Privacy Law Library

Alabama Genetic Data Privacy Act

AGDPA

Genetic · Health

Regulates direct-to-consumer genetic testing companies. They must post plain-language privacy notices and get express consent for initial collection and use, for each transfer to third parties, for secondary uses, and for genetic-data-based marketing, plus informed consent for research. Consumers can access their data, delete their accounts, and have samples destroyed.

Where
Alabama
Citation
Ala. Code §§ 8-43-1 to 8-43-6 (Act 2024-384, HB21)
Status
In force
In force since
2024-10-01
Enforced by
Alabama Attorney General (Consumer Interest Division)
People can sue
No
Penalties
The AG's Consumer Interest Division may sue for an injunction or a civil penalty of up to $3,000 per violation. Penalties and costs may be waived if the company made full restitution or paid actual damages to injured consumers.
Applies to
  • Direct-to-consumer genetic testing companies: persons other than health care providers that directly solicit biological samples from consumers to provide ancestry, relationship, or wellness information
  • Contractors of genetic testing companies
  • Excludes HIPAA covered entities and business associates, noncommercial research and instruction by institutions of higher learning, and samples lawfully obtained by law enforcement in a criminal investigation

What a privacy notice must say

  • Prominently display plain-language policies on collection, use, maintenance, and disclosure of genetic data, including a privacy overview, full privacy notice, notice of deidentified research sharing, and how to file a complaint.Ala. Code § 8-43-3(a)(1)

Rights it gives people

  • Provide a process for consumers to access genetic data, delete their account, request destruction of the sample and data (within 30 days), and revoke consent (third-party material retrieved within 60 days).Ala. Code § 8-43-3(a)(5)

Practices it requires

  • Obtain separate express consent each time the company transfers a sample or data to a non-contractor third party, uses it for a purpose other than the ordered service, or markets based on genetic data.Ala. Code § 8-43-3(a)(3)
  • Do not disclose genetic data to health, life, disability, or long-term care insurers or to current or prospective employers without express written consent.Ala. Code § 8-43-3(c)
  • Obtain informed consent under 45 C.F.R. Part 46 before transferring samples or data for third-party research or company-sponsored research.Ala. Code § 8-43-3(a)(4)
  • Obtain initial express consent covering use of the sample and data, who may access it, and retention for future testing.Ala. Code § 8-43-3(a)(2)

Other duties

  • Contracts with contractors must bar using, retaining, or disclosing samples or data except to perform the contracted service; contractors share the company's confidentiality duties.Ala. Code § 8-43-4

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Effective date October 1, 2024 is from the ALISON bill record (HB21, 2024RS) effective-date field.

Research reference, not legal advice.