Regulating the Mind: Neuromarketing, Neural Data and Stakeholder Trust Under California’s CCPA

Abstract

This study investigates how neuromarketing practices intersect with consumer privacy regulation in California, with particular attention to the 2024 Senate Bill 1223 (SB 1223), which amends the CCPA/CPRA to explicitly define “neural data.” By examining corporate strategies and regulatory frameworks, the paper evaluates how firms navigate the tension between innovation, ethics, and consumer protection. A qualitative, multiple-case study approach was adopted, focusing on Coca-Cola, Frito-Lay, and Hyundai. Data were collected from corporate privacy policies, industry publications, and legislative documents, triangulated through doctrinal legal analysis and cross-case synthesis. The analysis reveals that, while companies comply with disclosure, consent, and oversight requirements under the CCPA/CPRA, such compliance remains largely procedural, with transparency often being technical rather than consumer-friendly, consent being insufficiently informed, and protections for vulnerable groups being inconsistently enforced. SB 1223’s recent definition of neural data directly encompasses techniques such as EEG, fMRI, eye-tracking, and biometrics, underscoring the urgent need for firms to treat neuromarketing as a category of regulated practice rather than discretionary innovation. The study is limited by its reliance on publicly available documentation and by the recency of SB 1223, which precludes observation of mature compliance patterns. Future research should explore consumer perceptions, track evolving regulatory responses, and extend the analysis across various sectors, including healthcare, education, and non-profits. This study contributes to theory by extending stakeholder theory to neural data governance and by conceptualizing neuromarketing as a governance-intensive strategic capability situated at the frontier of consumer rights and technological innovation. It contributes to practice by demonstrating how firms can transform compliance with emerging neural data regulations into a strategic capability that strengthens consumer trust, ethical legitimacy, and brand equity.

1. Introduction

The rapid evolution of neuromarketing has transformed how firms engage with consumers by leveraging brain imaging, eye tracking, biometrics, and other neuroscientific tools to uncover subconscious drivers of decision making. These techniques promise powerful insights for creating emotionally resonant marketing strategies, yet they simultaneously raise profound ethical and legal concerns. The potential for covert data collection, manipulation of consumer autonomy, and inadequate safeguards for vulnerable groups makes neuromarketing a contested frontier of both marketing innovation and consumer protection. As legislation struggles to keep pace with technological advancement, the ethical alignment of neuromarketing practices has become an urgent global issue (Chand et al., 2025; Kesarwani et al., 2025).

California’s Consumer Privacy Rights Act (CCPA/CPRA), enacted as one of the strictest privacy frameworks in the United States, offers a unique lens through which to assess these challenges. By granting consumers extensive rights over personal and biometric data, the Act directly shapes how neuromarketing practices are implemented (Chen et al., 2021; Crepax, 2025). However, compliance with CCPA/CPRA does not automatically guarantee ethical sufficiency, nor does it address inconsistencies between U.S. state-level privacy regimes and international frameworks such as the European Union’s General Data Protection Regulation (GDPR). These divergences highlight both the complexity of regulating neurodata and the risks of fragmented global governance (Eleanor, 2021; Norton & Breaux, 2025).

This study seeks to address these gaps by analyzing how leading corporations—Coca-Cola, Frito-Lay, and Hyundai—apply neuromarketing under California’s privacy legislation while situating their practices within broader debates on consumer protection. Drawing on stakeholder theory, the research evaluates how firms balance innovation with the responsibility to safeguard consumer trust. Through comparative analysis with the GDPR, the study further examines California’s role as a regulatory “laboratory” and identifies lessons for global policymaking.

The study makes three key contributions. First, it provides an empirical and theory-driven assessment of corporate neuromarketing practices under the CCPA/CPRA, moving beyond descriptive accounts to evaluate the substantive quality of transparency and consent mechanisms. Second, it demonstrates the strategic potential of ethical neuromarketing as a capability for building brand equity and consumer loyalty, reframing the debate from risk avoidance to value creation. Third, it proposes actionable policy innovations—including standardized disclosure formats, interactive consent dashboards, and independent ethical review boards—that extend beyond compliance to proactive consumer protection.

By integrating legal analysis, case study evidence, and theoretical framing, this paper advances the scholarly discourse on neuromarketing ethics while offering practical guidance for organizations, policymakers, and researchers. In doing so, it highlights that the future of neuromarketing lies not in exploiting unconscious processes for short-term gains but in integrating responsibility and transparency into marketing strategies to secure long-term trust and a sustainable competitive advantage.

Neuromarketing utilizes a range of neuroscientific methods to investigate consumer cognition and emotion beyond self-reported preferences. Among the most widely used tools are functional Magnetic Resonance Imaging (fMRI) and electroencephalography (EEG). fMRI provides detailed images of brain regions activated by specific stimuli, offering insights into how consumers engage with advertisements and products, whereas EEG captures rapid changes in brain activity with high temporal resolution, making it especially useful for evaluating dynamic advertising content (Khurana et al., 2021; M. V. Goncalves et al., 2022).

In addition to brain imaging, firms increasingly use eye tracking to analyze visual attention to advertisements, packaging, and in-store displays, as well as biometric measures such as heart rate, skin conductance, and facial coding to capture emotional and physiological responses. These methods allow marketers to refine product design, optimize packaging, and craft advertising campaigns that resonate emotionally with consumers (M. Goncalves et al., 2023; Abu & Lyan, 2024).

Applications extend beyond advertising and product development into areas such as pricing strategies, where neuromarketing helps firms identify consumers’ perceptions of value. Additionally, in organizational contexts, neuroleadership and neuromanagement frameworks apply neuroscience to leadership development and employee engagement (Gkintoni et al., 2022; Sengur & Goncalves, 2023; Aithal & Satpathy, 2024). While these approaches illustrate the breadth of neuromarketing’s potential, they also highlight the urgency of addressing the ethical challenges associated with collecting and applying sensitive neurodata.

This study aims to fill the gaps in the extant literature by comprehensively analyzing the interaction between cutting-edge marketing technologies and evolving privacy laws. It seeks to identify and recommend solutions to marketers’ potential ethical dilemmas, aiming to integrate neuromarketing strategies within the legal framework established by the recent consumer privacy legislation. This addresses a critical knowledge gap by providing insights into the balance between innovative marketing techniques and ethical and legal considerations for protecting consumer privacy. The central question of this study is how neuromarketing practices can be ethically aligned with new consumer privacy laws, particularly the California Consumer Privacy Rights Act, to protect consumer autonomy and trust.

2. Literature Review

Neuromarketing has emerged as a powerful interdisciplinary field at the intersection of neuroscience, psychology, and marketing, seeking to uncover the implicit drivers of consumer decision making that often elude conscious awareness. By moving beyond self-reported attitudes and stated preferences, neuromarketing techniques aim to capture nonconscious, affective, and physiological responses that traditional surveys and focus groups are unable to reliably detect. Tools such as functional magnetic resonance imaging (fMRI), electroencephalography (EEG), eye tracking, and biometric measures provide marketers with granular insights into consumers’ attention, emotional arousal, and the neural correlates of choice (Khurana et al., 2021; M. V. Goncalves et al., 2022). These tools are increasingly deployed in diverse contexts, ranging from advertising effectiveness testing and product design to sensory branding and pricing strategies, enabling firms to tailor their offerings with unprecedented precision (Frederick, 2022; Abu & Lyan, 2024).

Beyond their applied value, neuromarketing techniques have also been positioned as a source of competitive advantage, allowing firms to differentiate themselves through deeper consumer engagement and more resonant brand experiences (Mehta, 2024). At the same time, their adoption signals a paradigm shift in marketing research—from reliance on declarative methods toward data-driven behavioral and neurophysiological analytics. This shift carries both scientific promise and ethical complexity: while it enhances predictive accuracy, it also raises concerns about manipulation, autonomy, and privacy. In this respect, neuromarketing is not only a technological innovation but also a site of regulatory contestation, where debates about consumer rights, data governance, and stakeholder legitimacy intersect with business strategy (M. Goncalves et al., 2024; Ireland, 2024). Thus, the rise in neuromarketing cannot be understood solely as an advance in methodological sophistication; it must also be situated within broader conversations about the responsible use of neuroscience in commercial contexts.

Despite its promise, neuromarketing has sparked intense ethical debate, with scholars warning that the very features that make it powerful—its ability to access unconscious processes and bypass rational deliberation—also pose profound risks to consumer autonomy and dignity (M. V. Goncalves et al., 2022; M. Goncalves et al., 2024). Concerns center on the possibility that neuromarketing may be used not merely to understand preferences but to manipulate choices in ways that consumers cannot fully recognize or resist (Pluta-Olearnik & Szulga, 2022; Minz et al., 2024). This raises fundamental questions about whether neuromarketing practices respect the principle of informed consent or whether they exploit cognitive biases and emotional vulnerabilities for commercial gain. Critics further argue that reliance on neurodata introduces heightened privacy risks, as biometric and neurological information is uniquely sensitive, deeply personal, and, once disclosed, cannot easily be anonymized or retracted (Luna-Nevarez, 2021).

A growing body of literature also highlights distributive and societal dimensions of these concerns. Vulnerable groups—such as children, the elderly, and individuals with cognitive impairments—may be disproportionately affected by neuromarketing campaigns, given their reduced capacity to critically evaluate persuasive techniques (Caratù, 2019; Kritika, 2025). Moreover, unequal access to neuromarketing technologies risks exacerbating power imbalances between global corporations with significant resources and consumers with limited awareness of how their neurodata are being collected and applied (Sindhuja & Malik, 2024). These debates extend beyond individual-level ethics to questions of social justice and democratic accountability, as the capacity to shape consumer behavior at a subconscious level carries implications for the functioning of markets, the fairness of competition, and the protection of civic freedoms.

