Privacy Law Library

Genetic Data Privacy (direct-to-consumer genetic testing companies)

VA Genetic Data Privacy

Genetic · Health

Regulates direct-to-consumer genetic testing companies. They must publish plain-language privacy summaries, get separate express consent for each use, sample storage, secondary use, third-party transfer, and genetic-data-based marketing, honor consent revocation within 30 days, secure the data, and let consumers access and delete it. Disclosure to insurers or employers requires express consent.

Where
Virginia
Citation
Va. Code §§ 59.1-593 to 59.1-602 (Title 59.1, Chapter 56)
Status
In force
In force since
2023-07-01
Enforced by
Virginia Attorney General (exclusive, 59.1-601(A))
People can sue
No
Penalties
Civil penalty up to $1,000 per violation, or $1,000 to $10,000 per willful violation, plus attorney fees, expenses, and costs; each violation is separate (59.1-601(D)-(E)).
Applies to
  • Direct-to-consumer genetic testing companies that offer consumer-initiated genetic tests or analyze genetic data provided directly by consumers (Virginia residents) (59.1-593)
  • Exclusions: HIPAA PHI, covered entities and business associates, Common Rule research by nonprofit higher education, newborn screening, diagnostic tests handled like PHI, and employer workplace-safety uses (59.1-594)

What a privacy notice must say

  • Provide a plain-language summary of genetic data collection, use, retention, disclosure, deletion, and security policies, the express-consent and revocation process, notice of deidentified research sharing, and how to complain, with the product and on the website.Va. Code § 59.1-595

Rights it gives people

  • Offer a revocation mechanism through the primary communication channel; honor revocation within 30 days and destroy the biological sample within 30 days of revoked storage consent.Va. Code § 59.1-596(C)-(D)
  • Let consumers easily access and delete their genetic data and request destruction of their biological sample.Va. Code § 59.1-597(2)

Practices it requires

  • Obtain separate express consent for use of genetic data, storage of the sample after testing, each secondary use, each transfer to a named third party other than a service provider, and marketing based on genetic data.Va. Code § 59.1-596(B)
  • Do not discriminate against a consumer for exercising rights under the chapter.Va. Code § 59.1-600
  • Service provider contracts must bar retention, use, or disclosure beyond the contracted service and bar combining the data with other information.Va. Code § 59.1-598
  • Do not disclose genetic data to health, life, long-term care, or disability insurers or employers (or their advisers) without express consent.Va. Code § 59.1-599

Security duties

  • Implement and maintain reasonable security procedures and practices for genetic data.Va. Code § 59.1-597(1)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Research reference, not legal advice.