AN ACT CONCERNING DIRECT-TO-CONSUMER GENETIC TESTING.

House of Representatives
sHB5128 / File No. 233 1

General Assembly File No. 233
February Session, 2026 Substitute House Bill No. 5128

House of Representatives, March 30, 2026

The Committee on General Law reported through REP. LEMAR
of the 96th Dist., Chairperson of the Committee on the part of
the House, that the substitute bill ought to pass.

AN ACT CONCERNING DIRECT-TO-CONSUMER GENETIC TESTING.
Be it enacted by the Senate and House of Representatives in General
Assembly convened:

Section 1. (NEW) (Effective October 1, 2026) As used in this section and 1
sections 2 and 3 of this act: 2
(1) "Biological sample" (A) means any material that is derived from 3
the human body and known to contain DNA, and (B) includes, but is 4
not limited to, any human tissue, blood, urine or saliva; 5
(2) "Consumer" means any individual who is physically present in 6
this state and a recipient, or a prospective recipient, of genetic testing; 7
(3) "De -identified data" means any data that cannot reasonably be 8
used to infer information about, or otherwise be linked to, an identified 9
or identifiable individual if the direct -to-consumer genetic testing 10
company that possesses such data (A) takes administrative and 11
technical measures to ensure that such data cannot be associated with 12
an individual, (B) publicly commits to possess and use such data 13
sHB5128 File No. 233

sHB5128 / File No. 233 2

exclusively in de-identified form and not to attempt to reidentify such 14
data, and (C) contractually obligates any recipient of such data to satisfy 15
the criteria set forth in subparagraphs (A) and (B) of this subdivision; 16
(4) "Direct-to-consumer genetic testing company" or "company" (A) 17
means any person doing business in this state who, in the ordinary 18
course of such business, (i) offers genetic testing directly to a consumer, 19
or (ii) collects, uses or analyzes genetic data that a consumer has 20
provided to such person, and (B) does not include any individual who 21
(i) is licensed by this state to provide health care services, and (ii) while 22
acting within the scope of such individual's practice, orders genetic 23
testing for a medical purpose; 24
(5) "DNA" means deoxyribonucleic acid; 25
(6) "Express consent" means an affirmative response by a consumer 26
to a clear, meaningful and prominent notice regarding the collection, 27
use, retention or disclosure of the consumer's genetic data for a specific 28
purpose; 29
(7) "Genetic data" (A) means any data, regardless of format, 30
concerning an individual's genetic characteristics, (B) includes, but is 31
not limited to, (i) any raw sequence data that result from sequencing all, 32
or any portion of, an individual's DNA, (ii) any genotypic or phenotypic 33
information that is obtained by analyzing an individual's raw sequence 34
data, and (iii) any information that (I) concerns a condition affecting an 35
individual's health, (II) the individual reports to a direct -to-consumer 36
genetic testing company, and (III) the direct-to-consumer genetic testing 37
company analyzes in connection with the individual's raw sequence 38
data and uses for scientific research or product development, and (C) 39
does not include de-identified data; 40
(8) "Genetic testing" means (A) any laboratory test performed on an 41
individual's complete DNA sequence, or one or more of an individual's 42
DNA regions, chromosomes, genes or gene products, for purposes of 43
determining the presence or absence of any genetic characteristic, and 44
(B) any interpretation of an individual's genetic data; and 45
sHB5128 File No. 233

