The Vermont Statutes Online

Title 9 : Commerce and Trade

Chapter 061a : Data Privacy [Effective January 1, 2028]

Subchapter 002 : Genetic Information Privacy

• § 2421b. Requirements

  (a) Privacy terms and consent. To safeguard the privacy, confidentiality, security, and integrity of a consumer’s genetic data, a direct-to-consumer genetic testing company shall:

  (1) provide clear and complete information regarding the company’s policies and procedures for the collection, use, maintenance, and disclosure, as applicable, of genetic data by making available to a consumer all of the following:

  (A) a summary of its privacy practices, written in plain language, that includes information about the company’s collection, use, maintenance, and disclosure, as applicable, of genetic data;

  (B) a prominent and easily accessible privacy notice that includes, at a minimum, complete information about the company’s data collection, consent, use, access, disclosure, maintenance, transfer, security, and retention and deletion practices; and

  (C) a notice that the consumer’s deidentified genetic or phenotypic information may be shared with or disclosed to third parties for research purposes in accordance with 45 C.F.R. Part 46; and

  (2) obtain a consumer’s express consent for the collection, use, and disclosure of the consumer’s genetic data, including, at a minimum, separate and express consent for each of the following:

  (A) the use of the genetic data collected through the genetic testing product or service offered to the consumer, including:

  (i) who has access to genetic data;

  (ii) how genetic data may be shared; and

  (iii) the specific purposes for which the data will be collected, used, and disclosed;

  (B) the storage of a consumer’s biological sample after the initial testing requested by the consumer has been fulfilled;

  (C) each use of genetic data or the biological sample beyond the primary purpose of the genetic testing or service;

  (D) each transfer or disclosure of the consumer’s genetic data or biological sample to a third party other than a service provider, including the name of the third party to which the consumer’s genetic data or biological sample will be transferred or disclosed and the intended purpose of said transfer, except that a company shall not require a consumer to expressly consent to the actions in this subdivision (D) in order to receive the services ordered from the company by the consumer; and

  (E) the marketing or facilitation of marketing to a consumer based on the consumer’s genetic data or the marketing or facilitation of marketing by a third party based upon the consumer having ordered, purchased, received, or used a genetic testing product or service.

  (b) Marketing exception.

  (1) Subdivision (a)(2)(E) of this section does not require a direct-to-consumer genetic testing company to obtain a consumer’s express consent to market to the consumer on the company’s own website or mobile application based upon the consumer having ordered, purchased, received, or used a genetic testing product or service from that company if the content of the advertisement does not depend upon any information specific to that consumer. Nothing in this subdivision alters, limits, or negates the requirements of any other antidiscrimination law or targeted advertising law.

  (2) Any advertisement of a third-party product or service presented to a consumer pursuant to subdivision (1) of this subsection or subdivision (a)(2)(E) of this section shall be prominently labeled as advertising content and be accompanied by the name of any third party that has contributed to the placement of the advertising. If applicable, the advertisement also shall clearly indicate that the advertised product or service, and any associated claims, have not been vetted or endorsed by the direct-to-consumer genetic testing company.

  (c) Revoking consent.

  (1) A direct-to-consumer genetic testing company that is subject to the requirements in subdivision (a)(2) of this section shall provide effective mechanisms for a consumer to withdraw consent provided pursuant to this subchapter that is at least as easy as the mechanism by which the consumer provided the consent, at least one of which utilizes the primary medium through which the company communicates with consumers.

  (2) If a consumer revokes consent pursuant to subdivision (1) of this subsection, the direct-to-consumer genetic testing company shall:

  (A) honor the consumer’s consent revocation as soon as practicable, but not later than 30 days after the individual revokes consent; and

  (B) if the revocation is related to the storage or use of a consumer’s biological sample, destroy the consumer’s biological sample not later than 30 days after receipt of the revocation of consent.

  (d) Data security and access.

  (1) A direct-to-consumer genetic testing company shall:

  (A) implement and maintain reasonable security procedures and practices to protect a consumer’s genetic data against unauthorized access, destruction, use, modification, or disclosure;

  (B) develop procedures and practices to enable a consumer to easily:

  (i) access the consumer’s genetic data;

  (ii) delete the consumer’s account and genetic data, except for genetic data that is required to be retained by the company to comply with applicable legal and regulatory requirements; and

  (iii) request to have and have the consumer’s biological sample destroyed; and

  (C) upon a request from a consumer to delete the consumer’s genetic data or to destroy the consumer’s biological sample pursuant to subdivision (B)(ii) or (iii) of this subdivision (d)(1), notify any third party, including service providers, that have received the consumer’s data or sample from the company to delete the consumer’s data or destroy the consumer’s sample not later than 30 days after the consumer makes the request.

  (2) Genetic data and biological samples of consumers shall:

  (A) not be stored within the territorial boundaries of any country currently sanctioned in any way by the U.S. Office of Foreign Assets Control or designated as a foreign adversary under 15 C.F.R. § 7.4(a); and

  (B) only be transferred or stored outside the United States with the express consent of the consumer.

  (e) Contracts.

  (1) A contract between a direct-to-consumer genetic testing company and a service provider shall prohibit the service provider from:

  (A) retaining, using, or disclosing the biological sample, genetic data, or any information regarding the identity of the consumer, including whether that consumer has solicited or received genetic testing, for a commercial purpose other than providing the services specified in the contract with the business; and

  (B) associating or combining the biological sample, genetic data, or any information regarding the identity of the consumer, including whether that consumer has solicited or received genetic testing, with information the service provider has received from or on behalf of another person or persons, or has collected from its own interaction with consumers or as required by law.

  (2) Upon the termination of a contract between a direct-to-consumer genetic testing company and a service provider, the service provider shall:

  (A) immediately destroy all genetic data the service provider retained during the contractual period with the testing company pursuant to subdivision (1)(A) of this subsection (e); and

  (B) not disclose, transfer, or sell genetic data to a third party before it destroys the genetic data pursuant to subdivision (A) of this subdivision (2).

  (f) Discrimination. A person or public entity shall not discriminate against a consumer because the consumer exercised any of the consumer’s rights under this subchapter by:

  (1) denying goods, services, or benefits to the consumer;

  (2) charging different prices or rates for goods or services, including through the use of discounts or other incentives, or imposing penalties;

  (3) providing a different level or quality of goods, services, or benefits to the consumer;

  (4) suggesting that the consumer will receive a different price or rate for goods, services, or benefits, or a different level or quality of goods, services, or benefits; and

  (5) considering the consumer’s exercise of rights under this subchapter as a basis for suspicion of criminal wrongdoing or unlawful conduct.

  (g) Nondisclosure and warrant requirement. Notwithstanding any other provision in this section, a direct-to-consumer genetic testing company shall not disclose:

  (1) a consumer’s genetic data to any entity that is responsible for administering or making decisions regarding health insurance, life insurance, long-term care insurance, disability insurance, or employment, or to any entity that provides advice to an entity that is responsible for performing those functions; or

  (2) any information about a consumer to a government entity, including the consumer’s genetic data or name:

  (A) without a search warrant issued by a court on a finding of probable cause; or

  (B) unless the consumer whose information is sought provides express consent to the disclosure upon being notified by the direct-to-consumer genetic testing company. (Added 2025, No. 135 (Adj. Sess.), § 1, eff. July 1, 2026.)