VT S0248

Direct-to-consumer genetic testing companies must obtain separate express consent for collecting, using, and disclosing genetic data, including consent for sample storage, third-party transfers, and marketing based on genetic information.

Consumers gain rights to access their genetic data, delete their accounts and data, and request destruction of biological samples, with companies required to honor consent revocations within 30 days.

Genetic data and biological samples cannot be stored in countries sanctioned by the U.S. Office of Foreign Assets Control or designated foreign adversaries, and transfers outside the U.S. require express consumer consent.

Companies are prohibited from disclosing genetic data to health insurers, life insurers, long-term care insurers, disability insurers, or employers for decision-making purposes.

Violations constitute unfair and deceptive acts enforceable by the Attorney General, with the law taking effect July 1, 2026.