workers, a ring or a pair of “wellness” earbuds handed out under a workplace health program. Their sensors tracked peripheral nervous system activity while you slept. The algorithm inferred your state.

That’s the honest version of the scenario. No mind-reading machine, no dreams projected on a screen — something more mundane and harder to fight: the prediction of your mental state, industrialized and written into a contract.

The real question, then, isn’t “will my employer be able to see my dreams?” It’s “will they be able to legally buy the prediction of what my dreams reveal?” Today’s law answers: it depends entirely on which country you work in — and in most countries, it doesn’t depend on anything at all.

What neurotechnology can actually do — and what it gets credit for

Let’s set the technical boundary first, because both the fear and the marketing hang on it.

The medical case — invasive and precise. Neuralink’s N1 implant records electrical activity in the motor cortex and translates it into commands (cursor, keyboard). It doesn’t decode emotions or memories — it decodes movement intent, after lengthy individual training. It’s a medical device, not a mind reader.

The consumer case — coarse and overrated. The overwhelming majority of users don’t buy implants. They buy EEG headsets, sleep bands, sensor-equipped earbuds. These devices detect broad states: wakefulness, deep sleep, relaxation, rough approximations of focus. They don’t read a specific thought.

The Chilean Girardi v. Emotiv ruling (more below) illustrates exactly this gap: Emotiv’s Insight headband collects “data on gestures, movements, preferences, reaction times, and cognitive activity” — a behavioral profile, not an open window into consciousness.

History shows that extraction claims race ahead of the evidence. In 2018, the South China Morning Post reported that Chinese factories were fitting workers with sensor-equipped caps meant to detect depression, anxiety, and anger. An official at State Grid Zhejiang Electric Power claimed the technology had generated 2 billion yuan (roughly $315 million) in profit since 2014 — a figure that, to date, has never been independently corroborated. MIT Technology Review called it “wildly dubious” at the time and noted that the link between surface EEG signals and emotions remains poorly established. Keep the doubt, not the number — it’s the technical skepticism, not the financial estimate, that has held up.

An EEG headset doesn’t measure your anger. It measures scalp microvolts that an AI turns into a score — a score that can be wrong, even when the management decision built on it isn’t treated that way.

The decisive legal detail is buried in the terms of service. In the Chilean case, Emotiv’s terms stated the company “owns all information, derived metrics, and data added to the scan data.” Your brain produces the signal; the contract assigns the derived product. That’s what dream ownership looks like in 2026: not an expropriation of thought, but an assignment clause on the metrics.

Chile: the only jurisdiction where an employee could actually sue

In four years, Chile has built the most complete legal architecture in the world.

2021 — the Constitution. Law 21.383 amended Article 19(1): the state must “specially safeguard brain activity and the information derived from it.” This is an enabling clause — it authorizes future law to regulate employer use of neurotechnology beyond therapeutic contexts. It doesn’t yet prohibit anything on its own.

2023 — the judicial precedent. On August 9, 2023, Chile’s Supreme Court decided Girardi v. Emotiv. Guido Girardi, a former senator and physician, had bought Emotiv’s Insight headband, created a cloud account, and then discovered his brain data was stored with no export option under the free tier — and that the company retained it for research purposes even after account closure.

The Court ruled in his favor: commercializing and storing electrical brain activity data affects physical and psychological integrity and privacy. It ordered Girardi’s data deleted.

It’s the first court ruling of its kind anywhere in the world — but Chilean legal scholarship itself tempers the enthusiasm:

• The Court avoided classifying brain data as “personal data” under the 1999 law.
• It applied, as a workaround, the consent regime used in biomedical research.
• The health authority later found its own classification partly at odds with the Court’s reasoning.

A powerful symbolic precedent and a fragile legal foundation are both true at once — and the second matters more for any employee who might sue tomorrow.

2024 — the general law. In December 2024, Law 21.719 overhauled the framework entirely: a new Data Protection Agency, classification of biometric data and the “human biological profile” as sensitive data, and substantial penalties for the most serious violations. A dedicated neurotechnology bill, under discussion since 2020, would go further still — banning influence over a person’s conduct without consent and creating criminal penalties for unauthorized data extraction.

Verdict for a Chilean employee: a constitutional foundation, a dedicated agency, case law, and likely a dedicated criminal statute before long. It’s the only country where the sentence “my employer cannot demand my brain scan” has real legal footing. Everywhere else, it’s a negotiating position, not a right.

United States: four states, one protection that actually covers workers

The American contrast with Chile is nearly a perfect inversion — and it’s gotten sharper, not softer, with two new laws in 2025 and 2026 that confirm the same pattern.

Colorado — the first US law, with a gaping hole

Colorado signed HB 24-1058 on April 17, 2024, effective August 7, 2024. “Neural data” — information generated by measuring central or peripheral nervous system activity, processed with the help of a device — became sensitive data under the Colorado Privacy Act.

The practical consequence for a consumer vendor: explicit opt-in consent before any processing, mandatory impact assessments.

