The Vermont Statutes Online

Title 9 : Commerce and Trade

Chapter 061a : Data Privacy [Effective January 1, 2028]

Subchapter 002 : Genetic Information Privacy

• § 2421a. Short title and definitions

  (a) This subchapter shall be known, and may be cited, as the “Genetic Information Privacy Act.”

  (b) As used in this subchapter:

  (1) “Affirmative authorization” means an action that demonstrates an intentional decision by a consumer.

  (2) “Biological sample” means any material part of the human, discharge therefrom, or derivative thereof, such as tissue, blood, urine, or saliva, known to contain deoxyribonucleic acid (DNA).

  (3)(A) “Biometric data” means data generated from the technological processing of a consumer’s unique biological, physical, or physiological characteristics that allow or confirm the unique identification of the consumer, including:

  (i) iris or retina scans;

  (ii) fingerprints;

  (iii) facial or hand mapping, geometry, or templates;

  (iv) vein patterns;

  (v) voice prints or vocal biomarkers; and

  (vi) gait or personally identifying physical movement or patterns.

  (B) “Biometric data” does not include:

  (i) a digital or physical photograph;

  (ii) an audio or video recording; or

  (iii) any data generated from a digital or physical photograph, or an audio or video recording, unless such data is generated to identify a specific consumer.

  (4) “Consumer” means an individual who is a Vermont resident.

  (5) “Dark pattern” means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice.

  (6) “Direct-to-consumer genetic testing company” means an entity that:

  (A) sells, markets, interprets, or otherwise offers consumer-initiated genetic testing products or services directly to consumers;

  (B) analyzes genetic data obtained from a consumer, except to the extent that the analysis is performed by a person licensed in the healing arts for diagnosis or treatment of a medical condition; or

  (C) collects, uses, maintains, or discloses genetic data that is:

  (i) collected or derived from a direct-to-consumer genetic testing product or service; or

  (ii) directly provided by a consumer.

  (7) “Disclose,” “disclosing,” or “disclosure” means to solicit, sell, assign, transfer, give, provide, or trade, whether or not for valuable consideration.

  (8) “Express consent” means a consumer’s affirmative authorization to grant permission in response to a clear, meaningful, and prominent notice regarding the collection, use, maintenance, or disclosure of genetic data for a specific purpose. Express consent cannot be inferred from inaction. Agreement obtained through the use of dark patterns does not constitute express consent.

  (9)(A) “Genetic data” means any data, regardless of its format, that results from the analysis of a biological sample from a consumer, or from another element enabling equivalent information to be obtained, and concerns genetic material. Genetic material includes deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), uninterpreted data that results from the analysis of the biological sample, and any information extrapolated, derived, or inferred therefrom.

  (B) “Genetic data” does not include deidentified data. For purposes of this subdivision (B), “deidentified data” means data that cannot be used to infer information about, or otherwise be linked to, a particular individual, provided that the business that possesses the information:

  (i) takes reasonable measures to ensure that the information cannot be associated with a consumer or household;

  (ii) publicly commits to maintain and use the information only in deidentified form and not to attempt to reidentify the information, except that the business may periodically attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision (B), on the express condition that the business does not use or disclose any information reidentified in this process and destroys the reidentified information upon completion of that periodic assessment; and

  (iii) contractually obligates any recipients of the information to take reasonable measures to ensure that the information cannot be associated with a consumer or household and to commit to maintaining and using the information only in deidentified form and not to reidentify the information.

  (C) “Genetic data” does not include data or a biological sample to the extent that data or a biological sample is collected, used, maintained, and disclosed:

  (i) exclusively for scientific research conducted by an investigator with an institution that holds an assurance with the U.S. Department of Health and Human Services pursuant to 45 C.F.R. Part 46; or

  (ii) in compliance with all applicable federal and State laws and regulations for the protection of human subjects in research, including the:

  (I) Common Rule, 45 C.F.R. Part 46;

  (II) U.S. Food and Drug Administration regulations pursuant to 21 C.F.R. Parts 50 and 56; and

  (III) Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g.

  (10) “Genetic testing” means any laboratory test of a biological sample from a consumer for the purpose of determining information concerning genetic material contained within the biological sample, or any information extrapolated, derived, or inferred therefrom.

  (11) “Person” means an individual, partnership, corporation, association, business, business trust, or legal representative of an organization.

  (12)(A) “Publicly available information” means information that is made available through federal, state, or local government records or to the general public from widely distributed media.

  (B) “Publicly available information” does not include:

  (i) biometric data collected by a business about a consumer without the consumer’s knowledge;

  (ii) information that is collated and combined to create a consumer profile that is made available to a user of a publicly available website either in exchange for payment or free of charge;

  (iii) information that is made available for sale;

  (iv) an inference that is generated from the information described in subdivision (ii) or (iii) of this subdivision (12)(B);

  (v) any obscene visual depiction, as defined in 18 U.S.C. § 1460;

  (vi) personal data that is created through the combination of personal data with publicly available information;

  (vii) genetic data, unless otherwise made publicly available by the consumer to whom the information pertains;

  (viii) information provided by a consumer on a website or online service made available to all members of the public, for free or for a fee, where the consumer has maintained a reasonable expectation of privacy in the information, such as by restricting the information to a specific audience; or

  (ix) intimate images, authentic or computer generated, known to be nonconsensual.

  (13) “Service provider” means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is involved in the collection, transportation, or analysis of the consumer’s biological sample or extracted genetic material:

  (A) on behalf of a direct-to-consumer genetic testing company;

  (B) on behalf of any other company that collects, uses, maintains, or discloses genetic data collected or derived from a direct-to-consumer genetic testing product or service; or

  (C) that is directly provided by a consumer. (Added 2025, No. 135 (Adj. Sess.), § 1, eff. July 1, 2026.)