Law / United States / 
Indiana
Consumer genetic testing providers: privacy disclosure, consent, security, access and revocation duties, and no sharing with insurers or employers
Ind. Code §§ 24-4-24-1 to 24-4-24-11
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Security, Data subject rights, Retention, Prohibition
- Audit expectation
- none
As of .
What it requires
- If you are a consumer genetic testing provider, give an individual a written disclosure of your privacy policy before you perform, or cause to be performed, genetic testing on the individual's biological material, covering how you collect, maintain, secure, retain and use the material and the resulting data, and publish the disclosure on your website with prominent directions and hyperlinks to it (Ind. Code 24-4-24-8).
- Do not, without the individual's freely given, specific, informed and unambiguous consent, test the individual's biological material beyond what the individual requested, use it for any other purpose, give a third party access to it or to identifiable genetic data, keep the material or identifiable data for more than 30 days after the requested testing or service, send advertising based on the results, or give a third party information that lets it advertise to the individual (24-4-24-9(a)).
- Describe each action in terms a person of ordinary intelligence can understand and ask for consent to each action separately, because consent given by inaction, by accepting general terms of service, by closing, muting or hovering over content, or through an interface designed to subvert user choice is not valid (24-4-24-9(b) and (c)).
- Implement commercially reasonable security measures to protect the biological material and the resulting data from unauthorized access, destruction, use, modification or disclosure (24-4-24-10(a)(1)).
- Let the individual access the data resulting from the genetic testing, provide a procedure to revoke consent with clear notice and instructions for it, and comply with a revocation not later than 30 days after it is communicated, including by destroying the biological material and the data whose retention the individual no longer consents to (24-4-24-10(a)(2) to (4)).
- Give a third party access to the biological material or the resulting data only under contract terms that bar the third party from using them beyond the individual's consent, giving another party access, or keeping them longer than you may (24-4-24-10(a)(5)).
- Clearly and prominently mark advertising or marketing communications sent because of the individual's use of your services, and make sure third-party communications identify the third party and state that you have not evaluated the claims in them (24-4-24-10(a)(6)).
- Do not provide data, other than deidentified data, resulting from genetic testing to an insurer, to a person that provides information to insurers for underwriting or rating, or to the individual's employer, even if the individual has consented to third-party access (24-4-24-10(b)).
- Do not charge a law enforcement agency, on a search warrant or court order, more than your actual cost, not counting labor or overhead, for providing the biological material or the data (24-4-24-10(c)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 11(b) lets the attorney general seek an injunction and a civil penalty not to exceed $7,500 for each violation of the chapter, and section 11(c) lets the attorney general recover reasonable expenses of investigating and preparing the case, including attorney's fees. Section 11(d) requires 30 days written notice and a chance to cure before an action.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 7,500
Who enforces it
Enforcement body
Indiana Attorney General, who has exclusive authority to enforce the chapter (Ind. Code 24-4-24-11(a)).
What this law does
In chapter 24 of article 4 of title 24 of the Indiana Code, consumer genetic testing means a service in which a person provides an individual with a means of submitting a sample of the individual's biological material directly to the person, performs or causes to be performed genetic testing on it, and returns the results directly to the individual.
The chapter excludes genetic testing of a health care provider's patient that is requested by the provider for diagnosis, treatment or prevention and is subject to Health Insurance Portability and Accountability Act (HIPAA), testing required by a court order, testing for a law enforcement investigation, testing at the request of a coroner or medical examiner, and research subject to the federal human subject protection rules.
A consumer genetic testing provider is a person that, in the ordinary course of business, offers consumer genetic testing or collects, uses or analyzes genetic data that results from a consumer genetic testing product or service and is provided by a consumer, in exchange for consideration. Section 8 of the chapter bars a provider from performing genetic testing on an individual's biological material unless it has given the individual a written disclosure of its privacy policy.
Section 9 of the chapter bars a provider from testing beyond what the individual requested, using the biological material for another purpose, giving a third party access, retaining the material or identifiable data for more than 30 days, or marketing based on the results unless the provider has received the individual's freely given, specific, informed and unambiguous consent.
Section 9(c) of the chapter provides that consent is not freely given, specific, informed and unambiguous if it is provided by the individual's inaction, by acceptance of general or broad terms of service, by closing, muting, pausing or hovering over content, or through an interface designed to subvert user choice.
Section 10(a) of the chapter requires a provider to implement commercially reasonable security measures to protect the biological material and the resulting data from unauthorized access, destruction, use, modification or disclosure. Section 10(a) of the chapter requires a provider to comply with a revocation of consent not later than 30 days after the individual communicates it, including by destroying the biological material and the resulting data.
Section 10(b) of the chapter bars a provider from providing data, other than deidentified data, resulting from genetic testing to an insurer, to a person that provides information to insurers for underwriting or rating of risks, or to a person that employs the individual, regardless of the individual's consent to third-party access.
Section 11 of the chapter gives the attorney general exclusive authority to enforce the chapter, by an action for an injunction and a civil penalty not to exceed $7,500 for each violation. Section 11(d) of the chapter requires the attorney general to give a provider 30 days written notice of the alleged violation before bringing an action, and bars the action if the provider cures the violation and gives an express written statement within that period.
Section 11(f) of the chapter provides that nothing in the section may be construed as providing the basis for a private right of action for violations of the chapter or any other law. Public Law 233 of 2025 added the chapter to the Indiana Code. House Bill 1521 of the 2025 session became Public Law 233, and the Governor signed it on .
When LexLint raises it
When your app profile says your app processes biometric data or trains models.