Utah Code § 13-60-101 Title.
13-60-101. Title.
This chapter is known as the "Genetic Information Privacy Act."
Enacted by Chapter 361, 2021 General Session
Genetic Information Privacy Act
Utah Code tit. 13, ch. 13-60, pt. 13-60-P1
in effectUtah Code § 13-60-102 Definitions.
13-60-102. Definitions.
As used in this part:
(1) "Biological sample" means any human material known to contain DNA, including tissue, blood, urine, or saliva.
(2) "Consumer" means an individual who is a resident of the state.
(3) "Deidentified data" means data that:
(a) cannot reasonably be linked to an identifiable individual; and
(b) possessed by a company that:
(i) takes administrative and technical measures to ensure that the data cannot be associated with a particular consumer;
(ii) makes a public commitment to maintain and use data in deidentified form and not attempt to reidentify data; and
(iii) enters into legally enforceable contractual obligation that prohibits a recipient of the data from attempting to reidentify the data.
(4) "Direct-to-consumer genetic testing company" or "company" means an entity that:
(a) offers consumer genetic testing products or services directly to consumers; or
(b) collects, uses, or analyzes genetic data that a consumer provides to the entity.
(5) "DNA" means deoxyribonucleic acid.
(6) "Express consent" means a consumer's affirmative response to a clear, meaningful, and prominent notice regarding the collection, use, or disclosure of genetic data for a specific purpose.
(7)
(a) "Genetic data" means any data, regardless of format, concerning a consumer's genetic characteristics.
(b) "Genetic data" includes:
(i) raw sequence data that result from sequencing all or a portion of a consumer's extracted DNA;
(ii) genotypic and phenotypic information obtained from analyzing a consumer's raw sequence data; and
(iii) self-reported health information regarding a consumer's health conditions that the consumer provides to a company that the company:
(A) uses for scientific research or product development; and
(B) analyzes in connection with the consumer's raw sequence data.
(c) "Genetic data" does not include deidentified data.
(8) "Genetic testing" means:
(a) a laboratory test of a consumer's complete DNA, regions of DNA, chromosomes, genes, or gene products to determine the presence of genetic characteristics of the consumer; or
(b) an interpretation of a consumer's genetic data.
Amended by Chapter 327, 2023 General Session
Utah Code § 13-60-103 Limitations.
13-60-103. Limitations.
This part does not apply to:
(1) protected health information that is collected by a covered entity or business associate as those terms are defined in 45 C.F.R. Parts 160 and 164;
(2) a public or private institution of higher education; or
(3) an entity owned or operated by a public or private institution of higher education.
Amended by Chapter 327, 2023 General Session
Utah Code § 13-60-104 Consumer genetic information -- Privacy notice -- Consent -- Access -- Deletion -- Destruction.
13-60-104. Consumer genetic information -- Privacy notice -- Consent -- Access -- Deletion -- Destruction.
(1) A direct-to-consumer genetic testing company shall:
(a) provide to a consumer:
(i) essential information about the company's collection, use, and disclosure of genetic data; and
(ii) a prominent, publicly available privacy notice that includes information about the company's data collection, consent, use, access, disclosure, transfer, security, retention, and deletion practices;
(b) obtain a consumer's initial express consent for collection, use, or disclosure of the consumer's genetic data that:
(i) clearly describes the company's use of the genetic data that the company collects through the company's genetic testing product or service;
(ii) specifies who has access to test results; and
(iii) specifies how the company may share the genetic data;
(c) if the company engages in any of the following, obtain a consumer's:
(i) separate express consent for:
(A) the transfer or disclosure of the consumer's genetic data to any person other than the company's vendors and service providers;
(B) the use of genetic data beyond the primary purpose of the company's genetic testing product or service; or
(C) the company's retention of any biological sample provided by the consumer following the company's completion of the initial testing service requested by the consumer;
(ii) informed consent in accordance with the Federal Policy for the Protection of Human Subjects, 45 C.F.R. Part 46, for transfer or disclosure of the consumer's genetic data to a third party for:
(A) research purposes; or
(B) research conducted under the control of the company for the purpose of publication or generalizable knowledge; and
(iii) express consent for:
(A) marketing to a consumer based on the consumer's genetic data; or
(B) marketing by a third party person to a consumer based on the consumer having ordered or purchased a genetic testing product or service;
(d) require valid legal process for the company's disclosure of a consumer's genetic data to law enforcement or any government entity without the consumer's express written consent;
(e) develop, implement, and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use, or disclosure; and
(f) provide a process for a consumer to:
(i) access the consumer's genetic data;
(ii) delete the consumer's account and genetic data; and
(iii) destroy the consumer's biological sample.
(2) Notwithstanding Subsection (1)(c)(iii), a direct-to-consumer genetic testing company with a first-party relationship to a consumer may, without obtaining the consumer's express consent, provide customized content or offers on the company's website or through the company's application or service.
Renumbered and Amended by Chapter 327, 2023 General Session
Utah Code § 13-60-105 Prohibited disclosures.
13-60-105. Prohibited disclosures.
A direct-to-consumer genetic testing company may not disclose a consumer's genetic data without the consumer's written consent to:
(1) an entity that offers health insurance, life insurance, or long-term care insurance; or
(2) an employer of the consumer.
Renumbered and Amended by Chapter 327, 2023 General Session
Utah Code § 13-60-106 Enforcement powers of the attorney general.
13-60-106. Enforcement powers of the attorney general.
(1) The attorney general may enforce this part.
(2) The attorney general may initiate a civil enforcement action against a person for violating this part.
(3) In an action to enforce this part, the attorney general may recover:
(a) actual damages to the consumer;
(b) costs;
(c) attorney fees; and
(d) $2,500 for each violation of this part.
Renumbered and Amended by Chapter 327, 2023 General Session
Source: Utah Office of Legislative Research and General Counsel (le.utah.gov)URL: https://le.utah.gov/xcode/Title13/Chapter60/13-60-P1.html?v=C13-60-P1_2023050320230503Fetched: 10/26/2026