sHB5128 / File No. 233 3

(9) "Person" means any individual, association, corporation, limited 46
liability company, partnership, trust or other legal entity. 47
Sec. 2. (NEW) ( Effective October 1, 2026 ) A consumer shall have a 48
property right in, and shall retain the right to exercise exclusive control 49
over, any biological sample that is derived from the consumer's body 50
and provided to, or used by, a direct -to-consumer genetic testing 51
company, as well as the results of any genetic testing conducted on the 52
consumer's DNA by a direct -to-consumer genetic testing company. 53
Such right to exercise exclusive control includes, but is not limited to, 54
the right to exercise exclusive control over the collection, use, retention, 55
maintenance, disclosure or destruction of such biological sample and 56
results. 57
Sec. 3. (NEW) ( Effective October 1, 2026 ) (a) A direct -to-consumer 58
genetic testing company shall: 59
(1) At all times transact its business and conduct its affairs in a 60
manner that is consistent with a consumer's rights under section 2 of this 61
act; 62
(2) Prior to accepting any biological sample, genetic data or payment 63
from a consumer, disclose to the consumer the company's policies and 64
procedures concerning the collection, use and disclosure of genetic data; 65
(3) Display, in a prominent and publicly accessible location on the 66
company's Internet web site, a privacy notice disclosing such company's 67
policies and procedures concerning the collection, use, access, 68
disclosure, transfer, security, retention and deletion of a consumer's 69
data and the consumer's consent thereto; 70
(4) Prior to collecting, using or disclosing a consumer's genetic data, 71
obtain the consumer's express consent for such collection, use or 72
disclosure after disclosing to such consumer (A) the company's policies 73
and procedures concerning use of the genetic data such company 74
collects from consumers, (B) the identity of each person who may access 75
the results of genetic testing performed by the company, including, but 76
sHB5128 File No. 233

sHB5128 / File No. 233 4

not limited to, any vendor or service provider for such company who 77
may access such results, and (C) the manner in which the company may 78
disclose such consumer's genetic data; 79
(5) In addition to the express consent required under subdivision (4) 80
of this subsection, separately obtain a consumer's express consent to (A) 81
disclose or transfer the consumer's genetic data to any person other than 82
a vendor or service provider for the company, prior to disclosing or 83
transferring such genetic data to such person, (B) use the consumer's 84
genetic data for any purpose other than the primary purpose for which 85
the company offered genetic testing directly to such consumer, prior to 86
using such genetic data for such other purpose, or (C) retain the 87
consumer's biological sample for any period following completion of 88
the genetic testing for which such consumer provided such biological 89
sample, prior to retaining such biological sample for such period; 90
(6) Obtain informed consent from a consumer in accordance with the 91
federal policy for the protection of human subjects under 45 CFR 46, as 92
amended from time to time, for any disclosure or transfer of the 93
consumer's genetic data to a third party for research purposes or 94
research conducted under the control of the company for purposes of 95
publication or generalizable knowledge; 96
(7) Not disclose the results of any genetic testing performed on a 97
consumer's DNA to any person other than the consumer, unless (A) the 98
company has obtained such consumer's express consent to such 99
disclosure, or (B) such disclosure is made to a person acting pursuant to 100
a court order, warrant or subpoena; 101
(8) Not disclose a consumer's genetic data to (A) the consumer's 102
employer, (B) any person who, in the ordinary course of business, (i) 103
offers health insurance, life insurance or long -term care insurance 104
coverage in this state or any other state, or (ii) provides information or 105
data to any insurer, a s defined in section 38a -1 of the general statutes, 106
health care center, as defined in section 38a-175 of the general statutes, 107
or fraternal benefit society, as described in section 38a-595 of the general 108
statutes, for purposes of underwriting or rating of risks, or (C) any third 109
sHB5128 File No. 233

sHB5128 / File No. 233 5

party which the company knows, or reasonably should know, intends 110
to use such genetic data for purposes of marketing, including, but not 111
limited to, targeted advertising; 112
(9) Implement reasonable security measures to protect a consumer's 113
biological sample or genetic data from any unauthorized access, 114
destruction, use, modification or disclosure; and 115
(10) Implement a process for a consumer to (A) access the consumer's 116
genetic data from the company, (B) require the company to delete the 117
consumer's genetic data, (C) require the company to destroy, and 118
confirm that such company has destroyed, the consumer's biological 119
sample, and (D) revoke the consumer's consent for (i) the company to 120
use such consumer's genetic data for research purposes, or (ii) any third 121
party to which the company has provided such consumer's genetic data 122
to use such genetic data for research purposes. 123
(b) Any violation of subsection (a) of this section shall be deemed an 124
unfair or deceptive trade practice under subsection (a) of section 42-110b 125
of the general statutes. 126
This act shall take effect as follows and shall amend the following
sections:

