Sponsors (2)
Requires DTC genomic testing firms to provide consumer access, deletion, and sample-destruction rights, pre-acquisition notices, and FTC enforcement authority.
Official title: Provide consumers with the right to delete their genomic data, and for other purposes.
Introduced March 5, 2025 by Bill Cassidy · Last progress March 5, 2025
The bill gives consumers stronger, timely control and federal privacy protections for genomic data while increasing regulatory enforcement and compliance burdens — improving privacy but creating added costs, limited exceptions to deletion, and potential state-level fragmentation.
Consumers, including patients with chronic conditions, can access their genomic data and request deletion of accounts and destruction of biological samples within 30 days, giving individuals timely control over sensitive genetic information.
Consumers are notified at least 30 days before a company acquisition with the purchaser's identity and instructions to exercise privacy rights, reducing surprise transfers of genetic data and enabling informed choices.
Deidentified genomic data shared for research must meet statutory deidentification standards and recipients must contractually agree not to reidentify individuals, strengthening privacy protections for research use.
Testing companies and genetic-data businesses will face compliance costs (building access/deletion systems, contractual controls, and meeting FTC rules) that could be passed on to consumers as higher prices.
Consumers' ability to obtain deletion or destruction of data and samples can be refused when items are subject to warrants, subpoenas, court orders, or other legal retention obligations, limiting control in legally constrained cases.
Allowing limited reidentification testing under narrow exceptions creates a small residual risk that controls could fail and individuals could be reidentified from genomic data.
Based on analysis of 2 sections of legislative text.
Requires direct-to-consumer genomic testing companies to give consumers clear, easy ways to access their genomic data, delete accounts and data, and request destruction of biological samples; companies must provide these options through their main communication channel, disclose that deidentified data may be shared for research, and notify customers 30 days before an acquisition identifying the purchaser. Deletion/destruction requests must be fulfilled within 30 days (subject to legal holds), purchasers must honor outstanding requests made to acquired companies, violations are treated as unfair or deceptive acts enforceable by the FTC, and the FTC is authorized to issue implementing rules.