In first-of-its kind legislation, the updated Colorado Privacy Act (CPA) will consider consumer neural data as “sensitive information.” California and Minnesota are likely to follow suit.