Direct-to-Consumer Genetic Testing Privacy (P.A. 26-64, ss. 17-19)
CT DTC Genetic Privacy
Genetic · Health
Gives consumers a property right in, and exclusive control over, their biological samples and genetic test results held by direct-to-consumer genetic testing companies. Companies must obtain express consent for collection, use, transfer, secondary use and sample retention, may not share genetic data with employers, insurers or marketers, and must let consumers access and delete data and destroy samples.
- Where
- Connecticut
- Citation
- P.A. 26-64, ss. 17-19 (not yet codified)
- Status
- Enacted, not yet in force
- In force since
- 2026-10-01
- Enforced by
- Connecticut Attorney General (solely; P.A. 26-64, s. 19(b))
- People can sue
- No
- Penalties
- Violations are CUTPA unfair or deceptive trade practices enforced solely by the Attorney General (up to $5,000 per wilful violation under 42-110o); no private action under 42-110g.
- Applies to
- Direct-to-consumer genetic testing companies doing business in Connecticut that offer genetic testing directly to consumers or collect, use or analyze genetic data consumers provide; excludes licensed health care providers ordering tests for a medical purpose (s. 17(4))
- Protects any individual physically present in Connecticut who receives or may receive genetic testing (s. 17(2))
What a privacy notice must say
- Disclose genetic data policies before accepting a sample, data or payment, and post a prominent privacy notice on the website.P.A. 26-64, s. 19(a)(2)-(3)
Rights it gives people
- Consumers hold a property right in and exclusive control over their biological samples and genetic test results, including collection, use, retention, disclosure and destruction.P.A. 26-64, s. 18
- Provide a process for consumers to access their genetic data, have it deleted, have their sample destroyed with confirmation, and revoke research consent.P.A. 26-64, s. 19(a)(10)
Practices it requires
- Obtain express consent before collecting, using or disclosing genetic data, and separate express consent for transfers to third parties, secondary uses, and retaining the sample after testing; obtain Common Rule informed consent for research use.P.A. 26-64, s. 19(a)(4)-(6)
- Do not disclose test results except with express consent or under court order, warrant or subpoena; never disclose genetic data to the consumer's employer, to health, life or long-term care insurers or underwriting data suppliers, or to third parties for marketing.P.A. 26-64, s. 19(a)(7)-(8)
Security duties
- Implement reasonable security measures to protect biological samples and genetic data.P.A. 26-64, s. 19(a)(9)
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Research reference, not legal advice.