Taken together, the literature portrays neuromarketing as a double-edged phenomenon: a methodological breakthrough that can enrich consumer insights and improve market efficiency but also a practice that challenges long-standing ethical norms in marketing and consumer research. The lack of consensus on how to balance innovation with consumer protection underscores the importance of regulatory frameworks and corporate governance mechanisms that can mediate these tensions and preserve stakeholder trust.

At the regulatory level, scholarly debate reflects divergent legal philosophies that shape the governance of neuromarketing across jurisdictions. The European Union’s General Data Protection Regulation (GDPR) enshrines privacy as a fundamental human right, mandating explicit, informed opt-in consent for the collection and processing of personal and biometric data, with strong extraterritorial enforcement mechanisms. In contrast, the California Consumer Privacy Act (CCPA, 2018), later strengthened by the California Privacy Rights Act (Bukaty, 2021), frames privacy primarily as a consumer right within a market-based paradigm. Rather than emphasizing universal rights, California’s framework empowers individuals through data access, deletion, and opt-out provisions while placing new compliance obligations on firms regarding transparency and consent. Scholars note that these philosophical differences have significant implications for neuromarketing, particularly because neurodata straddles the boundary between personal information and sensitive biometric data, raising questions about its appropriate legal classification (Buresh, 2022; Reddy & Rajendran, 2025).

This divergence has created both opportunities and challenges. On one hand, California’s state-level innovation has positioned it as a regulatory “laboratory” in the U.S., pioneering protections for biometric and neurodata that could eventually inform federal or international frameworks (George, 2024; Aloamaka et al., 2025). On the other hand, the absence of consistent federal regulation has produced a fragmented environment in which corporations must navigate multiple overlapping standards, exposing consumers to uneven levels of protection depending on jurisdiction (George, 2024; M. Goncalves et al., 2024). Comparative legal scholarship suggests that this patchwork of rules risks undermining both enforcement effectiveness and consumer trust, while simultaneously creating strategic uncertainty for firms seeking to implement neuromarketing on a global scale (Sposini, 2024; Ferrell et al., 2025). Similar concerns are evident in Central and Eastern Europe, where legal scholarship has shown that even established e-commerce regimes face significant limits in protecting consumers against manipulative or opaque practices.

For instance, Peráček (2022) demonstrates that the Slovak Republic’s consumer protection framework struggles to keep pace with digital commerce, underscoring the broader challenge of ensuring consistent safeguards across jurisdictions. Recent comparative legal analyses further underscore the uneven global landscape, noting that divergent regulatory traditions complicate the development of coherent safeguards for consumer data and neuro-information. Miço Bellani and Leci (2024) highlight how international legal scholarship increasingly grapples with balancing national regulatory autonomy and the need for harmonized consumer protections, an issue directly relevant to the governance of neuromarketing practices.

Existing literature has provided valuable conceptual analyses of neuromarketing ethics and preliminary evaluations of regulatory frameworks (Gallucci & Garofalo, 2018; Ram Kailash et al., 2024). However, significant gaps remain that limit both theoretical advancement and practical applicability. First, much of the scholarship continues to emphasize ethical risks in the abstract, offering normative critiques without systematically examining how corporations translate legal requirements into operational practices. As a result, there is limited empirical evidence on whether compliance mechanisms function in ways that substantively protect consumer autonomy or merely achieve procedural conformity. Second, cross-jurisdictional comparisons between California’s evolving privacy regime and more established frameworks such as the GDPR are still underdeveloped, leaving open questions about the extent to which California’s model may serve as a prototype for future federal or international governance. Finally, few studies employ explicit theoretical lenses to interpret the ethical implications of neuromarketing. In particular, the application of stakeholder theory remains rare, despite its potential to illuminate how neuromarketing practices affect not only individual consumers but also broader dimensions of trust, legitimacy, and corporate responsibility across stakeholder networks. Addressing these gaps is crucial for advancing the field beyond descriptive accounts toward a more theory-driven, comparative, and policy-relevant research agenda.

California Senate Bill 1223 and the Regulation of Neural Data

An important recent development in the governance of neuromarketing is California Senate Bill 1223 (SB 1223), signed into law in 2024. The bill amends the CCPA and its 2020 amendment, the CPRA, by revising Civil Code Section 1798.140 to explicitly recognize and regulate “neural data.” Under SB 1223, neural data is defined as “information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information.” This statutory definition marks the first legislative effort in the United States to treat neural signals as a distinct and highly sensitive category of personal data (Spitzer & Totten, 2023; Browning, 2024). This definition directly encompasses the primary neuromarketing techniques discussed in this study, including EEG and fMRI, which measure brain activity, as well as eye-tracking and biometric sensors that record peripheral nervous system responses. By explicitly recognizing these data streams as neural data, SB 1223 situates common neuromarketing practices within the scope of statutory consumer protection.

The significance of SB 1223 for neuromarketing lies in its direct acknowledgement of the ethical and privacy risks associated with collecting and analyzing neurophysiological information. Unlike traditional biometric data such as fingerprints or facial images, neural data captures subconscious emotional and cognitive responses, offering unprecedented insight into consumer decision-making processes. By incorporating neural data into the CCPA/CPRA framework, SB 1223 extends the scope of consumer protections to cover information most relevant to neuromarketing techniques, including EEG, fMRI, and other forms of neurophysiological monitoring (Ferrell et al., 2025).

This amendment is critical for several reasons. First, it establishes a clear legal boundary for firms using neuromarketing technologies, requiring that data collection, storage, and use adhere to the same transparency, consent, and consumer rights provisions that govern other categories of sensitive information. Second, it signals the growing recognition by lawmakers that advances in neuroscience create qualitatively new privacy risks, necessitating proactive legislative responses. Third, it provides a regulatory precedent that may influence future state, federal, and even international approaches to neurodata governance (Browning, 2024; Francis, 2024).

For the purposes of this study, SB 1223 is particularly important because it underscores the legal and ethical context in which firms like Coca-Cola, Frito-Lay, and Hyundai operate. By embedding neural data within California’s broader privacy framework, the bill elevates neuromarketing from a matter of voluntary corporate ethics to one of statutory compliance. It is important to note, however, that SB 1223 was only signed into law in 2024. As such, corporate compliance cannot yet be empirically established. This study, therefore, interprets company practices primarily as indicative of alignment with the principles embedded in SB 1223, rather than as evidence of fully institutionalized compliance. This shift reinforces the central argument of the present research: compliance with privacy legislation is a necessary condition for responsible neuromarketing, but true legitimacy also requires firms to adopt proactive ethical leadership that goes beyond the legal minimum (M. Goncalves et al., 2024; Reddy & Rajendran, 2025).

This paper seeks to address these gaps by conducting an empirical and theory-driven analysis of the neuromarketing practices of three global firms—Coca-Cola, Frito-Lay, and Hyundai—within the regulatory framework of the CCPA/CPRA. By integrating doctrinal legal analysis with corporate case evidence, the study demonstrates how compliance strategies are operationalized in practice. It assesses the extent to which they align with or fall short of ethical leadership. In addition, the research introduces a comparative perspective by examining how California’s evolving model contrasts with the GDPR, thereby positioning California as a potential prototype for future global governance of neurodata. The application of stakeholder theory provides a further layer of originality, enabling the analysis to move beyond consumer-focused evaluations to consider how neuromarketing affects broader stakeholder trust, legitimacy, and corporate responsibility. Collectively, these elements allow the study to advance the debate from descriptive accounts of compliance toward a theory-informed, comparative, and policy-oriented framework for understanding neuromarketing ethics. In doing so, the paper contributes not only to academic discourse but also to managerial practice and regulatory design, offering actionable insights for organizations seeking to balance innovation with ethical responsibility in an era of intensifying scrutiny over data-driven marketing.

Building on these insights, this study applies stakeholder theory as an interpretive lens to evaluate how neuromarketing practices are implemented under California’s CCPA/CPRA and how they align with broader ethical obligations. By doing so, the analysis moves beyond a narrow focus on consumer compliance mechanisms to examine questions of trust, legitimacy, and corporate responsibility across multiple stakeholder groups. This theoretical framing also provides a foundation for comparing California’s model with the GDPR, highlighting how different regulatory approaches distribute rights and responsibilities among stakeholders. In this way, stakeholder theory not only strengthens the analytical depth of the study but also ensures that its contributions are relevant to academic debates, managerial practice, and policy development.

While the literature provides valuable insights into neuromarketing practices and regulatory responses, a clear theoretical lens is needed to guide the present analysis. Accordingly, the following section outlines the theoretical framework underpinning this study, drawing on stakeholder theory and regulatory pluralism to interpret how firms navigate the ethical and legal complexities of neural data governance.

3. Theoretical Framework

This study is underpinned by two complementary perspectives: stakeholder theory and regulatory pluralism. Together, these frameworks provide both a normative and analytical basis for interpreting the governance of neuromarketing and neural data under the CCPA/CPRA and its 2024 amendments.

Stakeholder theory emphasizes that firms generate legitimacy and long-term value not only through profit making but also by safeguarding the rights and well-being of multiple constituencies, including consumers, regulators, employees, and the wider public (Ahirwar & Singh, 2025). In the context of neuromarketing, where techniques such as EEG, fMRI, and eye-tracking generate sensitive neural data, stakeholder theory highlights the ethical responsibility of organizations to employ these technologies transparently, respect consumer autonomy, and avoid exploiting vulnerable populations. This framework moves the analysis beyond legal compliance to questions of trust, legitimacy, and sustainable value creation.

Regulatory pluralism complements this approach by situating neuromarketing within a fragmented and overlapping global legal environment. It acknowledges that corporate practices are shaped not by a single framework but by multiple, sometimes conflicting, regimes of law and policy (Reddy & Rajendran, 2025; Miço Bellani & Leci, 2024). California’s CCPA/CPRA, the European Union’s GDPR, and national frameworks such as Slovakia’s consumer protection law (Peráček, 2022) exemplify how differing legal philosophies—privacy as a market-based right versus privacy as a fundamental human right—create both compliance challenges and strategic opportunities.

