Bill > H0639

This bill, titled the "Genetic Information Privacy Act," establishes new protections for the genetic data of Vermont residents collected by direct-to-consumer genetic testing companies. It defines key terms like "genetic data" (information derived from biological samples or equivalent sources concerning genetic material, excluding deidentified data) and "express consent" (explicit permission given after clear notice, not implied by inaction or "dark patterns," which are manipulative user interface designs). The bill mandates that these companies provide clear privacy notices, obtain separate express consent for various uses and disclosures of genetic data, including sharing with third parties and marketing, and allow consumers to revoke consent easily. Companies must also implement reasonable security measures to protect genetic data, provide consumers with easy access to their data, and allow them to delete their accounts and request the destruction of their biological samples. Furthermore, contracts with service providers will prohibit them from retaining or using genetic data for commercial purposes beyond the contracted services, and the bill prohibits discrimination against consumers for exercising their privacy rights. Importantly, this act does not apply to protected health information handled under federal laws like HIPAA or to certain types of scientific research, and it clarifies that the law affording greater privacy protection will prevail in case of conflict. The provisions of this act will take effect on July 1, 2026.

Business and Industry

https://legislature.vermont.gov/bill/status/2026/H.639