RI Takes Lead on Genetic Data Privacy

An archival U.S. Centers for Disease Control and Prevention photo shows a lab researcher reviewing the banding pattern from a DNA electrophoresis experiment. The Rhode Island House and Senate have both passed legislation that would regulate the direct-to-consumer genetic market and how companies collect, use, store and share consumers’ genetic data. (Photo by U.S. CDC)

by Alexander Castro, Rhode Island Current
May 5, 2026

You can learn about a person from a cotton swab — specifically, one coated in someone’s saliva, which is full of the residue needed for genetic testing.

Rhode Islanders who send their spit to commercial genetic testing services like 23andMe and Ancestry would be afforded more control over their genetic insights under a bill passed by the Rhode Island Senate in a 37-0 vote Tuesday night.

The Genetic Information Privacy Act — sponsored by Providence Democrats Sen. Sam Zurier and Rep. Edith Ajello in their respective chambers — would regulate the direct-to-consumer genetic testing market, which the bill text describes as “largely unregulated and could expose personal and genetic information, and potentially create unintended security consequences and increased risk.”

“It protects our genetic information when we send it off to these companies so that they can’t sell it to other people,” Zurier noted on the Senate floor Tuesday.

The House passed Ajello’s bill 68-0 on April 28. Even though the bills passed by each chamber are virtually identical, each chamber needs to pass the other chamber’s version (a process known as concurrence) before the legislation can head to Gov. Dan McKee’s desk for approval. Concurrence votes have not been scheduled yet.

The bill would mandate that consumer-focused genetic testing firms supply their privacy policies in summaries “written in plain language,” with clear information on how a customer’s genetic data would be accessed, transferred, secured, retained and deleted.

“The nature of the data collection, use, maintenance, or disclosure shall be conveyed in clear and prominent terms in such a manner that an ordinary consumer would notice and understand it,” the bill reads.

Concerns about genetic testing companies which go under — as 23andMe did last year, when it filed for bankruptcy — prompted the legislation. If genetic testers go broke and liquidate assets — including their databases of people’s private genetic information — what happens if that information is transferred to another party?

In the case of 23andMe, the Associated Press reported in 2025 that a bankruptcy judge approved the $305 million sale of 23andMe to the nonprofit TTAM Research Institute, which pledged to uphold the company’s existing privacy policies, which allow for consumers to request data deletion and opt out of the data being used for research purposes.

23andMe did not immediately respond to a request for comment Tuesday ahead of the Senate’s vote.

Zurier noted on the Senate floor Tuesday that he had submitted the bill last year, when it passed successfully in the Senate but died in the House upon referral to the Committee on Judiciary. A news release notes that Zurier spearheaded the legislation following news of 23andMe’s financial troubles in September 2024.

Zurier described 23andMe’s new ownership in 2025 as a “catastrophe avoided by good luck.”

The Rhode Island legislation is based on a California law from 2021 that seeks to standardize these privacy protections across the industry.

“Rhode Islanders deserve to know if their data might be shared or sold, and they should be able to opt out or request that their information be deleted, particularly in cases where the entity holding it changes hands,” Ajello said in a statement issued after the House vote.

Testing companies would need explicit consent to collect, use or disclose customers’ genetic data. This “express consent,” in the bill’s understanding, “cannot be inferred from inaction” on the part of the consumer, meaning a customer’s silence would not equal consent.

Express consent would be needed for each specific use case of a person’s genetic data, including storage of the data after the requested test, sharing the data with a third-party, or using the genetic data for marketing purposes.

Banning ‘dark patterns’

Under the bills, consumers could revoke consent as well, after which companies would have 30 days to destroy any of that customer’s biological samples.

The bill also seeks to ban the use of “dark patterns” by genetic testing companies. The website Deceptive Patterns, which catalogs this manipulative side of user interface (UI) design, defines dark or deceptive patterns as “tricks used in websites and apps that make you do things that you didn’t mean to,” such as opting into certain data collection practices that the user did not intend.

The bill would also create an enforcement structure which would ultimately benefit any consumers misled or affected by companies who would not follow the new rules. Civil penalties of up to $1,000 could be attached to negligent violations of the law, while willful violations would have penalties between $1,000 and $10,000, plus court costs. The person whose genetic data was involved in these violations would receive the penalty monies recovered through enforcement.

Exempt from the legislation is any medical information already covered by state or federal confidentiality laws such as HIPAA. Health care providers, some scientific research and educational uses, and data stored by employers for compliance with workplace health and safety laws would also be exempt.

Ancestry.com, which offers DNA testing via a service branded AncestryDNA, was supportive of the legislation in written testimony it submitted to the House Committee on Judiciary, where Ajello’s bill was first heard on March 10.

Ritchard Engelhardt, Ancestry’s head of government affairs, wrote in the company’s testimony that industry leaders, policymakers and advocates sculpted a model for the best practices regarding genetic testing and consumer privacy in 2018, after which states began to mold and gradually adopt their own laws based on these recommendations.

If the Rhode Island bill were to become law, it would join at least 13 states that have enacted similar legislation and would be the only New England state on the list.

Sen. Elaine Morgan was absent for Tuesday’s vote in the Senate.

Rhode Island Current is part of States Newsroom, a nonprofit news network supported by grants and a coalition of donors as a 501c(3) public charity. Rhode Island Current maintains editorial independence. Contact Editor Janine L. Weisman for questions: info@rhodeislandcurrent.com.

Our stories may be republished online or in print under Creative Commons license CC BY-NC-ND 4.0. We ask that you edit only for style or to shorten, provide proper attribution and link to our website. AP and Getty images may not be republished. Please see our republishing guidelines for use of any other photos and graphics.

Alexander Castro covers technology, education and health for Rhode Island Current. He previously worked as a visual arts critic, curator and adjunct professor.

Rhode Island Current is part of States Newsroom, the nation’s largest state-focused nonprofit news organization.