The Age of Majority Is Not a Data Event: Re-Consenting Pediatric Genomes in the United States
The eighteenth birthday is a legal threshold, not a database event. For a child whose genome was sequenced in infancy, childhood, or adolescence, majority changes who may make health care decisions. It does not automatically change who can open the research portal, download the variant file, or approve a new use of the sample. That gap between legal adulthood and data control is one of the quieter problems in American genomic governance, and it is becoming more visible as pediatric testing expands from rare disease diagnostics into carrier screening, pharmacogenomics, and consumer products purchased by parents.
Where Parental Authority Ends, and Where It Does Not
Under most state law, parents act as personal representatives for minor children in health care settings. The federal HIPAA Privacy Rule generally follows that structure, allowing a parent to access and authorize disclosure of a child's protected health information. When the child reaches majority, the parent's status as personal representative ordinarily ends. The record, however, does not disappear. Laboratory information systems retain variant calls, interpretive reports, and raw sequence data according to contractual, accreditation, and state retention requirements. A parent who once had portal access may lose it, but the underlying data may remain available to the laboratory, the health system, and any research collaborator named in an earlier authorization.
The result is a familiar administrative sequence: the young adult is asked to sign a new portal agreement, but is rarely asked whether the original consent should continue. Clinical operations treat majority as an access-management task. Genomic governance should treat it as a decisional event.
The Re-Consent Gap in Research and Consumer Testing
The Common Rule requires parental permission and, where appropriate, child assent for research involving children. It also contemplates re-consent when a child reaches legal age if the research continues and the IRB determines that consent is required. In practice, the trigger depends on the study's duration, the sensitivity of the data, and the institution's policies. Long-running biobanks and pediatric cohorts often include re-contact provisions, but the burden of finding a now-adult participant years after enrollment can be substantial. Some studies rely on continued use of de-identified data or on broad consent language that was never designed for a person who can now speak for themselves.
Consumer testing introduces a different problem. Direct-to-consumer genetic testing is generally marketed to adults, but parents sometimes purchase kits or create family accounts for children where platform terms permit it. Those accounts may store a child's sample data, link it to a parent's profile, and use it for research or product development under terms the parent accepted. When the child turns eighteen, the platform may require a new account holder, but the data may already have been shared with third parties, used in aggregated research, or retained under a separate contractual basis. A new click-through agreement cannot retrieve what has already traveled.
Access, Deletion, and the Limits of Existing Rights
American law provides no general right to delete genomic data. HIPAA gives individuals a right to access records and to request amendment, but not erasure. State comprehensive privacy laws increasingly include access and deletion rights, yet many exempt health information covered by HIPAA, research data, or genetic data held by certain entities. Where deletion rights do apply, they are often subject to retention obligations, fraud prevention, or the rights of other individuals whose data are entangled with the request. A genome is rarely a solitary record; it is a family record with individual access points.
Access rights are more robust but still uneven. A young adult may be entitled to a copy of a clinical report, while raw sequence data may be held by a laboratory under a separate policy. Research participants may have access to aggregate findings rather than individual results. Consumer platforms may offer downloads in one format and deletion in another, with different timelines and exceptions. These distinctions matter because the first exercise of adult authority often begins with a request for information, not a request for deletion.
A State-by-State Patchwork
As of 2026, no federal statute establishes a uniform age-triggered re-consent requirement for pediatric genomic data. State laws on minor consent, emancipation, and genetic privacy vary considerably. Some states allow minors to consent to certain health services, which can complicate the question of who authorized a test. Others have genetic privacy statutes that restrict disclosure but do not address the transition to majority. Comprehensive consumer privacy laws in a growing number of states include special provisions for sensitive data, yet their treatment of genomic information and their exemptions for covered entities differ. For a health system operating across state lines, the same pediatric biobank may be subject to several access, retention, and consent rules at once.
A Practical Protocol for Custodians
Institutions do not need to wait for legislation to reduce the re-consent gap. A defensible protocol begins with an inventory: identify datasets and samples that originated with pediatric patients or participants, record the legal basis for the original permission, and flag the date on which the individual reaches majority. From there, custodians can establish age-triggered notices written in plain language, distinguish between continued clinical care, research use, and commercial licensing, and offer a meaningful choice about each. Default settings matter. A young adult who does nothing should not be treated as having renewed every permission a parent once granted.
The protocol should also address access and deletion requests with clear timelines, explain which data can be removed and which must be retained, and document the reasons. Guardianship and supported decision-making arrangements require separate pathways. Finally, institutions should audit their re-contact practices and report how many pediatric-origin records reached majority without a recorded decision. That number is a governance indicator, not merely an operational metric.
The genome does not mature with the person it describes. It waits in a system that was designed around a parent's signature. Re-consent is the policy mechanism that allows the young adult to become the author of the next chapter, rather than the subject of an agreement made before they could read it.