The hole: the law exempts data collected in an employment context — an exclusion shared by most US data-privacy statutes. The result: in Colorado, the first US state to name neural data in its law, an employer who equips workers with sensors sits outside the reach of that very law.

California — the only real protection for employees, and its blind spot

Since January 1, 2023, the CCPA has applied fully to employee data — the HR exemption expired. SB 1223, signed September 28, 2024 and in effect since January 1, 2025, classifies neural data as “sensitive personal information.” A California employee can invoke CCPA rights to know, limit, and delete.

But the legal definition explicitly excludes anything “inferred from non-neural information” — that’s the statutory text itself. And what do most HR tools actually produce? Inference: sentiment analysis on written communications, engagement scores, fatigue estimated from typing cadence. Sentiment analysis run on text or voice sits, by construction, outside the law’s reach.

Montana — real protection, for a small handful of companies

On May 2, 2025, Montana enacted SB 163, which doesn’t add neural data to a consumer-privacy law but grafts it onto the existing Genetic Information Privacy Act, effective October 1, 2025. “Neurotechnology data” is defined broadly there — any information derived from measuring central or peripheral nervous system activity.

The gap is different from Colorado’s, but just as real. Montana’s law doesn’t expand which entities are regulated. It still applies only to companies already covered by the genetic-privacy statute — essentially consumer DNA-testing companies. A sleep-band manufacturer, an HR software vendor, or an employer distributing wellness trackers simply falls outside the law’s scope, however sensitive the data they collect.

Connecticut — confirming the same pattern in mid-2026

On June 24, 2025, Connecticut enacted SB 1295, adding neural data to the list of “sensitive data” under the Connecticut Data Privacy Act, effective July 1, 2026. The amendment also lowers the law’s applicability threshold to 35,000 residents and removes any minimum threshold once a company processes sensitive data at all.

But the law excludes the employment relationship by definition. The Connecticut Data Privacy Act protects a “consumer” acting in an individual or household capacity — and expressly excludes employees and job applicants acting within an employment relationship. Law firms tracking the amendment put it plainly: of the four states that have named neural data in statute, California is the only one that treats employee data as falling within its consumer-privacy law at all.

The US scorecard as of mid-2026, in one sentence: four states protect the raw neural signal in some form — Colorado, California, Montana, Connecticut — and three of them structurally exclude the employment relationship, each through a different mechanism (an employment exemption, too narrow an entity scope, a “consumer” definition that excludes workers). This isn’t an isolated legislative oversight. It’s the default reflex of American data law, repeated four times running.

The global scale: explicit worldwide rules, with no binding force

UNESCO has produced the text most directly useful to the world of work. On November 12, 2025, at its 43rd General Conference session in Samarkand, member states adopted the Recommendation on the Ethics of Neurotechnology — the first global normative instrument on the subject, prepared by an expert group co-chaired by Professor Nita Farahany.

Its employment provisions have no equivalent elsewhere in international law:

• Any workplace use of neurotechnology requires the employee’s explicit consent, reserved for safety and wellbeing — not for productivity at the expense of health.
• Employers must let employees obtain a copy of their own data, including the neuro-biometric readings and the interpretations drawn from them, in an understandable format.
• Collection outside the workplace and outside working hours is prohibited, with a requirement for technical safeguards.
• Marketing through neurotechnology during sleep must be banned outright — a clause that, on its own, says a great deal about what some vendors were already considering commercially viable.

The problem remains unresolved, and a March 2026 piece of legal scholarship from Stanford Law School states it precisely: a Recommendation binds no one, and the consent model it nonetheless still leans on is structurally inadequate against systems that generate probabilistic inferences about mental states the user neither understands nor controls. The Recommendation sets a benchmark now citable before any court or legislature; it sets no obligation either is required to follow.

The central gray zone: inference, exactly where the money goes

The whole system rests on a technical distinction that laws struggle to capture:

The UK’s ICO formalized this distinction back in 2023: “neurodata” comes in two orders — first-order data collected directly, and second-order inferences built on top of it.

Three leading researchers — Patrick Magee, Marcello Ienca, and Nita Farahany, of Duke University and the Swiss Federal Institute of Technology in Lausanne — draw out the consequence in a paper published in Neuron in September 2024: the category “neural data” is too narrow a regulatory target. Their proposed alternative, which they call “cognitive biometrics,” would regulate based on the inference a system enables and the risk it poses to mental life, rather than the technical source of the signal alone. Inferring a mental state from voice, text, or movement, they argue, produces the same intrusive power without ever touching a neuron.

In March 2026, a piece of legal scholarship published on Stanford Law School’s Law and Biosciences Blog extends this point onto legal ground: the consent architectures that structure American privacy law provide almost no mechanism for contesting an algorithmic inference as such, as opposed to the collection of the signal that fed it. The article surveys the four state laws discussed above — California, Colorado, Montana, Connecticut — as the only existing anchors, while noting that none of them solves the inference problem.

Why does this one point decide 2030? Because the “dreams” scenario doesn’t run through a nighttime EEG band — it runs through aggregation. A watch knows overnight heart rate; a phone knows screen-time patterns; a keyboard knows morning typing rhythm; a messaging app knows the tone you use. A model trained on millions of workers fuses these streams and outputs a “recovery index.”

