§ 24-4-24-9 — Acts of consumer genetic testing provider requiring consent of consumer

(a) A consumer genetic testing provider that
performs, or causes to be performed, genetic testing on an individual's
biological material may not take any of the following actions unless the
provider has solicited and received the individual's freely given,
specific, informed, and unambiguous consent to the action:
(1) Perform, or cause to be performed, any testing or analysis of
the individual's biological material that is not requested by the
individual except as required to comply with state and federal
law.
(2) Use the individual's biological material for any use other than
the genetic testing requested by the individual.
(3) Subject to section 10(b) of this chapter, provide access by a
third party to:
(A) the individual's biological material; or
(B) data, other than deidentified data, resulting from genetic
testing performed on the individual's biological material.
(4) Retain the individual's biological material for more than thirty
(30) days after the performance of the genetic testing requested by
the individual, except as required to comply with state or federal
law.
(5) Retain data, other than deidentified data, resulting from
genetic testing performed on the individual's biological material
for more than thirty (30) days after the completion of the service
except as required to comply with state and federal law.
(6) Disseminate advertising or marketing communications to the
individual based on the individual's genetic testing results.
(7) Provide information regarding the individual's:
(A) solicitation and use of the provider's genetic testing
services; or
(B) use of the provider's:
(i) website; or
(ii) other remote or virtual services;
associated with the provider's genetic testing services;
to a third party to enable the third party to disseminate advertising
or marketing communications to the individual.
(b) A provider's solicitation of an individual's consent to an action
described in subsection (a) must:
(1) describe the action in terms that are sufficiently clear and
concise as to be reasonably understandable by a person of
ordinary intelligence; and
(2) solicit the individual's consent to the action separately from a
solicitation of the individual's consent to any other action
described in subsection (a).
(c) Consent to an action under subsection (a) is not freely given,
specific, informed, and unambiguous if the consent is provided by any
of the following means:
(1) The individual's inaction.
(2) The individual's acceptance of:
(A) general or broad terms of service; or
(B) any other document requiring agreement by an individual
using the provider's services;
containing information unrelated to the action under subsection
(a).
(3) The individual closing, muting, pausing, or hovering a
computer cursor over a piece of content.
(4) The individual's communication of consent through an
Internet user interface that is designed or manipulated with the
substantial effect of subverting or impairing user autonomy,
decision making, or choice.

Legislative History

As added by P.L.233-2025, SEC.2.