Fifty Rules, One Genome: How State Lines Redraw the Boundaries of Genetic Privacy

The double helix does not recognize jurisdictional boundaries. A woman who relocates from Austin to Boise carries an identical genome across state lines, yet the legal architecture governing who may access, monetize, or disclose that genetic information changes fundamentally the moment she crosses the Texas–New Mexico border. This asymmetry — a single biological reality subject to fifty regulatory regimes — has become the defining structural problem of American genomic privacy governance.

The Federal Floor, and Why It Is Only a Floor

The Genetic Information Nondiscrimination Act of 2008, commonly abbreviated as GINA, remains the centerpiece of federal protection. Its accomplishments are real: employers may not use genetic information in hiring decisions, and health insurers may not adjust premiums or deny coverage based on predictive genetic test results.

But the statute's omissions are as consequential as its mandates. GINA says nothing about life insurance, disability insurance, or long-term care coverage — sectors where genetic underwriting remains lawful in most of the country. More fundamentally for the data governance community, GINA regulates discriminatory use of genetic information, not the collection, storage, secondary sharing, or commercial sale of it. A consumer genomics company can, under federal law, transfer its entire database to a third-party analytics firm without triggering any GINA obligation whatsoever.

The State Patchwork: Three Archetypes

Surveying state activity reveals three broad regulatory archetypes.

Comprehensive consent regimes. California's Genetic Information Privacy Act, effective since 2021, treats genetic data as a distinct category requiring explicit, opt-in consent for collection, use, and disclosure — including for direct-to-consumer testing companies, which must provide plain-language notices and honor deletion requests. Washington's My Health My Data Act extends similar principles to biological data broadly construed, with genetic information squarely within scope.

Sector-specific statutes. A second group of states — including Florida and Utah following the 2021 wave of consumer genetic privacy laws — regulate primarily the direct-to-consumer testing industry, requiring informed consent before sharing genetic data with third parties such as insurers or employers, but leaving broader data broker activity largely untouched.

The silent majority. The remaining states offer no genetic-privacy statute at all, leaving residents to rely on general data breach notification laws and the thin federal floor. In these jurisdictions, the practical answer to "who owns your genome?" is, functionally, whoever possesses it.

A Comparative Ranking, in Brief

When state regimes are scored across four dimensions — consent requirements, deletion rights, enforcement mechanisms (including private rights of action), and coverage of data brokers — a clear tiering emerges:

• Tier one: California and Washington, whose statutes combine opt-in consent, consumer deletion rights, and attorney general enforcement.
• Tier two: States with meaningful but narrow DTC statutes, including Utah and Florida, plus Illinois, whose Biometric Information Privacy Act has been applied by some courts to genetic identifiers.
• Tier three: States relying on general privacy or consumer protection frameworks with incidental genetic coverage.
• Tier four: States with neither genetic-specific nor robust general privacy legislation.

The rankings carry real economic consequences. Compliance costs push testing companies toward tier-one states' standards as de facto national baselines — a version of the "California effect" familiar from automotive emissions regulation — while residents of tier-four states receive those protections only incidentally, through contracts drafted for someone else's legislature.

Why National Legislation Is Inevitable

Three forces make federal preemption a matter of when, not whether.

First, the biobank problem: genomic data is inherently familial. A deletion right exercised in California is undermined when a sibling's sample, containing largely overlapping information, sits in an unregulated state's database.

Second, the research economy: multi-state academic consortia and pharmaceutical partnerships cannot efficiently navigate fifty consent regimes, and the resulting friction pushes data aggregation toward the least protective jurisdiction — the opposite of the policy intent.

Third, enforcement asymmetry: state attorneys general have limited extraterritorial reach, and cross-border transfers routinely escape meaningful oversight.

The Institute's position is not that any single state model should be nationalized wholesale. Rather, the patchwork itself demonstrates the demand signal: legislatures across the political spectrum, in states as different as California, Utah, and Washington, have concluded that genetic data warrants distinct treatment. A federal framework codifying explicit consent, deletion rights, and familial-data considerations would resolve the ZIP code lottery without abandoning the substantive consensus the states have already built.

Until Congress acts, Americans would do well to read their state's statute before their spit kit's terms of service — and to recognize that the former may matter more than the latter.