Your DNA, Your Choice: New Bill Lets You Delete Genetic Data

What it does

This bill requires direct-to-consumer genomic testing companies (like 23andMe, AncestryDNA) to let customers access, delete, and destroy their genetic data and biological samples through a simple mechanism. Companies must notify customers clearly about these rights and about how their de-identified genetic data may be used for research. If a company is bought, it must notify customers 30 days before the sale and explain how they can still delete their data. Companies have 30 days to fulfill deletion requests, except when blocked by court orders or legal holds.

Why we flagged it

The bill's operative mechanism is a straightforward consumer right: access, deletion, and destruction of genomic data held by private testing companies. It is a privacy and data-control measure, not a subsidy, deregulation, or industry carve-out.

What the text implies

• De-identified genomic data may still be shared for research without explicit per-use consent, provided it meets HIPAA privacy standards. Consumers are notified of this possibility but cannot opt out of research use of de-identified data — only of the original data retention.
• The bill does not restrict companies from selling de-identified data to third parties (pharmaceutical firms, research institutions, biotech companies) before deletion requests are made. The deletion right applies only to identified data and biological samples.

The full analysis lists 4 implications of this text.

Who it affects

Ordinary people gain concrete control over their most sensitive biological information — the right to delete genetic data and samples, with clear notice and a 30-day deadline. This addresses a real asymmetry: consumers have little visibility into or control over genetic data once submitted to private companies.