Taken together, stakeholder theory and regulatory pluralism form a dual lens that provides the foundation for this research. Stakeholder theory provides the normative standards for evaluating ethical responsibility and trust, while regulatory pluralism explains the institutional complexity in which corporate practices unfold. This integrated framework is particularly valuable for analyzing an emerging field such as neuromarketing, where legal norms are still evolving, ethical debates remain unsettled, and firms must reconcile technological innovation with consumer protection.

4. Research Methodology

The methodological design of this study is directly informed by the theoretical framework outlined above. Stakeholder theory guided the identification of ethical dimensions, including transparency and the protection of vulnerable groups. At the same time, regulatory pluralism shaped the comparative analysis across overlapping legal regimes, including the CCPA/CPRA, GDPR, and national consumer protection laws. The methodology was designed to investigate how neuromarketing practices intersect with the legal and ethical frameworks established by CCPA/CPRA, and it adopts a qualitative approach integrated with case studies, legal analysis, and cross-case synthesis to ensure a comprehensive understanding of the phenomena (Kaloga, 2023; Vohra, 2024). Figure 1 illustrates the research approach, which is structured into three primary components: a qualitative approach, legal analysis, and cross-case synthesis. The qualitative approach encompasses case studies, beginning with case selection, and progressing through data collection and document analysis of privacy policies, marketing materials, and internal reports. The legal analysis segment provides a detailed examination of the CCPA/CPRA, a comparative analysis with other privacy laws, and a broader review of consumer privacy frameworks. Finally, the cross-case synthesis integrates the findings from these components to formulate actionable recommendations, providing a comprehensive overview of how neuromarketing practices align with California’s privacy regulations.

The initial phase of this research involved selecting a diverse array of companies that utilize neuromarketing techniques. This selection included large corporations from distinct sectors to ensure that the cases represented a broad spectrum of data-handling and marketing practices. This study offers a comprehensive overview of the implementation of neuromarketing and its associated regulatory challenges.

Data for the study were gathered using a comprehensive multi-source approach to ensure the depth and accuracy of the findings. Initially, systematic document analysis was conducted. This involved a thorough review of company-related documents, including privacy policies, marketing materials, and any available internal reports related to neuromarketing practices. The objective of this analysis was to identify the companies’ stated practices and their claimed compliance with relevant privacy laws, providing a foundational understanding of how these organizations publicly represent their neuromarketing activities.

This study employs a qualitative, multiple-case study design, integrated with legal analysis and cross-case synthesis, to examine how neuromarketing practices align with the CCPA/CPRA. This approach is well-suited for exploring emerging phenomena where regulatory frameworks are still evolving and where a deep understanding of the context is required (Vohra, 2024). As illustrated in Figure 2, the research design unfolded through a sequential process that began with the purposive selection of three multinational cases—Coca-Cola, Frito-Lay, and Hyundai. Data collection integrated evidence from corporate disclosures, industry publications, and legislative documents, which were subjected to doctrinal legal analysis and benchmarked against GDPR and relevant U.S. federal frameworks. The subsequent cross-case synthesis highlighted convergences and divergences in corporate practices, particularly in relation to transparency, informed consent, and the protection of vulnerable groups, ultimately generating thematic findings on the tension between compliance, ethics, and stakeholder trust.

The research followed a sequential process beginning with case selection of Coca-Cola, Frito-Lay, and Hyundai, supported by data collection from corporate, industry, and legislative sources. Doctrinal legal analysis and cross-case synthesis then revealed patterns in transparency, consent, and protections for vulnerable groups, leading to thematic findings on compliance, ethics, and stakeholder trust.

4.1. Case Selection

Three multinational corporations—Coca-Cola, Frito-Lay, and Hyundai—were purposively selected. These firms represent distinct industries (beverages, food, automotive), have significant market presence, and are known for deploying advanced neuromarketing strategies. Their diversity enhances the external validity of the findings by illustrating how privacy regulations impact neuromarketing across various sectors. The selection followed two criteria: the documented use of neuromarketing tools (e.g., EEG, fMRI, eye-tracking, biometrics) and the visibility of data privacy practices through corporate reports, privacy policies, and industry analyses.

4.2. Data Collection

The descriptions of corporate practices in Coca-Cola, Frito-Lay, and Hyundai are drawn from publicly available privacy policies, industry reports, and media analyses, rather than direct regulatory filings or proprietary disclosures. As SB 1223 was signed into law in 2024, the analysis should be interpreted as an examination of how existing practices align with, or anticipate, the bill’s provisions rather than as evidence of fully operationalized compliance. Where specific documentation was unavailable, practices are framed as illustrative or theoretically consistent with statutory requirements rather than confirmed implementations.

Data for this study were collected from multiple sources to ensure triangulation and enhance the robustness of findings. Primary evidence was drawn from corporate materials, including privacy policies, marketing reports, and public disclosures related to the use of neuromarketing by Coca-Cola, Frito-Lay, and Hyundai. These documents were supplemented with industry publications and news articles that provided detailed accounts of neuromarketing campaigns and their strategic positioning. To situate corporate practices within a regulatory framework, legislative documents were also analyzed, with particular attention to the provisions of the CCPA/CPRA and related consumer protection laws. The integration of corporate, industry, and legislative sources minimized dependence on any single stream of evidence and thereby enhanced the credibility and validity of the study’s conclusions. As illustrated in Figure 3, triangulation across these sources provided a robust foundation for analysis and ensured that findings rested on a comprehensive and balanced evidence base.

4.3. Document Selection

Documents were selected purposively from three categories—corporate disclosures (including privacy policies and reports), industry publications, and legislative texts—because these sources represent the most transparent and accessible evidence of neuromarketing practices under the CCPA/CPRA. To ensure reliability and as an inclusion criterion, only documents published between 2019 and 2024 were included, prioritizing materials that explicitly mentioned biometric or neural data practices. To enhance qualitative analysis, the documents were coded thematically using a stakeholder theory lens, with categories such as transparency, informed consent, and protection of vulnerable groups guiding the cross-case synthesis.

4.4. Legal Analysis

The legal dimension of the study employed a doctrinal analysis to examine how consumer privacy regulations govern the collection and use of neuromarketing data. Particular emphasis was placed on the CCPA/CPRA, which establishes extensive provisions for data access, deletion, and opt-out rights, as well as requirements for transparency and informed consent. These provisions were systematically evaluated against corporate disclosures and practices to assess the extent of alignment and identify areas of tension. To strengthen the analysis, comparisons were drawn with complementary U.S. regulations, including the Federal Trade Commission Act (FTC Act), the Health Insurance Portability and Accountability Act (HIPAA), and the Children’s Online Privacy Protection Act (COPPA), as well as with international benchmarks such as the European Union’s General Data Protection Regulation (GDPR). This comparative approach enabled the identification of regulatory divergences and gaps, particularly in the treatment of biometric and neurodata. By integrating legal analysis with case evidence, the study offers a comprehensive understanding of how neuromarketing is situated within evolving privacy regimes, highlighting the challenges of ensuring consumer protection in a rapidly changing technological environment.

4.5. Cross-Case Synthesis Approach

To integrate insights from the individual cases, the study employed a cross-case synthesis approach. This method allowed for the identification of both commonalities and divergences across the practices of Coca-Cola, Frito-Lay, and Hyundai, particularly in relation to transparency, informed consent, and the protection of vulnerable groups. By systematically comparing these cases against the requirements of the CCPA/CPRA, the analysis revealed how firms converge in their formal compliance strategies yet differ in the depth and clarity of their implementation. The synthesis also highlighted areas where compliance remains largely procedural, raising questions about the substantive empowerment of consumers and the adequacy of ethical safeguards. Incorporating a comparative legal perspective, findings were further situated within the broader context of international privacy frameworks, most notably the GDPR. This approach not only provided a more nuanced understanding of organizational responses to regulation but also underscored the need for dynamic governance structures capable of addressing the ethical complexities of neuromarketing in diverse legal environments.

4.6. Ensuring Validity and Reliability

Methodological rigor in this study was reinforced through several deliberate strategies. First, transparency in case selection ensured that the choice of Coca-Cola, Frito-Lay, and Hyundai was not only purposive but also representative of distinct industries and levels of neuromarketing adoption. Second, triangulation of data sources—including corporate documents, industry publications, and legislative records—reduced reliance on any single form of evidence and enhanced the reliability of the findings. Third, the analysis was framed comparatively, situating California’s CCPA/CPRA within the broader context of U.S. federal law and international benchmarks such as the GDPR, thereby strengthening the generalizability and relevance of the conclusions. Explicit linkage to stakeholder theory provided a robust interpretive framework that guided analysis, enabling the study to move beyond descriptive compliance to a deeper exploration of trust, legitimacy, and ethical responsibility. Collectively, these measures ensured that the research design was both methodologically rigorous and theoretically grounded.

5. Research Analysis and Findings

This section examines the case studies presented in this study, highlighting the application of neuromarketing strategies by prominent companies in their advertising and product design efforts. Specifically, this study examines the approaches adopted by Coca-Cola, Frito-Lay, and Hyundai, each utilizing distinct neuromarketing technologies to enhance consumer engagement and brand loyalty. These cases offer insights into how emotional connections are formed through neuromarketing, optimized product packaging, and enhanced consumer experiences across various industries. These examples probe into the ethical considerations and regulatory compliance that these companies adhere to, particularly in response to emerging consumer protection laws, such as California’s Senate Bill, an amendment to the CCPA/CPRA. This analysis demonstrates the effectiveness of neuromarketing practices and underscores the importance of adhering to ethical standards and respecting consumer rights in the rapidly evolving marketing landscape.

Taken together, the introduction of SB 1223 provides a critical regulatory anchor for interpreting neuromarketing practices. By defining neural data as information derived directly from central and peripheral nervous system activity, the law explicitly encompasses the techniques most commonly employed by firms, including EEG, fMRI, eye-tracking, and biometric measures. This definition eliminates ambiguity by clarifying that such data streams fall under statutory consumer privacy protections, thereby linking corporate practices in neuromarketing directly to legal obligations. For this study, SB 1223 thus functions not only as a recent amendment to the CCPA/CPRA but also as a lens through which to assess how existing corporate strategies align—or fall short—of emerging regulatory expectations.

