Consumer brain data is now protected under California law.

Democratic Gov. Gavin Newsom’s signature last week makes it the second state, after Colorado, to recognize its citizens’ privacy rights over their brain waves.

Colorado included that right in a broader privacy law in April.

The new California law says companies like Muse, which makes a headband that analyzes brain activity to help people focus and sleep better, can’t sell or share the data they collect without consent.

Californians can also request that companies that collect brain data delete theirs.

Why it matters: Muse is far from alone in the brain data industry.

Another company, EMOTIV, sells a headband that analyzes electrical activity in customers’ brains and has collected more than 100 million minutes of brain activity.

Companies like Elon Musk’s Neuralink are building brain-computer interfaces that allow people to type without using their fingers.

Such data isn’t protected under federal law. The health data privacy law, HIPAA, applies only to health care providers and insurers and their vendors.

What’s next? Brain privacy advocates are pushing more jurisdictions to enact brain privacy laws.

The Neurorights Foundation, a New York City-based group co-founded by Columbia biological sciences professor Rafael Yuste, has successfully lobbied legislators in Chile to pass constitutional amendments that protect brain data and activity and persuaded a Brazilian state, Río Grande do Sul , to incorporate neural data protections into its constitution. He also helped promote the California and Colorado laws.

Yuste worries companies could one day use brain data to interfere with our thinking.

Yuste is lobbying more state lawmakers:

“We have a lot of pots in the fire,” Yuste said.