State Genetic Privacy Laws for Direct-to-Consumer DNA Testing Companies: California and Four Other Statutes Compared

The Direct-to-Consumer Model These Laws Target

A consumer who orders an ancestry or health kit mails a saliva sample to a company that sequences or genotypes it, keeps the resulting file, and may retain the physical sample. The company is often not a health care provider or health plan within HIPAA's definitions, and a set of state statutes written for this business model addresses that gap. This explainer charts five of them, each read in its codified form on the legislature's own site: California, Arizona, Utah, Virginia and Montana. It does not describe any other state, and a state's absence here is not a finding that it lacks such a law.

The statutes define their target in two ways. Arizona's A.R.S. § 44-8001 covers an entity that "offers genetic testing products or services directly to consumers" and collects genetic data or samples from them. Utah, Montana, California and Virginia go further and also reach businesses that only handle the data. Utah's definition in Utah Code chapter 13-60 includes an entity that "collects, uses, or analyzes genetic data that a consumer provides to the entity"; Montana's, in Mont. Code Ann. § 30-23-102, covers any organization that "collects, uses, or analyzes genetic data," with no link to a consumer-facing sale. Both states also define "genetic testing" to include "an interpretation of a consumer's genetic data."

California's Genetic Information Privacy Act

California's chapter is Civil Code §§ 56.18 to 56.186, added by Stats. 2021, ch. 596 (SB 41), effective January 1, 2022. Section 56.18 defines a direct-to-consumer genetic testing company as an entity that sells, markets or interprets consumer-initiated genetic tests, analyzes consumer genetic data (except a licensed practitioner doing so for diagnosis or treatment), or collects, uses, maintains or discloses genetic data from a DTC product or provided directly by a consumer. "Genetic data" covers any data from analysis of a biological sample that "concerns genetic material," including SNPs, uninterpreted data and "any information extrapolated, derived, or inferred therefrom."

California's definition of express consent is the most detailed of the five. It requires an "affirmative authorization" in response to "a clear, meaningful, and prominent notice," states that consent "cannot be inferred from inaction," and adds that "agreement obtained through use of dark patterns does not constitute consent." A dark pattern is "a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice."

Section 56.181(a)(1) requires three disclosures: a plain-language summary of privacy practices, a complete privacy notice that also explains how to file a complaint, and notice that deidentified genetic or phenotypic information may be shared for research under 45 CFR Part 46. Section 56.181(d) requires reasonable security procedures and ways for a consumer to access their genetic data, delete their account and data, and have their sample destroyed. Section 56.181(e) prohibits any person or public entity from penalizing a consumer for exercising these rights, including by treating the exercise as grounds for suspecting criminal conduct.

Express Consent and Its Separate Occasions

All five statutes use a layered model: one consent for the test itself, and separate consents for anything beyond it. California's § 56.181(a)(2) lists five occasions, each requiring "separate and express consent":

1. Use of the genetic data collected through the product, including who has access, how it may be shared and the specific purposes
2. Storage of the biological sample after the requested testing is complete
3. Each use of the data or sample "beyond the primary purpose of the genetic testing or service and inherent contextual uses"
4. Each transfer or disclosure to a third party other than a service provider, naming the third party
5. Marketing based on the consumer's genetic data, or third-party marketing based on the consumer having bought or used a genetic test

The marketing item has a first-party exception. Under § 56.181(a)(2)(E)(ii), a company need not obtain consent to advertise on its own website or app on the basis that the consumer ordered or used its product, provided the content does not depend on other consumer-specific information and placement is not meant to produce disparate exposure by a protected characteristic. Third-party advertisements must be labeled as advertising and name the contributing third party. Virginia's Va. Code § 59.1-596, enacted in 2023, copies the same five occasions and a similar first-party marketing exception.

Arizona, Utah and Montana use a shorter list. Each requires an initial express consent describing uses, access and sharing; separate express consent for transfers to anyone other than vendors or processors, for uses beyond the primary purpose, and for retaining a sample; informed consent for transfers for research (Arizona and Utah by reference to 45 CFR Part 46); and express consent for genetic-data marketing. Montana's § 30-23-104 adds a separate express consent for the "sale or other valuable consideration" of genetic data. Arizona's § 44-8002 and Utah's statute also require "valid legal process" before disclosing genetic data to law enforcement or other government agencies without the consumer's consent, and Montana's § 30-23-104(4) incorporates the same rule by reference to its § 44-6-104.