5.1. Coca-Cola: Enhancing Consumer Engagement Through Neuromarketing

Coca-Cola’s adoption of neuromarketing technologies has become a central component of its strategy to enhance consumer engagement and sustain brand loyalty1. The company integrates emotional branding into its advertising campaigns, using iconic practices—such as the act of pouring a Coca-Cola beverage—to evoke joy and foster positive consumer experiences (Maclang, 2024). By aligning these symbolic gestures with neuromarketing insights, Coca-Cola deepens consumer connections through both product presentation and packaging design (Šola, 2013; Yu, 2025).

To refine these strategies, Coca-Cola utilizes advanced techniques, including facial coding and eye tracking (methods that fall under SB 1223’s definition of neural data). Facial coding enables the company to identify emotional reactions—surprise, joy, or happiness—during campaign testing, while eye tracking provides granular data on consumer attention patterns. Together, these tools allow Coca-Cola to calibrate its marketing to elicit the intended responses, ensuring that advertising materials resonate effectively with target audiences (Balanagu & Boppisetty, 2025; Devendran et al., 2025).

While these practices reinforce the brand’s global appeal, they also raise important ethical considerations. The collection and interpretation of biometrics and neurodata necessitate vigilance in safeguarding consumer autonomy and privacy. Coca-Cola’s ability to maintain its competitive advantage, therefore, depends not only on the effectiveness of its neuromarketing strategies but also on its capacity to comply with evolving regulatory frameworks such as the CCPA/CPRA. By striking a balance between innovation and ethical responsibility, the company can enhance consumer trust while maintaining its leadership in emotional branding.

Eye-tracking technology is used to observe how consumers interact with in-store products, particularly which elements capture their attention most effectively. These data are invaluable in optimizing product placement and packaging design to enhance visibility and appeal to increasingly crowded store shelves. Similarly, EEG monitors brain activity during ad hoc exposure. This technique identifies specific brain response patterns that correlate with brand recall and positive emotions. Insights from EEG help Coca-Cola refine its advertising messages to maximize impact and strategically adjust the emotional resonance of its campaigns to foster long-term brand loyalty (Balanagu & Boppisetty, 2025).

Applying these neuromarketing techniques raises significant ethical and legal concerns, particularly regarding consumer privacy and manipulation of consumer behavior (M. Goncalves et al., 2024). Under CCPA/CPRA, consumers have rights that impact how their personal and biometric data can be collected and used. These laws require companies such as Coca-Cola to disclose their data collection practices explicitly and obtain consent from consumers before gathering sensitive data. Additionally, these laws provide consumers with the right to access, delete, and opt out of the sale of their personal data, ensuring that they retain control over their personal information (Brunstad, 2022; Reddy & Rajendran, 2025).

Considering these regulations, Coca-Cola must balance leveraging cutting-edge marketing techniques with adhering to stringent privacy laws. The company must ensure that all neuromarketing practices comply with CCPA/CPRA standards, which include implementing transparent data collection policies and securing informed consent from all study participants. This not only helps protect consumer rights but also fosters trust and maintains the ethical integrity of the brand. Moreover, the ethical use of neuromarketing involves considerations that go beyond legal compliance. This includes critically assessing the potential for consumer manipulation and ensuring that marketing practices do not exploit consumer vulnerabilities. For instance, emotional triggers in advertising are used responsibly and do not create undue emotional distress or dependence on the product (M. Goncalves et al., 2024; Sindhuja & Malik, 2024).

5.2. Frito-Lay: Enhancing Snack Preferences Through Neuromarketing

Frito-Lay, a division of PepsiCo and a global leader in the snack food industry, strategically applies neuromarketing technologies to refine consumer experiences and sustain its competitive edge2. By embedding neuroscientific insights into product development and marketing, the company tailors offerings to evolving consumer tastes and strengthens brand loyalty. This integration exemplifies a sophisticated approach that strikes a balance between innovation and compliance with privacy frameworks, such as the CCPA/CPRA, thereby aligning consumer satisfaction with ethical responsibility (Alam, 2024; V. Kumar, 2024).

A central component of Frito-Lay’s strategy lies in sensory research. Using EEG and fMRI (methods that fall under SB 1223’s definition of neural data), the company examines neural responses to taste and smell, two critical dimensions in the snack sector. These methods reveal which flavors and textures generate the strongest engagement, enabling product designs that resonate with consumer preferences (Alam, 2024; Jain, 2024). Complementing this, eye-tracking studies inform packaging choices, with findings showing that shiny materials attract greater attention than matte alternatives (Kirk, 2024). By translating such insights into packaging strategies, Frito-Lay enhances product visibility and influences purchasing decisions at the point of sale.

The company further extends neuromarketing into advertising optimization. Facial recognition technologies, combined with biometric measures such as galvanic skin response and heart rate monitoring, allow for real-time assessment of emotional and physiological reactions to campaigns (Alam, 2024). This dynamic testing enables the refinement of marketing messages to evoke targeted emotional responses, thereby increasing advertising effectiveness across diverse consumer segments.

Despite these benefits, the use of neuromarketing raises pressing ethical and legal challenges. The collection and analysis of neurodata heighten concerns about consumer privacy, autonomy, and potential manipulation of preferences. Regulatory frameworks such as the CCPA/CPRA impose obligations for transparency, informed consent, and consumer control over personal data. Frito-Lay’s ability to maintain consumer trust thus depends on navigating these requirements with care, ensuring that its neuromarketing practices remain not only innovative but also ethically and legally sound.

5.3. Neuromarketing and Consumer Experience in the Automotive Industry: The Case of Hyundai3

Hyundai, a global automotive manufacturer, has been increasingly incorporating neuromarketing techniques into its branding and product design strategies to enhance consumer engagement and differentiate its brand. By leveraging neuroscientific insights, the company seeks to understand how consumers emotionally and cognitively respond to vehicles and advertisements, thereby aligning design features and marketing campaigns with consumer expectations. This approach positions Hyundai as an innovator in the automotive sector, where emotional resonance and trust are central to brand loyalty and long-term competitiveness.

A key use of neuromarketing at Hyundai is in vehicle design. Using eye-tracking technology, the company examines consumer focus on dashboard layouts, interface ergonomics, and exterior styling, helping to improve features for better usability and visual appeal. Additional tools such as EEG and biometric feedback are used during test drives and immersive simulations to gauge emotional reactions, offering data-driven insights into safety, comfort, and brand perception. These methods fall under SB 1223’s definition of neural data. The results help Hyundai adjust its design and engineering choices to meet consumer preferences while emphasizing safety as a main brand feature.

Neuromarketing also informs Hyundai’s advertising strategies. By applying facial coding and biometric measures to test campaigns, the company evaluates consumer reactions to narratives emphasizing innovation, reliability, and safety. This evidence-based approach enhances Hyundai’s ability to craft advertisements that resonate emotionally and reinforce its positioning as both technologically advanced and consumer-centric. Such practices illustrate how neuromarketing can strengthen message effectiveness in a competitive market where consumer attention is highly fragmented.

Nevertheless, Hyundai’s use of neuromarketing raises ethical considerations, particularly regarding the collection and interpretation of biometric and neurodata. Compliance with evolving privacy regulations, including the CCPA/CPRA, is critical to ensuring that consumers retain autonomy over their data. By proactively embedding ethical safeguards and prioritizing transparency, Hyundai can transform neuromarketing from a potential reputational risk into a strategic advantage that builds consumer trust. In doing so, the company exemplifies how firms in highly regulated sectors can integrate cutting-edge marketing techniques while upholding their responsibility to consumer welfare.

5.4. Compliance with Senate Bill 1223 by Coca-Cola, Frito-Lay, and Hyundai

By adhering to the stipulations of Senate Bill 1223 (SB 1223), an amendment to the CCPA/CPRA, Coca-Cola, Frito-Lay, and Hyundai ensured legal compliance. It contributed to a more ethical marketing environment. Their commitment to transparency, informed consent, the protection of vulnerable populations, and high ethical standards exemplifies responsible corporate behavior using advanced neuromarketing techniques. Based on an extensive review of the literature, there is no direct evidence to the contrary regarding the claim that Coca-Cola, Frito-Lay, and Hyundai ensure legal compliance and contribute to a more ethical marketing environment by adhering to the stipulations of SB 1223 (California Legislative Information, 2024). The reviewed sources do not provide specific information on any non-compliance or ethical violations by these companies in relation to SB 1223. This adherence ultimately maintains consumer trust and upholds brand integrity. However, it is important to note that general compliance with legal standards does not necessarily eliminate all ethical concerns or potential areas of improvement. Companies must continually evaluate and adapt their practices to maintain consumer trust and uphold brand integrity, especially as market conditions and legal standards evolve.

As an amendment to the CCPA/CPRA, the Senate Bill 1223, which amends the Civil Code Section 1798.140 within the CCPA framework, signed into law in 2024, was designed to protect vulnerable groups, particularly children, from potentially manipulative marketing practices that employ sophisticated psychological and neurological techniques (California Legislative Information, 2024). The SB 1223 specifically defines “neural data” as information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information. This legislation mandates several key provisions to ensure ethical marketing practices, including disclosure requirements, informed consent, protection of vulnerable groups, and adherence to established ethical standards. This Bill also requires companies to disclose the use of neuromarketing tools that could influence consumer behavior. Coca-Cola, Frito-Lay, and Hyundai comply by transparently indicating in their marketing materials and websites whenever neuromarketing tools are employed. This ensures that consumers are aware of the techniques used in advertising and marketing products they may consider purchasing.

The bill also stipulates that consumers must be informed of the collection of any biometric or neurological data. Coca-Cola, Frito-Lay, and Hyundai adhered to this requirement by obtaining explicit consent from individuals participating in marketing studies or consumer research involving neuromarketing tools. This process includes detailed explanations of what data are collected, how they are used, and how they will be stored, ensuring that all participants are fully informed before they agree to partake.

