Genetic Information Privacy Act (direct-to-consumer genetic testing)

RI GIPA

Genetic · Health · Marketing

Enacted in June 2026 and effective on passage, this law regulates consumer genetic testing companies such as ancestry and health DNA services. They must publish plain-language privacy information, get separate express consent for each use, storage, transfer and genetic-based marketing, let consumers access and delete data and destroy samples, secure genetic data, and not share it with insurers or employers.

Where: Rhode Island
Citation: R.I. Gen. Laws §§ 6-63-1 to 6-63-7 (P.L. 2026, ch. 222 and ch. 223)
Status: In force
In force since: 2026-06-19
Enforced by: Rhode Island Attorney General (exclusive)
People can sue: No
Penalties: Negligent violations: civil penalty up to $1,000 plus court costs; willful violations: $1,000 to $10,000 plus costs. Each violation is separate. Only the Attorney General may sue, and penalties recovered are paid to the individual whose genetic data is at issue (§ 6-63-4).
Applies to: Direct-to-consumer genetic testing companies: entities that sell, market, interpret or offer consumer-initiated genetic tests, analyze a consumer's genetic data (other than licensed clinicians diagnosing or treating), or collect, use, keep or disclose genetic data from DTC tests or provided directly by consumers
Rhode Island residents are the protected consumers
Excludes HIPAA and ch. 5-37.3 medical information and entities handling genetic data like medical information, IRB-governed nonprofit postsecondary research, newborn screening, diagnostic tests handled as medical information, and employer data needed for workplace health and safety compliance

What a privacy notice must say

Make available a plain-language summary of privacy practices, a prominent privacy notice covering collection, consent, use, access, disclosure, transfer, security, retention and deletion and how to file a complaint, and notice that de-identified data may be shared for research under 45 CFR Part 46.R.I. Gen. Laws § 6-63-3(a)(1)

Rights it gives people

Provide easy mechanisms to revoke consent, honor revocation within 30 days, and destroy the biological sample within 30 days after consent to store it is revoked.R.I. Gen. Laws § 6-63-3(a)(2)(v)(D), (b)
Enable consumers to easily access their genetic data, delete their account and genetic data (except data legally required to be kept), and have their biological sample destroyed.R.I. Gen. Laws § 6-63-3(c)(2)

Practices it requires

Do not disclose genetic data to entities that administer or decide health, life, long-term care or disability insurance or employment (or advise them), subject to a narrow exception for entities not primarily in those businesses with walled-off access.R.I. Gen. Laws § 6-63-3(e)
Do not discriminate against consumers for exercising rights, including by denying goods, charging different prices, reducing quality, or treating the exercise of rights as suspicion of wrongdoing.R.I. Gen. Laws § 6-63-3(d)
Obtain separate express consent for use of genetic data, storage of the biological sample after testing, each secondary use, each transfer to a named third party (other than a service provider), and marketing based on genetic data or test purchase; consent obtained through dark patterns is invalid.R.I. Gen. Laws §§ 6-63-2(6), 6-63-3(a)(2)

Security duties

Implement and maintain reasonable security procedures and practices protecting genetic data against unauthorized access, destruction, use, modification or disclosure.R.I. Gen. Laws § 6-63-3(c)(1)

Other duties

Contracts with service providers must bar them from retaining, using, disclosing or combining samples, genetic data or consumer identity beyond the contracted services.R.I. Gen. Laws § 6-63-2(10)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: The chapter was not yet posted in the online General Laws (Title 6 index checked 2026-09-25); section numbers are taken from the enacted public law text and may be renumbered by the Law Revision Office. | Effective date assumes 'effective upon passage' means the 06/19/2026 enactment date shown on the public law; the Governor's signing date was reported by a secondary news source (VitalLaw) and not confirmed on an official page. | Companion Senate act P.L. 2026, ch. 222 (2026-S 2203) was not fetched; assumed identical.

Research reference, not legal advice.