Privacy Law Library

Genetic Information Privacy Act

VT GIPA

Genetic · Health

Vermont's 2026 genetic privacy law requires direct-to-consumer genetic testing companies to publish plain-language privacy terms, get separate express consent for each use, storage or transfer of genetic data and samples, protect the data, and let consumers access and delete data and destroy samples. It bans disclosing genetic data to insurers or employers, and requires a warrant or the consumer's consent before disclosure to the government.

Where
Vermont
Citation
9 V.S.A. §§ 2421a-2421d (9 V.S.A. ch. 61A), added by 2026 Acts and Resolves No. 135 (H.639)
Status
In force
In force since
2026-07-01
Enforced by
Vermont Attorney General (Consumer Protection Act); consumers
People can sue
Yes
Penalties
A violation is an unfair and deceptive act under 9 V.S.A. § 2453; the AG may seek civil penalties up to $10,000 per violation (§ 2458) and has rulemaking and investigation powers. Consumers may sue under the Consumer Protection Act, but until June 30, 2028 they must first send written notice and allow a 30-day cure period (Act 135, Secs. 1a-1b).
Applies to
  • Direct-to-consumer genetic testing companies and their service providers
  • Any person or public entity, for the ban on discriminating against consumers who exercise their rights
  • Excludes HIPAA protected health information, covered entities and business associates handling genetic data as PHI, qualifying nonprofit university research, diagnostic tests handled as medical information, and employer genetic data needed for workplace safety compliance

What a privacy notice must say

  • Provide a plain-language summary of privacy practices, a prominent privacy notice covering collection, consent, use, access, disclosure, security and retention, and notice that de-identified data may be shared for research.9 V.S.A. § 2421b(a)(1)

Rights it gives people

  • Let consumers easily access their genetic data, delete their account and data, and have their sample destroyed, and pass deletion requests to third parties within 30 days.9 V.S.A. § 2421b(d)(1)(B)-(C)
  • Give consumers a withdrawal mechanism as easy as giving consent, honor it within 30 days, and destroy biological samples within 30 days of a related revocation.9 V.S.A. § 2421b(c)

Practices it requires

  • Obtain separate express consent for the primary use of genetic data, sample storage after testing, each secondary use, each transfer to a third party (not a condition of service), and genetic-data-based marketing.9 V.S.A. § 2421b(a)(2)
  • Do not discriminate against consumers, for example through price or service quality, for exercising their rights.9 V.S.A. § 2421b(f)
  • Do not store genetic data or samples in OFAC-sanctioned or foreign-adversary countries, and transfer or store them outside the U.S. only with express consent.9 V.S.A. § 2421b(d)(2)
  • Service provider contracts must bar using or combining genetic data for other purposes and require immediate destruction when the contract ends.9 V.S.A. § 2421b(e)
  • Do not disclose genetic data to insurers or employers (or their advisers), or any consumer information to a government entity without a warrant or the consumer's express consent.9 V.S.A. § 2421b(g)

Security duties

  • Implement and maintain reasonable security procedures and practices to protect genetic data.9 V.S.A. § 2421b(d)(1)(A)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Codification conflict: Act 135 and Act 145 (VDPOSA) both add '9 V.S.A. chapter 61A, subchapter 1'. Legislative Counsel will probably renumber one of them when the 2026 statutes are published; the section numbers here (§§ 2421a-2421d) follow the act as enacted.

Research reference, not legal advice.