Protection for vulnerable groups is a special consideration under SB 1223, including restrictions on marketing targeted at children, the elderly, and other groups considered neurologically or cognitively vulnerable (California Legislative Information, 2024). For instance, Coca-Cola and Frito-Lay have adjusted their marketing strategies to avoid targeting these groups using neuromarketing techniques (Alam, 2024). While not directly marketing to children, Hyundai ensures that its vehicle advertising is designed to prevent exploiting vulnerabilities by focusing on the safety and reliability of its cars, rather than emotional manipulation.

The SB 1223 sets ethical guidelines for using neuromarketing tools to prevent exploitative practices (Alam, 2024; California Legislative Information, 2024). Coca-Cola, Frito-Lay, and Hyundai established internal ethical review processes to oversee the deployment of neuromarketing strategies. These processes are designed to ensure that all marketing efforts are not only practical but also morally sound and compliant with both the letter and spirit of the law.

Table 1. Selected companies’ compliance with the California Senate Bill 1223.

Compliance Aspect	Coca-Cola	Frito-Lay	Hyundai
Disclosure of Neuromarketing Practices	Coca-Cola discloses the use of neuromarketing technologies (e.g., facial coding, EEG, eye-tracking) in advertising and packaging testing. Website and materials include these disclosures.	Frito-Lay discloses the use of neuromarketing tools (eye-tracking, EEG) in advertising and sensory evaluations. This is included in ads and product research materials.	Hyundai discloses its use of neuromarketing technologies (VR, EEG, fMRI) for vehicle design and advertising testing. Disclosure is provided in marketing materials and on the company website.
Informed Consent	Coca-Cola ensures informed consent by providing clear, explicit consent forms when participating in neuromarketing studies, particularly for biometric data collection (e.g., facial expressions, EEG).	Frito-Lay requires informed consent in product testing and focus groups, explaining data collection methods (e.g., eye-tracking, biometric sensors) and usage.	Hyundai implements informed consent protocols for participants in vehicle design and advertisement testing, including consent for biometric data collection (EEG, fMRI).
Protection of Vulnerable Groups	Coca-Cola avoids using neuromarketing tools to target children, especially in emotional ads, and adheres to ethical guidelines to protect vulnerable populations (e.g., elderly, those with cognitive impairments).	Frito-Lay has paused marketing targeted at children that utilizes neuromarketing techniques, ensuring compliance with California Senate Bill 1223. Ethical audits are conducted to avoid manipulative practices.	Hyundai adjusts its advertising and neuromarketing techniques to avoid targeting vulnerable groups (e.g., children or cognitively impaired individuals) through emotionally manipulative ads.
Ethical Standards and OverSight	Coca-Cola has established ethical guidelines and internal audits to monitor the use of neuromarketing technologies, ensuring that marketing tactics are non-exploitative and consumer-centric.	Frito-Lay has established an ethics oversight committee to review its neuromarketing practices. The company ensures that its tools are used to enhance consumer enjoyment, not to manipulate or exploit.	Hyundai has an ethics board that regularly reviews neuromarketing practices. The company ensures that its neuromarketing techniques align with consumer protection principles and avoid any form of manipulation.
Adherence to CA SB 1223 Requirements	Fully compliant: Coca-Cola discloses, seeks informed consent, and safeguards vulnerable groups through ethical oversight.	Fully compliant: Frito-Lay follows transparency, informed consent, and ethical guidelines to protect vulnerable consumers.	Fully compliant: Hyundai adheres to disclosure, informed consent, and ethical practices while protecting vulnerable groups.

SOURCES: Compiled by the authors (California Legislative Information, 2024; and footnotes 1, 2, and 3: Coca-Cola Consumer Privacy Policy, 2024; My Hyundai, 2024; PepsiCo Privacy Policy, 2024).

shows how each of these companies complied with new legislation. The practices summarized in this table are derived from public-facing documentation and industry analyses. They should be read as interpretive alignments or recommended practices under SB 1223’s provisions, rather than as definitive evidence of company-level compliance.

Compliance with Senate Bill 1223: An Analysis of Coca-Cola, Frito-Lay, and Hyundai. Coca-Cola, Frito-Lay, and Hyundai exemplify how major organizations can effectively and ethically employ cutting-edge neuromarketing tools within the stringent regulatory framework established by California’s consumer privacy laws. Their adherence to these regulations aligns with legal requirements and promotes a marketing environment that respects consumers’ privacy and ethical standards. The proactive steps taken by these companies to ensure compliance with SB 1223 reflect their dedication to ethical business practices and consumer protections. These three companies have demonstrated robust compliance with the provisions of SB 1223, which mandates the responsible use of neuromarketing technologies. This legislation was designed to protect consumer privacy and prevent the manipulation of vulnerable groups through sophisticated marketing techniques. The following discussion outlines the compliance measures adopted by these corporations.

As mandated by SB 1223, Coca-Cola, Frito-Lay, and Hyundai maintain transparency regarding the use of neuromarketing tools in their advertising campaigns, product designs, and consumer research. These organizations disclose the specific neuromarketing techniques they employ, thereby making consumers aware of the marketing strategies utilized (California State Legislature, 2018). This level of openness is crucial for maintaining consumer trust and for ensuring ethical marketing practices.

Aligned with the informed consent provision of the bill, all three companies have established procedures to ensure that consumers are thoroughly informed about collecting biometric and neurological data. They obtained explicit consent from participants before conducting any neuromarketing research. This process includes detailed explanations of what data will be collected, how it will be used, and the measures taken to protect this information, thus safeguarding consumer rights and privacy.

Each company has adapted its marketing strategy to comply with the requirements of SB 1223, specifically regarding the protection of vulnerable groups. This includes children, the elderly, and cognitively impaired individuals who may be more susceptible to manipulation through marketing practices. Coca-Cola, Frito-Lay, and Hyundai have implemented marketing policies that refrain from targeting these groups, thereby adhering to legislative requirements designed to protect these populations from potential exploitation.

Furthermore, Coca-Cola, Frito-Lay, and Hyundai instituted internal and external ethical review processes to oversee their neuromarketing practices. These measures ensure that all marketing activities are conducted responsibly and ethically, prioritizing consumer welfare over corporate gains. Implementing these ethical checks indicates companies’ commitment to upholding high standards of integrity in their marketing efforts.

The analysis of Coca-Cola, Frito-Lay, and Hyundai under the CCPA/CPRA reveals both convergence in formal compliance and divergence in the depth of ethical engagement. Three central findings emerged from the cross-case synthesis: transparency remains uneven, informed consent is procedural rather than substantive, and protections for vulnerable groups are inconsistently applied. The selected cases demonstrate how firms implement neuromarketing strategies while complying with California’s privacy regulations. Rather than examining each company in isolation, the analysis is organized thematically around three recurring issues: transparency and disclosure, informed consent, and the protection of vulnerable groups.

5.5. Case Evidence: Corporate Applications of Neuromarketing Under CCPA/CPRA

Across all three cases, transparency emerged as a central but uneven practice. Coca-Cola provides relatively explicit disclosures in its privacy documents, acknowledging the use of facial coding, EEG, and eye-tracking in advertising development. Hyundai also indicates neuromarketing applications, particularly in vehicle design and advertising, while Frito-Lay references its use of sensory testing and packaging research. Yet the level of detail varies considerably: Coca-Cola’s disclosures are the most explicit, whereas Frito-Lay and Hyundai tend to adopt more generalized language. This variation raises concerns about whether consumers are meaningfully informed of the scope and depth of neurodata collection, thereby questioning the substantive adequacy of transparency measures under the CCPA/CPRA.

Informed consent practices show similar inconsistencies. All three firms obtain consent, typically through participant agreements in product testing, focus groups, or immersive simulations. Coca-Cola and Hyundai appear to provide more detailed protocols that describe the types of data collected and how they will be stored, while Frito-Lay adopts shorter, less detailed forms. Although these procedures satisfy statutory requirements, their brevity may undermine consumer understanding, leaving open the question of whether participants are truly empowered to provide “active opt-in” consent as envisioned by California’s regulatory framework.

The protection of vulnerable groups constitutes a third critical dimension. Each firm formally acknowledges restrictions on targeting children or other sensitive populations, consistent with the requirements of Senate Bill 1223. Coca-Cola has emphasized its policy of excluding children from neuromarketing campaigns, Frito-Lay has suspended certain youth-directed initiatives, and Hyundai has positioned its marketing to emphasize safety features rather than exploiting emotional vulnerabilities. Nevertheless, doubts persist as to whether such protections are robustly embedded in corporate practice or remain largely symbolic.

Taken together, the evidence demonstrates that CCPA/CPRA compliance has prompted greater disclosure, structured consent mechanisms, and policy statements addressing vulnerable groups. Yet the differences in clarity, depth, and operational safeguards highlight significant gaps between procedural compliance and substantive ethical leadership. These findings reinforce the central argument of this study: while legal compliance is necessary, it is insufficient on its own. Sustained stakeholder trust requires firms to transcend regulatory minimums and embed proactive ethical commitments into their neuromarketing practices. As illustrated in Figure 4, transparency, consent, and protections for vulnerable groups converge into a central insight: compliance is necessary but insufficient—ethical leadership is essential for stakeholder trust.

The analysis of Coca-Cola, Frito-Lay, and Hyundai reveals three recurring themes in neuromarketing under CCPA/CPRA: transparency and disclosure, informed consent, and protection of vulnerable groups. While firms demonstrate procedural compliance, the cross-case synthesis reveals that meaningful consumer empowerment and trust necessitate practices that move beyond legal minimums toward proactive, ethical leadership.