Section 1 October 1, 2026 New section
Sec. 2 October 1, 2026 New section
Sec. 3 October 1, 2026 New section

GL Joint Favorable Subst.

sHB5128 File No. 233

sHB5128 / File No. 233 6

The following Fiscal Impact Statement and Bill Analysis are prepared for the benefit of the members of
the General Assembly, solely for purposes of information, summarization and explanation and do not
represent the intent of the General Assembly or either chamber thereof for any purpose. In general,
fiscal impacts are based upon a variety of informational sources, including the analyst’s professional
knowledge. Whenever applicable, agency data is consulted as part of the analysis, however final
products do not necessarily reflect an assessment from any specific department.

OFA Fiscal Note

State Impact: None
Municipal Impact: None
Explanation
The bill makes various changes to direct-to-consumer genetic testing
laws and makes violations an unfair trade practice resulting in no fiscal
impact to the state. The Department of Consumer Protection (DCP)
enforces unfair trade practice violations and has the expertise and
resources to meet the requirements of the bill.
The Out Years
State Impact: None
Municipal Impact: None

sHB5128 File No. 233

sHB5128 / File No. 233 7

OLR Bill Analysis
sHB 5128

AN ACT CONCERNING DIRECT -TO-CONSUMER GENETIC
TESTING.

SUMMARY
This bill gives consumers a property right and exclusive control over:
1. their biological samples (material from a person’s body known to
contain DNA including tissue, blood, urine, and saliva) that are
given to or used by a direct-to-consumer genetic testing company
and
2. results from genetic testing by these companies on their DNA.
This includes the right of control over the collection, use, retention,
maintenance, disclosure, and destruction of a consumer’s biological
sample and results. The bill requires direct-to-consumer genetic testing
companies to conduct their business and affairs consistent with these
rights.
Additionally, the bill requires these companies to (1) disclose certain
policies and procedures to consumers and (2) get a consumer’s consent
for various uses of their genetic data. The bill prohibits companies from
disclosing the results of genetic testing on a consumer’s DNA to anyone
other than the consumer unless the consumer expressly consents to the
disclosure, or it is disclosed to someone under a court order, warrant, or
subpoena.
The bill also requires companies to have security procedures and
certain processes to let consumers take certain actions.
Violations of the bill’s provisions are deemed an unfair or deceptive
trade practice under the Connecticut Unfair Trade Practices Act
sHB5128 File No. 233

sHB5128 / File No. 233 8

(CUTPA) (see BACKGROUND).
EFFECTIVE DATE: October 1, 2026
SCOPE OF THE BILL
Direct-to-Consumer Genetic Testing Companies
The bill applies to “direct-to-consumer genetic testing compan ies,”
which are individuals or entities that, in the ordinary course of business
in Connecticut, offer genetic testing directly to a consumer or collect,
use, or analyze genetic data given by a consumer. The term does not
include a licensed health care services provider who, within the
provider’s scope of practice, orders genetic testing for a medical
purpose.
Genetic Testing
The bill defines “g enetic testing ” as (1) a lab test o f a person’s
complete DNA sequence or a DNA region, chromosome, gene, or gene
product to determine the presence or absence of a genetic characteristic
and (2) an interpretation of genetic data.
Genetic Data
The bill applies to “genetic data,” which is data in any format about
an individual’s genetic characteristics. It includes:
1. raw sequence data that result s from sequencing all or part of a
person’s DNA;
2. genotypic (a person’s unique sequence of DNA) or phenotypic (a
person’s observable characteristics) information from analyzing
raw sequence data; and
3. information that (a) is about a person’s health condition, (b) the
person gives the company, or (c) the company analyzes related
to raw sequence data and uses for scientific research or product
development.
It does not include de -identified data , which is data that cannot
sHB5128 File No. 233

