In the context of the data driven economy, the widespread deployment of emotional artificial intelligence raises serious legal issues. Should we resist to exploit emotional AI? How could privacy and autonomy be adequately protected in the face of the advancement of mind-reading technologies? Should the European Union recognise a set of neurorights? This work aims at offering a critical analysis of emotional AI current regulation and sets the stage for a discussion, identifying some loopholes in the European legislative framework and proposing how to close them in order to shape a more effective governance of emotional AI. A preliminary review suggests that current legal standards, in the European Union legal framework, may require further interpretation or amendment to ensure adequate protection against manipulative emotional profiling for business or political goals and to assure that mental data fall unambiguously within the highest standard of legal protections: i.e., under the protection of art. 9 GDPR.