SD SB49

Direct-to-consumer genetic testing companies must obtain express consent before collecting, using, or disclosing genetic data, with separate consent required for third-party transfers, secondary uses, sample retention, research purposes, and marketing activities

Companies must provide plain-language privacy policies and publicly available privacy notices detailing their data collection, retention, security, and transfer practices

Consumers have the right to access their genetic data, delete their account and data, request destruction of biological samples, and revoke consent at any time, with companies required to honor revocations within 30 days

Exemptions apply to HIPAA-covered entities, medical screening/diagnosis/treatment, higher education institutions, law enforcement forensic laboratories, federally-compliant research entities, and licensed hospitals

The attorney general may impose civil penalties up to $5,000 per violation, with service providers held to the same confidentiality obligations as the testing companies they contract with