sHB5128 / File No. 233 9

reasonably be used to infer information about , or be linked to , an
individual as long as the company that has the data (1) takes
administrative and technical steps to make sure it cannot be associated
with an individual, (2) publicly commits to have and use it only in de-
identified form and does not reidentify it, and (3) contractually obligates
any recipient of the data to do the same.
POLICY DISCLOSURES
The bill requires companies to:
1. disclose their policies and procedures on the collection, use, and
disclosure of genetic data before taking a consumer’s biological
sample, genetic data, or payment; and
2. prominently display a privacy notice on their websites with their
policies and procedures on the collection, use, access, disclosure,
transfer, security, retention, and deletion of a consumer’s data
and consent.
CONSENT REQUIREMENTS
Collecting, Using, or Disclosing Genetic Data
The bill requires c ompanies to get a consumer’s express consent to
collect, use, or disclose the consumer’s genetic data . Before doing so,
companies must disclose to the consumer:
1. their policies and procedures on us ing consumers’ genetic data
they collect;
2. each person who may access the results of genetic testing they
perform, including vendors or service providers; and
3. how the company may disclose the consumer’s genetic data.
Express consent under the bill requires the consumer to affirmatively
respond to a clear, meaningful, and prominent notice about collecting,
using, retaining, or disclosing the consumer’s genetic data for a specific
purpose.
sHB5128 File No. 233

sHB5128 / File No. 233 10

Transferring Genetic Data, Using It for Other Purposes, and
Retaining Samples
The bill requires a company to get a separate express consent before:
1. disclosing or trans ferring genetic data to anyone other than a
vendor or service provider,
2. using the genetic data for any purpose other than the primary
purpose the company gave to the consumer, or
3. retaining a consumer’s biological sample after completing
genetic testing.
Research Purposes
The bill requires a company to get the consumer’s informed consent
in compliance with federal regulations on human subjects to disclose or
transfer genetic data to a third party for research purposes or research
done under the company’s control for publication or generalized
knowledge.
PROHIBITED DISCLOSURES
The bill prohibits a company from disclosing a consumer’s genetic
data to:
1. the consumer’s employer;
2. someone who in the ordinary course of business offers health,
life, or long -term care insurance or provide s information to an
insurer, health care center, or fraternal benefit society for
underwriting or rating risks; or
3. a third party the company know s or reasonably should know
intends to use it for marketing, including targeted advertising.
SECURITY AND COMPANY PROCEDURES
The bill requires companies to have reasonable security measures to
protect consumers ’ biological samples and genetic data from
unauthorized access, destruction, use, modification, or disclosure. It
sHB5128 File No. 233

sHB5128 / File No. 233 11

also requires companies to have procedures that allow consumers to:
1. access their genetic data;
2. require the company to delete their genetic data or destroy , and
confirm destruction of, their biological samples; and
3. revoke consent for using their genetic data for research, including
by a third party.
BACKGROUND
Connecticut Unfair Trade Practices Act (CUTPA)
By law, CUTPA prohibits businesses from engaging in unfair and
deceptive acts or practices. It allows the Department of Consumer
Protection commissioner, under specified procedures, to issue
regulations defining an unfair trade practice, investigate complaints,
issue cease and desist orders, order restitution in cases involving less
than $10,000, impose civil penalties of up to $5,000 , enter into consent
agreements, ask the attorney general to seek injunctive relief, and accept
voluntary statements of compl iance. It also allows individuals to sue.
Courts may issue restraining orders; award actual and punitive
damages, costs, and reasonable attorney’s fees; and impose civil
penalties of up to $5,000 for willful violations and up to $25,000 for a
restraining order violation.
COMMITTEE ACTION
General Law Committee
Joint Favorable Substitute
Yea 20 Nay 0 (03/11/2026)