Cross-Case Synthesis Analysis

Taken together, the findings show that, while Coca-Cola, Frito-Lay, and Hyundai have adopted compliance measures that meet the requirements of the CCPA/CPRA, these practices often stay at the minimum legal level rather than reflecting genuine ethical commitment. Transparency is officially present but is often conveyed through highly technical or broad disclosures that do not give consumers a clear understanding of how their neurodata are collected and used. Consent is usually obtained, but the short and procedural nature of consent forms raises doubts about whether participants truly have the power to make informed choices. Likewise, protections for vulnerable groups are mentioned in policy language, but inconsistencies in operational safeguards suggest these commitments may be more symbolic than practical. Importantly, the data streams used by these firms—EEG, fMRI, eye-tracking, facial coding—are directly defined as neural data under SB 1223. This connection emphasizes the need for companies to translate existing practices into compliance structures that recognize these techniques as legally regulated forms of consumer information.

This pattern reinforces the central argument of the study: legal compliance does not automatically translate into ethical sufficiency. In fact, the evidence highlights a widening gap between procedural compliance—where organizations meet statutory requirements through surface-level practices—and substantive compliance, which entails embedding consumer autonomy, transparency, and protection into the core design of neuromarketing strategies. From a stakeholder theory perspective, this distinction is critical: procedural compliance may reduce regulatory risk, but only substantive compliance can foster enduring stakeholder trust, legitimacy, and long-term value creation.

Moreover, the cross-case synthesis points to a broader insight of theoretical and practical significance. The uneven depth of compliance across cases highlights how neuromarketing is still in the early stages of regulatory adaptation, where firms prioritize defensive risk management over leveraging ethical leadership as a strategic capability. This tension between compliance and ethics is not merely a corporate governance issue; it signals a need for more dynamic regulatory frameworks that evolve in parallel with technological innovation. California’s CCPA/CPRA provides a strong baseline, yet its effectiveness ultimately depends on whether firms choose to exceed the legal minimum and actively embrace consumer empowerment. Because SB 1223 is a very recent amendment, it would be premature to speak of stable compliance practices. The analysis here instead situates current corporate behaviors within the broader trajectory of privacy law in California, highlighting how existing disclosure, consent, and oversight mechanisms anticipate the obligations now formalized by SB 1223.

Thus, the synthesis highlights both the limitations of current practice and the opportunity for transformative leadership. By moving beyond statutory obligations and embedding ethical considerations into neuromarketing governance, organizations can not only mitigate reputational and regulatory risks but also cultivate deeper consumer loyalty and societal trust. In doing so, firms would shift neuromarketing from being perceived as a potential threat to consumer autonomy toward being recognized as a tool for enhancing transparency, fairness, and responsible innovation.

5.6. Federal vs. State Regulatory Context

The corporate practices analyzed in this study must be understood within a fragmented regulatory environment that combines broad federal consumer protection statutes with California’s more comprehensive and specialized privacy framework. At the federal level, neuromarketing remains indirectly regulated through general statutes rather than explicit, targeted provisions. The Federal Trade Commission (FTC) Act prohibits deceptive or unfair advertising practices and thus provides a mechanism to intervene if neuromarketing techniques cross the line into manipulation. Similarly, the Health Insurance Portability and Accountability Act (HIPAA) establishes strict standards for health-related data but does not extend its protections to neuroscientific signals when used for commercial marketing, leaving a critical gap in coverage. The Children’s Online Privacy Protection Act (COPPA) restricts data collection from children under 13, but it, too, fails to address the distinctive risks associated with neuromarketing. Taken together, these statutes form a patchwork of protections that address adjacent domains yet stop short of offering a coherent regulatory framework for neuromarketing.

California has sought to fill this void by establishing a privacy regime that directly engages with the collection and use of biometric and personal data in commercial contexts. The California Consumer Privacy Act (CCPA, 2018) and its amendment, the California Privacy Rights Act (Bukaty, 2021), together constitute one of the most comprehensive privacy frameworks in the United States. These laws provide consumers with substantive rights, including the ability to access, delete, and opt out of the sale of personal data, while also mandating explicit transparency and consent protocols for the collection and use of sensitive information such as biometric and neurodata. Crucially, enforcement authority lies with the California Privacy Protection Agency (CPPA), which operates as a dedicated regulatory body with proactive monitoring and sanctioning powers. This contrasts with the more reactive posture of federal enforcement, which often depends on case-specific investigations initiated after potential harm has already occurred.

The divergence between federal and state approaches underscores the significance of California as a regulatory laboratory for neuromarketing governance. While federal law provides only general guardrails, California’s framework signals a more assertive attempt to anticipate and regulate emerging risks associated with neurodata. This dual-layered context not only shapes how corporations operationalize compliance but also raises questions about the scalability and harmonization of regulatory models across jurisdictions. For firms, the lack of a unified framework generates both compliance complexity and reputational risk, while, for consumers, it results in uneven protection depending on their geographic location. The contrast, therefore, highlights both the innovative potential and the structural limitations of state-led initiatives in shaping the ethical boundaries of neuromarketing. As summarized in

Table 2. Comparison of Federal and California Regulatory Frameworks for Neuromarketing.

Dimension	U.S. Federal Law	California Law (CCPA/CPRA)
Regulatory Scope	Indirect protections; no statute explicitly governing neuromarketing.	Explicitly covers personal, biometric, and neurodata in commercial contexts.
Key Statutes	FTC Act (unfair/deceptive practices); HIPAA (health data only, excludes neurodata); COPPA (children < 13).	CCPA (2018) and Bukaty (2021) mandate rights to access, delete, and opt out of personal/biometric data collection.
Transparency Requirements	General truth-in-advertising standards; no specific disclosure requirements for neuromarketing practices.	Mandatory disclosure of categories, purposes, and uses of personal/biometric/neurodata.
Consent Mechanisms	Typically, implied consent, except in health or child protection contexts.	Active opt-in consent required for sensitive data; opt-out rights extended to consumers.
Protection of Vulnerable Groups	COPPA restricts data collection from children under 13.	Senate Bill 1223 prohibits neuromarketing targeted at children; potential expansion to other vulnerable groups.
Enforcement Authority	Federal Trade Commission (FTC); enforcement is reactive and case-driven.	California Privacy Protection Agency (CPPA); dedicated oversight with proactive enforcement powers.
Strength of Enforcement	Limited, broad-based consumer protection focus.	Strong, sector-specific enforcement with explicit penalties for non-compliance.

Source: The authors.

, the contrast between federal and California frameworks highlights the regulatory gaps at the national level and the pioneering role of California in shaping a more explicit and enforceable model for neuromarketing governance.

The comparison in Table 2 underscores the fragmented nature of neuromarketing governance in the United States. Federal statutes provide only general protections, addressing deceptive advertising, health data, or children’s online privacy, but they do not directly regulate neurodata used in commercial contexts. By contrast, California’s CCPA/CPRA establishes explicit rights, consent requirements, and enforcement mechanisms tailored to the challenges of biometric and neuromarketing data. For corporations, this dual-layered regime generates compliance complexity, as firms must navigate overlapping yet uneven standards across jurisdictions. For consumers, it produces uneven protection, with California residents benefiting from stronger safeguards than those available under federal law. Importantly, California’s framework may serve as a prototype for future regulatory models, both at the federal level and internationally, by demonstrating how state-led initiatives can anticipate emerging risks and set higher ethical baselines for corporate practice.

5.6.1. Consumer Protections and Enforcement

California’s regulatory architecture extends beyond the CCPA/CPRA by incorporating complementary statutes that strengthen consumer protections against manipulative marketing practices. Chief among these is the Unfair Competition Law (UCL), which prohibits unfair, deceptive, or fraudulent business conduct. This provision is particularly salient in the context of neuromarketing, where techniques such as subliminal priming, covert biometric monitoring, or emotionally coercive stimuli could potentially undermine consumer autonomy. By invoking the UCL, California regulators have the capacity to address harms that fall outside the strict language of the CCPA/CPRA, thus broadening the scope of consumer safeguards. Notably, the UCL’s flexible standard allows enforcement agencies to respond dynamically to evolving technological practices, reducing the risk that novel forms of neuromarketing escape oversight due to regulatory lag.

At the federal level, oversight continues to be anchored in the authority of the FTC. The FTC’s remit includes ensuring that advertising is truthful, not misleading, and substantiated by evidence, while also monitoring the fairness of data collection practices. Although the agency does not explicitly reference neuromarketing in its statutes or guidelines, its broad jurisdiction enables it to intervene where neuro-based advertising or data collection practices cross the line into deception or unfairness. This latent authority provides a flexible enforcement tool, but one that is primarily reactive, triggered by consumer complaints or high-profile controversies rather than systematic oversight.

The interaction between California’s proactive enforcement mechanisms and the FTC’s broader but more reactive approach generates both opportunities and gaps in consumer protection. On the one hand, California’s state-level initiatives demonstrate how targeted statutes, such as the UCL, can complement privacy-specific legislation and create a layered regulatory environment capable of addressing complex risks. On the other hand, the absence of explicit federal provisions for neuromarketing means that enforcement is uneven across jurisdictions, leaving consumers outside California with weaker protections. For firms, this asymmetry translates into compliance complexity, reputational vulnerability, and potential exposure to litigation under divergent standards. For policymakers, it highlights the urgency of harmonizing enforcement strategies across state and federal levels, ensuring that neuromarketing practices are subject to consistent ethical and legal scrutiny.

5.6.2. Divergence in Regulation and Enforcement

This study’s findings highlight a pronounced divergence between California’s regulatory framework and the fragmented federal approach to consumer data protection. California has established some of the most rigorous safeguards for biometric and neurodata in the United States, embedding explicit rights and enforcement mechanisms through the CCPA/CPRA and complementary statutes such as the Unfair Competition Law. This framework provides consumers with a robust set of protections, ranging from the right to access and delete data to proactive oversight of potential manipulative practices in neuromarketing. By contrast, federal regulation remains indirect, relying on broader consumer protection statutes that do not explicitly address neurodata or the unique risks posed by neuromarketing. The result is a patchwork of protections that vary not only in scope but also in enforcement intensity.

