Privacy Law Library

Direct-to-Consumer Genetic Testing Privacy (P.A. 26-64, ss. 17-19)

CT DTC Genetic Privacy

Genetic · Health

Gives consumers a property right in, and exclusive control over, their biological samples and genetic test results held by direct-to-consumer genetic testing companies. Companies must obtain express consent for collection, use, transfer, secondary use and sample retention, may not share genetic data with employers, insurers or marketers, and must let consumers access and delete data and destroy samples.

Where
Connecticut
Citation
P.A. 26-64, ss. 17-19 (not yet codified)
Status
Enacted, not yet in force
In force since
2026-10-01
Enforced by
Connecticut Attorney General (solely; P.A. 26-64, s. 19(b))
People can sue
No
Penalties
Violations are CUTPA unfair or deceptive trade practices enforced solely by the Attorney General (up to $5,000 per wilful violation under 42-110o); no private action under 42-110g.
Applies to
  • Direct-to-consumer genetic testing companies doing business in Connecticut that offer genetic testing directly to consumers or collect, use or analyze genetic data consumers provide; excludes licensed health care providers ordering tests for a medical purpose (s. 17(4))
  • Protects any individual physically present in Connecticut who receives or may receive genetic testing (s. 17(2))

What a privacy notice must say

  • Disclose genetic data policies before accepting a sample, data or payment, and post a prominent privacy notice on the website.P.A. 26-64, s. 19(a)(2)-(3)

Rights it gives people

  • Consumers hold a property right in and exclusive control over their biological samples and genetic test results, including collection, use, retention, disclosure and destruction.P.A. 26-64, s. 18
  • Provide a process for consumers to access their genetic data, have it deleted, have their sample destroyed with confirmation, and revoke research consent.P.A. 26-64, s. 19(a)(10)

Practices it requires

  • Obtain express consent before collecting, using or disclosing genetic data, and separate express consent for transfers to third parties, secondary uses, and retaining the sample after testing; obtain Common Rule informed consent for research use.P.A. 26-64, s. 19(a)(4)-(6)
  • Do not disclose test results except with express consent or under court order, warrant or subpoena; never disclose genetic data to the consumer's employer, to health, life or long-term care insurers or underwriting data suppliers, or to third parties for marketing.P.A. 26-64, s. 19(a)(7)-(8)

Security duties

  • Implement reasonable security measures to protect biological samples and genetic data.P.A. 26-64, s. 19(a)(9)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Research reference, not legal advice.