None of these sources is, individually, neural data under the CCPA. Together, they produce a reading of an employee’s night finer than any $300 EEG headset could ever deliver. The neurotechnology of the employer’s nightmare isn’t one more sensor — it’s the fusion of the ones the employee already owns.

Toward 2030: three real vectors, one fictional consent

1. The medical-professional boundary. When an implant durably restores someone’s ability to work, the resulting data stream becomes a genuine labor issue. Who owns the decoder when the tool that lets someone earn a living also emits state metrics? No law anywhere answers this yet.

2. “Voluntary” augmentation. Once focus-boosting earbuds get marketed as a competitive edge, the employee who declines to wear the device will, in practice, be penalized for it. UNESCO explicitly named this as a risk of new forms of inequality.

3. The fiction of consent in employment. The lesson of the 2018 Chinese factory cases isn’t technological — it’s structural. Workers in a weak economic position cannot meaningfully say no to a device their management offers them. An employee facing a “wellness” program is not in the same power relationship as a consumer facing a vendor. That’s precisely the blind spot Stanford Law’s analysis points to: a consent-based model assumes two parties who can each refuse without cost — a symmetry labor law does not guarantee, and one that four-for-four US state laws continue to leave unaddressed, each in its own way.

A genuine counter-example, for the sake of honesty: a sensor that triggers an alarm when a high-speed train driver falls asleep can save lives. UNESCO’s Recommendation recognizes this by limiting acceptable workplace use to safety and wellbeing. The decisive test, then, isn’t “sensor or no sensor” — it’s: does the purpose protect the worker, or only the employer’s output — and can the worker decline without losing anything?

What’s still missing, and where the protection is weakest

Europe hasn’t named the problem yet. GDPR treats biometric data as a special category — but only when it’s used to identify a person, the same limitation that weakens several American laws. No European text currently contains anything equivalent to UNESCO’s employment clauses. In France, workplace biometrics require approval from the works council (Comité social et économique) under the Informatique et Libertés law — real protection for access control or time-clocks, silent on inference or on wellness devices an employer hands out.

For an employee in France, Germany, Brazil, or Japan in 2026, the toolkit applicable to neural metrics at work amounts, in practice, to general privacy rules — often invocable in theory, rarely used in practice. And even for a US employee, the map no longer reduces to “California protects, Colorado doesn’t”: the landscape got more complex in 2025-2026 without, at any point, closing around the employment relationship.

What this legal map actually reveals

What the six jurisdictions examined here share isn’t their differences — it’s a common logic. Each protects what it can measure and name: a signal, a sensor, a device. Each lets slip whatever a model deduces from it. Chile managed to reach into the employment relationship because it started from a constitutional right to mental integrity, not from a list of data types. The four American laws, by contrast, were all born from the same reflex: bolt a new sensitive-data category onto an existing consent regime — a reflex that runs into inference and into the employment relationship, structurally, four times in a row, through four different exclusion mechanisms.

That regularity, more than any single provision, is what 2030 is likely to look like: not an employer literally reading thoughts, but an employer legally buying a score on what your data — neural or not — lets someone guess about your night.

If you’re an employee:

• Ask, in writing, for a copy of the “wellness metrics” collected on you — in California, that’s a CCPA right; elsewhere, it’s a good test of company culture.
• Treat any “voluntary” neuro device as a negotiation, not a gift: purpose, retention period, who sees the aggregates, consequences of declining.
• Refuse collection outside working hours by default — that’s the UNESCO rule, invocable even without the force of law.

If you’re in HR, leadership, or corporate legal:

• Ban any internal use of neural metrics for productivity purposes; reserve them for safety, with mandatory human review.
• Put in writing that personal-device data never feeds HR decisions, even in anonymized aggregate form — researchers increasingly dispute whether neural data can be meaningfully anonymized at all.
• Review vendor contracts: the “the vendor owns all derived metrics” clause that exposed Emotiv in Chile needs to become, in your contracts, a refusal clause.

If you’re a legislator: the reform that actually matters isn’t adding a fifth state law built on the same template. It’s extending protection to inferred mental data, as Magee, Ienca, and Farahany argue, and closing the employment exclusion that three out of four US laws still carry. As long as both gaps remain open, every new law adds a box to the map without changing the territory.

Primary sources: HB 24-1058, Colorado General Assembly · SB 1223, California Legislature · Montana SB 163 (2025), amending the Genetic Information Privacy Act · Connecticut SB 1295 (2025), amending the Connecticut Data Privacy Act, effective July 1, 2026 · UNESCO Recommendation on the Ethics of Neurotechnology, November 2025 · Magee, Ienca & Farahany, “Beyond Neural Data: Cognitive Biometrics and Mental Privacy,” Neuron, vol. 112, no. 18 (2024) · “Who Owns Digital Thoughts?”, Stanford Law School, Law and Biosciences Blog, March 2026 · MIT Technology Review, 2018