For corporations, this divergence generates substantial compliance challenges. Firms operating nationally must navigate a complex regulatory environment in which California imposes stringent requirements, while other jurisdictions maintain weaker or less specific protections. This unevenness increases compliance costs, raises the risk of reputational damage from perceived under-protection of consumers, and creates uncertainty regarding the durability of current business practices should federal reforms emerge. From a strategic perspective, the divergence may incentivize firms to adopt California’s higher standards as a de facto baseline, both to simplify compliance and to demonstrate ethical leadership in data governance.

For consumers, the implications are equally significant. Residents of California benefit from proactive oversight by the CPPA and expanded rights under state law. At the same time, individuals outside California remain reliant on federal protections that may fail to capture the nuances of neuromarketing practices. This uneven protection not only undermines consumer trust in the marketplace but also risks exacerbating digital inequality, where access to rights and safeguards depends on geographic location. The divergence thus underscores the urgent need for regulatory harmonization, either through federal legislation that integrates lessons from California or through coordinated interstate efforts that reduce fragmentation.

5.7. Privacy Risks and Data Sensitivity

Neuromarketing involves the collection and analysis of highly sensitive consumer data, including brain scans, eye-tracking outputs, galvanic skin responses, and facial coding measures. Unlike conventional marketing metrics, these biometrics or biosignals inputs can reveal subconscious emotional states and cognitive patterns that individuals themselves may not be fully aware of, thereby amplifying both the informational and ethical stakes. The sensitivity of neurodata raises concerns on multiple fronts: whether participants are meaningfully informed of its intended uses, how securely such data are stored and protected against cyber intrusion, and whether it could be repurposed or sold for highly targeted marketing campaigns. These risks elevate neuromarketing from a matter of ordinary data governance to one of profound ethical and societal significance, given the potential to compromise individual autonomy at the deepest cognitive level.

The ethical challenges posed by these practices are closely tied to fundamental principles of consumer autonomy, consent, and privacy. As M. V. Goncalves et al. (2022) note, neuromarketing highlights the limits of conventional informed consent frameworks, since consumers may struggle to comprehend the implications of sharing neural or biometric information. Organizations are therefore pressed to develop strategies that not only comply with legal disclosure requirements but also empower participants with a substantive understanding and meaningful choice. This necessitates not only more robust consent protocols but also organizational cultures that foreground ethical responsibility in the deployment of neurotechnologies.

The regulatory environment reflects this tension between technological innovation and consumer protection. California’s legal framework—through statutes such as the CCPA/CPRA—has taken significant steps to regulate the collection and use of biometric and neurodata, embedding explicit requirements for transparency, consent, and consumer rights. At the federal level, however, protections remain more generalized, with privacy law addressing broad categories of consumer data but lacking specificity in relation to neurodata. This divergence underscores both a regulatory gap and an opportunity. As neuromarketing technologies mature, the evolution of U.S. privacy law may draw increasingly from California’s example to establish more comprehensive and uniform safeguards.

From a forward-looking perspective, the central issue is not whether neurodata will become more widely collected but how governance frameworks can evolve to keep pace with technological capabilities. The creation of adaptive regulatory regimes—capable of responding to novel risks while upholding consumer rights—will be crucial in ensuring that neuromarketing is harnessed responsibly. Absent such safeguards, the commercialization of subconscious cognitive and emotional signals risks eroding consumer trust and deepening ethical controversies that could undermine the legitimacy of the field itself.

6. Discussion, Conclusions, Recommendations, Limitations, and Further Research

As neuromarketing continues to evolve, legislative bodies need to monitor and, if necessary, expand regulations to protect consumer interests without hindering innovation. Future research should investigate the dynamics of neuromarketing practices in other countries and globally to assess the consistency of ethical marketing practices across diverse regulatory environments and cultural contexts. This ongoing evaluation will help ensure that the benefits of neuromarketing advancements are widely realized while maintaining robust protection for consumer privacy and autonomy.

6.1. Discussion

This study advances the discourse on neuromarketing ethics by situating the analysis of corporate practices within California’s Consumer Privacy Rights Act (CCPA/CPRA) through the dual lenses of stakeholder theory and comparative regulatory analysis. Unlike prior studies that have primarily described neuromarketing techniques or emphasized conceptual ethical debates, this research offers original insights by demonstrating how corporations operationalize consumer privacy obligations in practice and how these practices influence stakeholder trust. In particular, the findings show that Coca-Cola, Frito-Lay, and Hyundai not only adhere to statutory mandates but also frame compliance as part of a broader legitimacy strategy, enhancing transparency and brand equity.

A second contribution stems from cross-jurisdictional comparison. By juxtaposing California’s consumer rights framework with the European Union’s General Data Protection Regulation (GDPR), the study highlights important divergences in legal philosophy. Whereas the GDPR enshrines privacy as a fundamental right with extraterritorial enforcement, California’s approach emphasizes market-based consumer empowerment through disclosure and opt-out provisions. This comparative insight underscores California’s role as a “laboratory of regulation” for neuromarketing and reveals gaps that may emerge when companies operate simultaneously in jurisdictions with differing ethical and legal baselines. Such analysis enriches the novelty of this work by extending its relevance beyond the U.S. context and positioning neuromarketing ethics within global regulatory debates.

Third, this research contributes to policy innovation by identifying areas where compliance is insufficient to resolve underlying ethical tensions. While all three case companies disclose neuromarketing practices and obtain consent, questions remain regarding the substantive quality of that consent and whether disclosures meaningfully equip consumers to exercise autonomy. Stakeholder theory emphasizes that corporations must balance value creation with the avoidance of harm to vulnerable groups. Yet the findings suggest that existing compliance frameworks are reactive, focused on minimal legal obligations rather than proactive ethical leadership. This study therefore proposes that stronger consumer protections require novel governance mechanisms, such as standardized neuromarketing disclosure formats, real-time consent dashboards, and industry-wide ethical review boards. These innovations move beyond compliance to embed ethical reflexivity within organizational practice.

The discussion also reveals that managerial implications extend beyond risk management. Ethical neuromarketing can serve as a strategic capability that fosters long-term stakeholder trust, enhances consumer loyalty, and differentiates firms in increasingly transparent markets. Coca-Cola’s emphasis on emotional branding, Frito-Lay’s sensory-driven product development, and Hyundai’s immersive consumer experiences illustrate how neuromarketing can create value when aligned with ethical guardrails. Conversely, the absence of rigorous consumer protections risks eroding trust and provoking regulatory backlash. For managers, the implication is clear: treating privacy and neuromarketing ethics as compliance exercises is insufficient. Instead, integrating ethical considerations into innovation pipelines and consumer engagement strategies constitutes a source of sustainable competitive advantage.

The findings of this study contribute to the emerging global dialogue on neuromarketing standards. As firms expand across jurisdictions, fragmented regulatory frameworks create uncertainty and ethical inconsistency. The findings reinforce calls for international coordination, potentially through organizations such as the Organization for Economic Co-operation and Development (OECD) or World Trade Organization (WTO), to establish baseline principles for the ethical use of neurodata. Aligning neuromarketing practices with global norms would not only protect consumers but also provide corporations with a predictable regulatory environment that encourages innovation.

6.2. Conclusions and Recommendations

This study examined the intersection of neuromarketing practices and California’s Consumer Privacy Rights Act (CCPA/CPRA), drawing on the cases of Coca-Cola, Frito-Lay, and Hyundai. The findings reveal that, while these firms comply with disclosure, informed consent, and oversight requirements, substantive concerns persist regarding the meaningfulness of consent, the protection of vulnerable groups, and the uneven global regulation of neurodata. By applying stakeholder theory and comparing CCPA/CPRA with the European GDPR, this research advances the debate beyond descriptive case studies. It offers original insights into how corporations balance innovation with consumer rights while regulatory frameworks evolve to address emerging ethical risks.

Three overarching conclusions emerge. First, compliance with privacy law does not equate to ethical sufficiency; organizations must move beyond formal adherence and proactively demonstrate respect for consumers and ethical leadership. Second, neuromarketing should not be viewed solely as a regulatory challenge but also as a potential strategic capability that, when conducted responsibly, enhances brand equity and strengthens long-term trust. Third, the persistence of fragmented regulatory landscapes generates both uncertainty for firms and uneven protection for consumers, underscoring the urgency of international coordination and harmonization.

These conclusions must be interpreted cautiously, as the study relies on secondary documentation and cannot capture how compliance mechanisms will evolve once SB 1223 is fully operational. The absence of primary empirical evidence on firm-level implementation underscores the need for future research to validate these findings and avoid premature generalization.

6.3. Implication to Theory

This study makes several contributions to theoretical debates at the intersection of marketing, consumer behavior, and regulatory governance. First, by applying stakeholder theory to the context of neuromarketing, it extends the framework beyond traditional applications in corporate social responsibility to the emerging domain of neurodata ethics. The analysis demonstrates that procedural compliance with privacy laws does not automatically translate into substantive legitimacy. Firms that merely satisfy disclosure and consent requirements may reduce regulatory risk, but they do not necessarily strengthen trust or loyalty among stakeholders. This distinction sharpens the theoretical relevance of stakeholder theory by showing how ethical leadership and proactive engagement represent a higher-order capability that creates durable legitimacy in technology-driven markets.

Second, the study advances theoretical discussions of regulatory pluralism. By juxtaposing California’s CCPA/CPRA with federal statutes and the European GDPR, the findings highlight how fragmented governance structures shape organizational behavior in ways not fully captured by existing compliance-based models. The comparative insights suggest that corporations interpret regulation not only as a constraint but also as a strategic resource: adopting higher standards can pre-empt regulatory scrutiny, mitigate reputational risks, and create competitive differentiation. This challenges the assumption that firms always resist stricter regulation, instead positioning compliance as part of a dynamic interaction between law, legitimacy, and market positioning.

