Utah and South Dakota enacted genetic privacy laws in 2026, but gaps remain

When 23andMe filed for bankruptcy in March 2025, its customers faced a question most had not considered when swabbing their cheeks: what happens to your genetic data when the company holding it collapses? The answer proved uncomfortable. The bankruptcy court appointed a privacy ombudsman, who reported to the court that he could not "conclude with certainty" that the proposed sale was consistent with 23andMe's own privacy policy, according to Bloomberg Law. State attorneys general from across the country challenged the data transfer in court. TTAM Research Institute — a nonprofit created by 23andMe founder Anne Wojcicki — ultimately completed the acquisition in July 2025 for $305 million, according to the HIPAA Journal, and pledged to maintain existing privacy policies. The episode exposed how sparse the legal framework around consumer genetic data actually is. State legislatures noticed.

South Dakota moved first among the 2026 class. Governor Larry Rhoden signed SB 49, the South Dakota Genetic Data Privacy Act, into law on March 23, 2026, according to KOTATV. The law takes effect July 1, 2026, and it applies specifically to companies that sell genetic testing kits directly to individuals — the category this site covers. Under SB 49, a direct-to-consumer genetic testing company must publish a prominent, publicly available privacy notice that includes clear disclosure whenever de-identified genetic data may be shared with or disclosed to third parties for research. Service providers that handle genetic data under contract with those companies are subject to the same confidentiality obligations. The law explicitly carves out healthcare providers and research institutions operating under federal human subjects protections, keeping its requirements focused on the consumer testing market, according to Hunton's Privacy and Cybersecurity Law Blog.

Utah enacted a different kind of law. HB 182, the Genetic Information Amendments, was signed in early 2026 with a main effective date of January 1, 2028. Rather than granting consumers new rights, HB 182 regulates sequencing infrastructure: it prohibits medical and genomic research facilities in Utah from using genetic sequencing equipment or software produced by foreign adversaries as defined under federal regulation 15 C.F.R. § 791.4 — a classification that currently covers China, Russia, Iran, Cuba, North Korea, and Venezuela. The law also bars those facilities from storing sequencing data within those countries or providing remote access to it from within their borders. The concern driving the law is that sequencing equipment tied to foreign-adversary manufacturers could expose genetic data to foreign government access regardless of what privacy policy the testing company publishes to its customers. HB 182 targets that risk at the infrastructure level, not the consumer rights level, according to Inside Privacy.

Other states are moving, though not uniformly. Wisconsin's legislature passed a similar foreign-adversary sequencing bill, but Governor Tony Evers vetoed it on March 27, 2026, citing potential harm to medical research, according to Inside Privacy. Connecticut Attorney General William Tong submitted testimony in 2026 supporting legislation that would give state residents "exclusive control" over their biological material and DNA analysis results, requiring companies to obtain express consent for any use not disclosed at the time of collection, according to the Connecticut Attorney General's office. At the federal level, the "Don't Sell My DNA Act," introduced by a bipartisan group in July 2025, would classify genetic data as personally identifiable information under the Bankruptcy Code — a direct response to the 23andMe proceedings — but as of this writing it has not advanced out of committee, according to Public Citizen.

For anyone considering a whole genome sequencing kit today, the short answer is that your legal protections depend heavily on where you live, and they remain thin in most of the country. No comprehensive federal law specifically governs direct-to-consumer genetic testing. South Dakota residents will have specific rights starting July 1, 2026; California residents already have some coverage under the California Consumer Privacy Act. Most other states provide little or no genetic-data-specific protection for consumers. Before ordering from any service, two sections of the privacy policy are worth your attention: first, whether the company shares or licenses de-identified genetic data with third parties and under what conditions; second, what the policy says happens to your data if the company is sold, merges, or files for bankruptcy. The 23andMe case made clear that privacy promises and legal guarantees are different things — and states are working, imperfectly and unevenly, to narrow that gap.