Law / United States / 
Vermont
Genetic Information Privacy Act: direct-to-consumer genetic testing companies
9 V.S.A. secs. 2421a to 2421d; 2026 Vt. Acts & Resolves Act 135
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Security, Retention
- Audit expectation
- none
As of .
What it requires
- If you are a direct-to-consumer genetic testing company (you sell or market consumer-initiated genetic testing products or services directly to Vermont consumers, analyze genetic data obtained from a consumer other than through a person licensed in the healing arts for diagnosis or treatment, or collect, use, maintain or disclose genetic data from such a product or service), give Vermont consumers a plain-language summary of your privacy practices and a prominent, easily accessible privacy notice covering your data collection, consent, use, access, disclosure, maintenance, transfer, security, and retention and deletion practices, plus a notice that deidentified genetic or phenotypic information may be shared with third parties for research.
- Obtain a consumer's express consent, in response to a clear, meaningful and prominent notice and never by inaction or through a dark pattern, for the collection, use and disclosure of the consumer's genetic data, with separate and express consent for each use of the data (including who has access to it, how it may be shared and the specific purposes), for storing the biological sample after the initial testing, for each use beyond the primary purpose, for each transfer or disclosure to a third party other than a service provider (naming the third party and the purpose), and for marketing or facilitating marketing based on the data. You may not require consent to a third-party transfer as a condition of the services ordered.
- Give a consumer a way to withdraw consent that is at least as easy as the way the consumer gave it, at least one of them through your primary medium of communication. Honor a revocation as soon as practicable and no later than 30 days after it, and destroy the consumer's biological sample no later than 30 days after a revocation related to its storage or use.
- Implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification or disclosure.
- Develop procedures and practices that let a consumer easily access the consumer's genetic data, delete the consumer's account and genetic data (except data you must retain to comply with legal and regulatory requirements), and have the consumer's biological sample destroyed, and within 30 days of such a request tell every third party, including service providers, that received the data or sample to delete or destroy it.
- Do not store genetic data or biological samples of consumers in a country sanctioned by the Office of Foreign Assets Control or designated a foreign adversary, and transfer or store them outside the United States only with the consumer's express consent.
- Bind each service provider by contract not to retain, use or disclose the biological sample, genetic data or any information about the consumer's identity for a commercial purpose other than the contracted services, and not to associate or combine them with information it receives from or collects for others. The service provider must destroy all genetic data it retained immediately when the contract ends, and may not disclose, transfer or sell it before destroying it.
- Do not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health, life, long-term care or disability insurance or employment, or to an entity that advises one, and do not disclose any information about a consumer to a government entity without a search warrant issued by a court on a finding of probable cause, or unless the consumer gives express consent after being notified by you.
- If you are a person or a public entity, do not discriminate against a consumer for exercising rights under the subchapter by denying goods, services or benefits, charging different prices or rates, providing a different level or quality, suggesting any of these, or treating the exercise of rights as a basis for suspicion of criminal wrongdoing.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionYes
Penalty structure
Section 2421c(a) makes a violation an unfair and deceptive act in commerce under section 2453 of title 9, and section 2421c(b) gives the Attorney General the same authority to bring civil actions as chapter 63. Section 2458(b)(1) of that chapter lets the court impose a civil penalty of not more than $10,000.00 for each unfair or deceptive act or practice in commerce. The subchapter states no penalty of its own.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Statutory damages
A consumer may bring a civil action under section 2421c after sending a written notice and allowing 30 days to cure (section 1a of the act, repealed ). Section 2461(b) of title 9 lets a consumer who sustains damages or injury from a practice prohibited by section 2453 sue for equitable relief and recover damages, reasonable attorney's fees and exemplary damages not exceeding three times the value of the consideration given by the consumer.
- As of
- Currency
- USD
Who enforces it
Enforcement body
Vermont Attorney General, who has the same authority to make rules, conduct civil investigations, bring civil actions and enter into assurances of discontinuance as provided under chapter 63 of title 9 (9 V.S.A. section 2421c(b)).
What this law does
A direct-to-consumer genetic testing company is an entity that sells, markets, interprets or otherwise offers consumer-initiated genetic testing products or services directly to consumers, analyzes genetic data obtained from a consumer other than through a person licensed in the healing arts for diagnosis or treatment of a medical condition, or collects, uses, maintains or discloses genetic data collected or derived from such a product or service.
A direct-to-consumer genetic testing company must obtain a consumer's express consent for the collection, use and disclosure of the consumer's genetic data, with separate and express consent for each of the uses section 2421b(a)(2) lists.
A direct-to-consumer genetic testing company must make available a plain-language summary of its privacy practices and a prominent and easily accessible privacy notice covering its data collection, consent, use, access, disclosure, maintenance, transfer, security, and retention and deletion practices.
A direct-to-consumer genetic testing company must honor a consumer's revocation of consent as soon as practicable and not later than 30 days after the revocation, and must destroy the consumer's biological sample not later than 30 days after receiving a revocation related to its storage or use.
A direct-to-consumer genetic testing company must implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification or disclosure. A direct-to-consumer genetic testing company must develop procedures and practices that let a consumer easily access the consumer's genetic data, delete the consumer's account and genetic data, and have the consumer's biological sample destroyed.
Genetic data and biological samples of consumers may not be stored in a country sanctioned by the Office of Foreign Assets Control or designated a foreign adversary, and may be transferred or stored outside the United States only with the consumer's express consent. A direct-to-consumer genetic testing company must obtain separate and express consent for each use of genetic data or the biological sample beyond the primary purpose of the genetic testing or service.
Section 2421b(f) bars a person or public entity from discriminating against a consumer because the consumer exercised any of the consumer's rights under the subchapter. A direct-to-consumer genetic testing company may not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health, life, long-term care or disability insurance or employment, or to an entity that advises one.
A direct-to-consumer genetic testing company or service provider that violates the subchapter commits an unfair and deceptive act in commerce in violation of section 2453 of title 9. Before a consumer initiates a civil action under section 2421c, the consumer must send the company or service provider a written notice that includes as many details as possible of the alleged violation. The pre-suit notice and cure period in section 1a of Act 135 of 2026 is repealed on .
The Genetic Information Privacy Act does not apply to protected health information collected, maintained, used or disclosed by a covered entity or business associate governed by the federal health privacy, security and breach notification rules.
When LexLint raises it
When your app profile says your app processes biometric data or trains models.