Your smartwatch can tell you that you slept badly, your heart rate variability is down, and your “readiness” is low. For most people, that’s a report to glance at over morning coffee. But a fast-growing class of wearables does much more with the same data, running your sleep, heart rate, and movement through models that draw conclusions about your mental state. WHOOP’s Stress Monitor converts heart rate variability and resting heart rate into a daily stress score. Oura and Garmin ship comparable stress and resilience readings, and researchers have shown the same signals can flag depression risk.
Here’s the problem: those conclusions fall outside almost every rule written to protect health data. And once generated, they can become valuable products on their own. A 2023 Duke University study found data brokers openly selling lists of Americans identified by depression, anxiety, and PTSD — for as little as a few hundred dollars, with no HIPAA protection in sight. The report warned that health insurers could use the data to set rates or target vulnerable people with ads, and that scammers could buy it to exploit them.
Recording isn’t the same as inferring
How does an assessment that sensitive escape regulation? Because the law protects measurements, not judgments.
A heart rate reading is a measurement — a fact about your body at one moment. “This person is at elevated risk for depression” is a judgment, produced when an algorithm studies weeks of your measurements and characterizes your mental state. The judgment reveals far more about you than any single number behind it. It’s also the part these wearables are increasingly built to sell — and the part no privacy rule was written to reach.
A 2026 study tracking older adults over three years found that smartwatch and smartphone signals — sleep patterns above all — could classify depressive symptoms. WHOOP analyzed 7.9 million days of its own members’ biometrics against hundreds of thousands of mental health surveys and reported that heart rate variability, resting heart rate, and sleep consistency tracked self-reported depression and anxiety, not just stress.
You can see the raw data your device collects, but not always the conclusion drawn from it. A company may decide you show signs of chronic stress and never tell you. It could flag — and withhold — something as sensitive as depression risk. Nothing requires the company to disclose that conclusion, prove its accuracy, or keep it off the market.
The laws that should cover this don’t
Neural data laws protect the wrong signal. Colorado, California, Montana, Connecticut, and Vermont have all passed laws protecting “neural data.” But those statutes were written for devices that read the brain directly — EEG headsets and brain-computer interfaces capturing electrical activity from your nervous system. Your smartwatch never touches a brain signal. It infers your mental state from your wrist, and the inference isn’t covered. In the first six weeks of 2026, lawmakers in six states introduced new neural data bills. Every one targets brain signals. None addresses what wearables infer.
The FDA just stepped back. At CES in January, FDA Commissioner Marty Makary announced updated guidance loosening regulation of general wellness products. The agency now treats products that use sensors to estimate or infer health indicators as wellness tools rather than medical devices. As long as companies avoid diagnostic claims, they can reach the market without FDA review.
HIPAA was never in play. It protects data held by clinics, hospitals, and health plans. You bought your wearable at Best Buy. No clinical relationship, no HIPAA.
A few laws partly reach this. Connecticut’s broader privacy law gives consumers a right to know the inferences companies hold about them, and Washington’s consumer health data law covers some health conclusions drawn from non-health data. But those protections apply unevenly — turning on a company’s size and how it frames its product — and none was designed for AI estimates of your mental state.
What happens when you bring it to your doctor
Clinicians already see patients arrive with sleep scores and heart-rate trends. Increasingly, those visits involve an algorithm’s verdict rather than a raw number. If your wearable convinces you it detected burnout or depression, you carry that belief into the exam room — and your doctor has no way to know how the device reached its conclusion or how often it’s wrong. Reassuring you risks waving away a real signal; agreeing risks endorsing an unproven one. The opacity that hides these assessments from regulators hides them from doctors, too.
The neural data laws guard a brain signal the wearable never records. The FDA treats its output as wellness. HIPAA covers only the clinic. The depression risk it calculates about you is what none of them was written to reach.