Destruction of Samples and Deletion of Data

Each statute requires a process for a consumer to access genetic data, delete it, and have the physical sample destroyed. California and Virginia put a clock on revocation. California's § 56.181(c) requires a company to honor a revocation "as soon as practicable, but not later than 30 days" after it is made, and to "destroy a consumer's biological sample within 30 days of receipt of revocation of consent to store the sample." Virginia's § 59.1-596(D) uses the same two 30-day periods. California also requires at least one revocation mechanism to use "the primary medium through which the company communicates with consumers."

Deletion rights have stated limits. California's § 56.181(d)(2)(B) excepts "genetic data that is required to be retained by the company to comply with applicable legal and regulatory requirements." Virginia's § 59.1-597 similarly excepts data state or federal law requires the company to retain. Montana's § 30-23-104 contains two waivers. The access, deletion, revocation and destruction rights are waived for clinical research participants who give a separate written consent, obtained no sooner than 14 days after sample collection when the sample was collected for an unrelated purpose, in 12-point type, disclosing that whole genome sequencing may follow. The destruction right is temporarily waived for laboratories retaining samples under 42 CFR 493.1105, for no more than two years.

Insurers, Employers and Who Enforces

All five limit disclosure to insurers and employers, in different terms. The table below summarizes the text of each statute as read.

None of the five expressly creates a private lawsuit in the consumer's own name. California comes closest: its penalties go to "the individual to whom the genetic data at issue pertains," and § 56.182(e) voids contract terms that would delay or limit access to a legal remedy. Illinois takes a different approach for the same companies; section 20(e) of its statute bars sharing with health or life insurers without written consent, backed by a private right of action, as described in the Illinois Genetic Information Privacy Act.

Montana Adds Neurotechnology Data

Montana's statute was enacted in 2023 as chapter 768 and amended in 2025 by chapter 345, according to the history notes on each section. The enrolled SB 163 is titled an act "including neurotechnology data in the scope of the Genetic Information Privacy Act." It extended the notice, consent, access and disclosure rules to "neurotechnology data," defined in § 30-23-102(10) as information captured by devices that record or interpret activity of the central or peripheral nervous system, excluding "nonneural information" such as pupil dilation, motor activity and breathing rate. The findings in § 30-23-101 state that noninvasive neurotechnologies used outside medical settings "are generally considered consumer products and operate without regulation or data protection standards."

What the Laws Do Not Reach

Each statute carves out the health care system. California's § 56.184(c) excludes medical information under California's Confidentiality of Medical Information Act, HIPAA protected health information, providers, covered entities and business associates that treat genetic information like other medical records, tests conducted exclusively to diagnose a specific disease, and the state newborn screening program. Arizona's § 44-8003, Utah's part 1 and Virginia's § 59.1-594 exclude HIPAA protected health information, and Arizona also excludes samples obtained for medical screening, treatment or diagnosis. Montana's exclusion for protected health information applies only if the covered entity obtained separate informed consent for genetic data and follows the access and deletion policies in § 30-23-104.

Research and education are the second carve-out. Arizona and Utah exclude public and private institutions of higher education and entities they own or operate. California and Virginia exclude research by institutions holding an HHS assurance under 45 CFR Part 46. California, Arizona, Utah and Virginia exclude deidentified data from "genetic data," with different tests: Arizona uses HIPAA's 45 CFR 164.514(b) standard, while the other three require technical measures, a commitment not to reidentify, and contractual limits on recipients. Montana's § 30-23-103 is narrower, excluding only deidentified genetic data obtained from a third party and used for internal, medical or scientific research. Montana also excludes uses by a governmental agency, while requiring any agency collection to follow a specific state law or a warrant or investigative subpoena.

Finally, these statutes regulate testing companies, not employers or insurers directly. An employer's own requests for genetic information are governed by other laws, including GINA Title II, and a health plan's underwriting by the HIPAA genetic information rule. How the newer consumer health data statutes treat genetic data as one category among many is covered in the consumer health data laws guide.

Frequently Asked Questions