Minnesota Genetic Information Privacy Act (direct-to-consumer genetic testing)
MN Genetic Information Privacy Act
Genetic · Health
Requires direct-to-consumer genetic testing companies to give plain-language privacy notices, get express consent for collecting and using genetic data and separate consent for each third-party disclosure, secondary use, sample retention, research transfer, and genetic-data-based marketing, and to let consumers access and delete their data and have samples destroyed. Companies may not give genetic data to law enforcement without consent or a warrant or court order, or to insurers or employers without written consent.
- Where
- Minnesota
- Citation
- Minn. Stat. 325F.995
- Status
- In force
- In force since
- 2023-08-01
- Enforced by
- Minnesota Commissioner of Commerce under 45.027 (325F.995, subd. 4)
- People can sue
- No
- Penalties
- Enforced by the Commissioner of Commerce using the Department of Commerce's general investigative and enforcement powers in 45.027 (subd. 4); the section sets no specific dollar penalty. Rights and remedies under 13.386 and chapter 13 are preserved (subd. 6).
- Applies to
- Direct-to-consumer genetic testing companies that offer consumer genetic tests to Minnesota residents or collect, use, or analyze DTC genetic data provided by consumers (325F.995, subd. 1(c), (e))
- Service providers handling samples or genetic data for such companies (subd. 3)
- Exempt: HIPAA protected health information held by covered entities or business associates, and public or private institutions of higher education and entities they own or operate (subd. 5)
What a privacy notice must say
- Provide a plain-language high-level privacy overview, a prominent public privacy notice covering collection, consent, use, access, disclosure, transfer, security, retention, and deletion of genetic data, and information on how to file a complaint.Minn. Stat. 325F.995, subd. 2(a)(1)
Rights it gives people
- Provide processes for consumers to access their genetic data, delete their account and genetic data, and have their biological sample destroyed; honor consent revocations within 30 days.Minn. Stat. 325F.995, subd. 2(a)(5), (c)
Practices it requires
- Obtain initial express consent and separate express consent for each named third-party transfer, each use beyond the primary purpose, retention of the biological sample, research transfers (under 45 C.F.R. part 46), and marketing based on genetic data.Minn. Stat. 325F.995, subd. 2(a)(2)
- Do not disclose genetic data to law enforcement or other government agencies without express written consent unless under a valid warrant or court order, and never to health, life, disability, or long-term care insurers or employers without written consent identifying the recipient.Minn. Stat. 325F.995, subd. 2(a)(3), (b)
Security duties
- Develop, implement, and maintain a comprehensive security program to protect genetic data against unauthorized access, use, or disclosure.Minn. Stat. 325F.995, subd. 2(a)(4)
Other duties
- Service provider contracts must bar retaining, using, disclosing, or combining samples, genetic data, or identity information except to perform the contracted services.Minn. Stat. 325F.995, subd. 3
Sources
- Official text
- Minn. Stat. 325F.995 (Office of the Revisor of Statutes)
- Laws 2023, ch. 57, art. 4, s. 18 (signed May 24, 2023)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Effective date: the enacting section (Laws 2023, ch. 57, art. 4, s. 18) has no effective-date clause, so August 1, 2023 is inferred from the default rule in Minn. Stat. 645.02. | The task description referred to a '2025 DTC genetic testing law'; the revisor history for 325F.995 shows only Laws 2023, ch. 57, and no 2025 or 2026 amendment was found.
Research reference, not legal advice.