States continue to enact laws regulating genetic data. Since our last update, the Connecticut governor has signed SB 4, an omnibus privacy law which contains provisions regulating direct-to-consumer (“DTC”) genetic testing companies. You can read our full analysis of SB 4 here.
The genetic testing provisions in SB 4 define a “direct‑to‑consumer genetic testing company” as an entity that “offers genetic testing directly to a consumer” or that “collects, uses or analyzes genetic data that a consumer has provided to such person.” The law includes exceptions for individuals licensed by Connecticut to provide health care services who order genetic testing for a medical purpose while acting within the scope of their licensed practice, data disclosures pursuant to court order, and for de-identified data. Unlike many other DTC genetic testing laws, SB 4 does not include an exemption for research conducted in accordance with human subject research frameworks or for entities or data subject to HIPAA.
The law establishes that a consumer has property rights in their biological sample and genetic test results derived from the consumer’s DNA. It also requires companies to disclose their genetic data handling practices to consumers and to obtain consumers’ “express consent” for genetic data collection, use, disclosure, and retention, along with secondary uses, third‑party transfers, and post‑testing sample retention. To disclose or transfer the consumer’s genetic data to a third party for research purposes or research conducted under the control of the company for purposes of publication or generalizable knowledge, a DTC genetic testing company must obtain informed consent in accordance with the federal Common Rule. SB 4 grants consumers the right to access and delete genetic data, to require the destruction of their biological samples, and to revoke consent for the use and storage of their genetic data.
Violations are deemed unfair or deceptive trade practices enforceable “solely” by the Connecticut Attorney General. The provisions will take effect October 1, 2026.