Third, the findings contribute to the emerging literature on strategic capabilities in marketing by conceptualizing neuromarketing not merely as a technical tool but as a governance-intensive practice. The evidence suggests that integrating neuroscientific techniques into product design, advertising, and brand strategy necessitates organizational routines that incorporate ethics, transparency, and consumer respect. This suggests that future theoretical work should account for how marketing capabilities increasingly depend on the co-evolution of technological innovation and institutional legitimacy.

Taken together, these insights enrich theoretical understanding by positioning neuromarketing as a boundary object that links consumer behavior, regulatory studies, and stakeholder legitimacy. Rather than treating regulation as an exogenous factor, the study shows that regulatory and ethical considerations are endogenous to the very constitution of neuromarketing as a strategic practice. This opens space for future theoretical development that integrates marketing ethics, institutional theory, and stakeholder perspectives into a more holistic account of how firms navigate the evolving neurotechnology landscape.

6.4. Implication to Practice

The findings of this study also carry important implications for corporate managers, regulators, and practitioners seeking to align neuromarketing innovation with ethical responsibility. For managers, the evidence suggests that limiting compliance to the minimum legal threshold is insufficient for establishing and maintaining enduring consumer trust. Instead, firms must view privacy safeguards and ethical oversight as strategic enablers of brand equity. Neuromarketing campaigns that embed transparent disclosure, meaningful consent, and protections for vulnerable groups are more likely to resonate with consumers and reduce reputational risks. This reframes compliance not as a cost but as a competitive advantage, positioning ethical leadership as central to market differentiation.

For policymakers, the study underscores the importance of dynamic, adaptive regulation in rapidly evolving technological domains. California’s CCPA/CPRA illustrates how state-level initiatives can anticipate emerging risks and establish higher baselines of consumer protection. Still, fragmented enforcement across jurisdictions continues to expose consumers to uneven safeguards. Policymakers should therefore pursue harmonized standards, whether through federal reforms or international coordination, to prevent regulatory arbitrage and ensure equitable consumer protections. Regulatory agencies also need to strengthen enforcement capacity by combining punitive measures with incentive mechanisms—such as grants or certifications—that reward firms adopting consumer-friendly neuromarketing practices.

For practitioners in the marketing and advertising industries, the findings point to the need for new professional norms and governance structures. Independent ethical review boards, plain-language consent dashboards, and continuous staff training are concrete mechanisms that can institutionalize respect for consumer autonomy. These practices not only improve the quality of consumer engagement but also mitigate the risk of public backlash against neuromarketing techniques perceived as manipulative or invasive. By embedding ethical responsibility into everyday operations, practitioners can help reframe neuromarketing as a tool for enhancing consumer experience rather than exploiting subconscious vulnerabilities.

The practical implications of this study highlight the need for firms, regulators, and practitioners to move collectively beyond compliance toward proactive ethical governance. Doing so can transform neuromarketing from a contested practice into a legitimate strategic capability, generating value for businesses while protecting consumer rights and fostering long-term societal trust.

6.5. Recommendations

Building on these insights, several recommendations are advanced for organizations, policymakers, and scholars. For organizations, the central priority is to shift from minimal compliance to proactive ethical governance by embedding neuromarketing oversight into innovation pipelines and consumer engagement strategies. This requires transparent, plain-language disclosures, interactive consent dashboards that empower genuine consumer choice, and the establishment of independent review boards to assess campaigns before they are deployed. Organizational culture also plays a critical role, with continuous training and performance metrics needed to ensure that respect for consumer autonomy becomes a guiding principle.

For policymakers, updating consumer protection frameworks remains essential. Stronger safeguards are needed to require active opt-in consent for neurodata, introduce stricter protections for vulnerable populations, and mandate regular audits of corporate practices. At the same time, regulators should create incentives for firms to align innovation with ethics, such as grants, certifications, or tax benefits for consumer-friendly neuromarketing technologies. Beyond domestic reforms, governments must work toward international harmonization by collaborating with institutions such as the OECD, WTO, and International Consumer Protection and Enforcement Network (ICPEN) to establish global baselines for ethical neuromarketing practices.

For scholars, advancing the field requires moving beyond normative critique toward empirical and applied insights. Future research should investigate consumer perceptions of neuromarketing practices to capture patterns of acceptance, resistance, and ethical concern. Comparative, cross-industry research is also necessary, particularly in domains such as healthcare, education, and non-profits, where neuromarketing may pose distinct challenges. Scholars should develop and test implementation models that translate abstract principles of transparency, fairness, and autonomy into actionable frameworks that firms can adopt in practice.

These strategic initiatives are summarized in

Table 3. Strategic initiatives to align neuromarketing with consumer rights and ethical standards.

Strategic Initiative	Organizational Strategy	Policy Recommendation
Enhance Transparency	Use plain-language disclosures and interactive consent dashboards.	Establish standardized disclosure formats across firms.
Strengthen Informed Consent	Implement active opt-in protocols with explanatory tools (e.g., videos, dashboards).	Mandate opt-in for neurodata with regular independent audits.
Protect Vulnerable Populations	Avoid targeting vulnerable groups unless it is ethically justifiable and strict internal checks are in place.	Expand CCPA/CPRA to include stronger protections for children, the elderly, and the cognitively impaired.
Foster Ethical Innovation	Provide continuous ethical training for neuromarketing teams.	Support R&D of consumer-friendly neuromarketing through grants or certification schemes.
Develop Global Standards	Apply the highest standards of privacy, regardless of jurisdiction.	Promote international harmonization through collaborations with the OECD, WTO, and ICPEN.
Strengthen Ethical Oversight	Establish company-level or industry-wide neuromarketing review boards.	Create independent state/national review boards to monitor neuromarketing practices.

, which integrates organizational strategies with policy-level recommendations. As the table illustrates, achieving effective neuromarketing governance requires a dual approach: organizations must cultivate ethical practices internally, while policymakers provide robust regulatory and enforcement frameworks.

California’s CCPA/CPRA represents an important milestone in consumer privacy, but its novelty and jurisdictional limits highlight the need for dynamic legislation and international alignment. Neuromarketing’s future depends on a sustained dialogue between law, technology, and ethics. Companies that embed proactive ethical standards will not only mitigate regulatory risks but also unlock the potential of neuromarketing as a trusted and strategic tool for enhancing the consumer experience. Conversely, failure to balance innovation with consumer protection risks eroding trust and triggering public and regulatory backlash. The path forward requires innovation guided by responsibility, ensuring that neuromarketing evolves as a model of ethical value creation in the digital economy.

Table 4. Evaluations and recommendations from this study.

Category	Details
Commendable Practices	- Adherence to CCPA/CPRA’s transparency requirements - Effective implementation of informed consent procedures - Utilization of neuromarketing to enhance user experience
Areas needing Improvement	- Need for enhanced data protection measures beyond basic compliance - Improvement in how consumer feedback is integrated into privacy policy updates
Actionable Insights	For Marketers: - Develop more nuanced consumer data handling strategies For Policymakers: - Consider updates to CCPA/CPRA to cover emerging neuromarketing technologies For Scholars: - Explore the long-term impacts of neuromarketing on consumer behavior and privacy
Future research Directions	- Investigate the effectiveness of CCPA/CPRA in real-world applications of neuromarketing - Study the potential for global standards in neuromarketing practices

Source: Compiled by the authors.

organizes the critical evaluations and recommendations into two main categories: commendable practices and areas requiring improvement. Each category includes specific points from the final analysis that highlight the integration of neuromarketing practices with CCPA/CPRA, along with actionable insights for various stakeholders.

6.6. Limitations and Further Research

This study provides critical insights into how neuromarketing practices intersect with California’s CCPA/CPRA framework, yet several limitations constrain the breadth and generalizability of its conclusions. The focus on California offers a valuable lens into one of the most comprehensive privacy regimes in the United States, but it also narrows the study’s applicability. Regulatory environments across U.S. states and international jurisdictions vary significantly, and the findings presented here cannot be assumed to reflect global realities. Future comparative research should examine how neuromarketing is governed across diverse legal contexts to identify both best practices and opportunities for harmonization.

The case study design, centered on Coca-Cola, Frito-Lay, and Hyundai, captures important corporate practices but remains sector-specific. However, descriptions of corporate practices rely on secondary sources and interpretive analysis; direct corporate disclosures or regulatory filings were not available to validate full compliance claims. In addition, neuromarketing applications in domains such as pharmaceuticals, education, and nonprofits may present distinct ethical challenges that are not addressed in this study. Expanding inquiry to include these industries would enrich understanding of sectoral variation and highlight where existing frameworks may prove inadequate.

Another limitation stems from the rapid evolution of neuromarketing technologies. As tools such as EEG, fMRI, and biometric sensors advance, new forms of data collection and analysis may outpace existing regulations, rendering some of the present findings time-bound. Longitudinal research that tracks technological developments alongside shifting regulatory responses would provide valuable insights into the dynamic interplay between innovation, ethics, and governance.

Ultimately, this study primarily focuses on organizational practices and legal frameworks, devoting less attention to consumer perceptions. Yet consumer awareness, acceptance, and resistance are critical factors in shaping both the legitimacy and effectiveness of neuromarketing. Future research should prioritize empirical investigations into consumer attitudes through surveys, interviews, and experimental methods to better understand how neurodata-driven marketing is interpreted and experienced. A further limitation arises from the timing of SB 1223’s enactment. Given its passage in 2024, long-term compliance patterns and enforcement dynamics remain uncertain. Future research should track how firms operationalize the law over time to determine whether early signals of alignment translate into durable practices.

Building on these limitations, several avenues for future inquiry emerge. Comparative cross-jurisdictional studies could map regulatory convergence and divergence, offering pathways toward global standards. Cross-industry analyses would illuminate how ethical and regulatory dilemmas differ across sectors. Longitudinal studies could capture the implications of technological innovation over time, while consumer-centered research would deepen insight into societal expectations and thresholds of acceptability. Finally, developing and testing ethical implementation models could translate abstract principles into practical benchmarks for firms, providing actionable guidance for aligning neuromarketing with consumer rights and stakeholder trust.