Genetic Information Privacy Act

GIPA

Genetic · Health

Regulates direct-to-consumer genetic testing companies. It requires plain-language privacy notices, separate express consent for each use, storage, transfer, and marketing use of genetic data or samples, reasonable security, and ways for consumers to access and delete data and have samples destroyed. It also bars sharing genetic data with health, life, disability, or long-term care insurers or employers.

Where: California
Citation: Cal. Civ. Code 56.18-56.186
Status: In force
In force since: 2022-01-01
Enforced by: California Attorney General, district attorneys, and specified city attorneys; also on complaint of a person who suffered injury and lost money or property
People can sue: Limited
Penalties: Civil penalty up to $1,000 per negligent violation and $1,000-$10,000 per willful violation, plus court costs; penalties are paid to the individual whose genetic data is at issue (56.182).
Applies to: Direct-to-consumer genetic testing companies (and any person or public entity, for the anti-discrimination rule) (56.18, 56.181)

What a privacy notice must say

Provide a plain-language summary of privacy practices and a prominent privacy notice covering collection, consent, use, access, disclosure, transfer, security, retention, and deletion.Cal. Civ. Code 56.181(a)(1)

Rights it gives people

Consumers may revoke consent; honor revocation within 30 days and destroy stored samples within 30 days.Cal. Civ. Code 56.181(b)-(c)
Consumers may access their genetic data, delete their account and data, and have their sample destroyed.Cal. Civ. Code 56.181(d)(2)

Practices it requires

Do not disclose genetic data to entities that administer health, life, long-term care, or disability insurance or employment decisions.Cal. Civ. Code 56.181(f)
Obtain separate express consent for use of genetic data, storage of biological samples, each secondary use, each third-party transfer (naming the recipient), and marketing based on genetic data.Cal. Civ. Code 56.181(a)(2)
Do not discriminate against consumers for exercising rights under the law.Cal. Civ. Code 56.181(e)

Security duties

Maintain reasonable security procedures and practices for genetic data.Cal. Civ. Code 56.181(d)(1)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Whether any section of 56.18-56.186 other than 56.18, 56.181, 56.182, 56.184, and 56.186 was amended after 2022 was not checked.

Research reference, not legal advice.