Genetic Data Privacy (direct-to-consumer genetic testing companies)

Regulates direct-to-consumer genetic testing companies. They must publish plain-language privacy summaries, get separate express consent for each use, sample storage, secondary use, third-party transfer, and genetic-data-based marketing, honor consent revocation within 30 days, secure the data, and let consumers access and delete it. Disclosure to insurers or employers requires express consent.