Vermont S. 248: An act relating to the public financing of campaigns

Bill Text

BILL AS INTRODUCED S.248
2026 Page 1 of 16

VT LEG #385797 v.1
S.248 1
Introduced by Senators Harrison and Plunkett 2
Referred to Committee on 3
Date: 4
Subject: Commerce and trade; consumer protection; genetic data privacy 5
Statement of purpose of bill as introduced: This bill proposes to require direct-6
to-consumer genetic testing companies and related providers to protect the 7
genetic data information of Vermonters. The bill requires companies to limit 8
data sharing, allows consumers to access their own data, and otherwise 9
provides other genetic data privacy protections to consumers. 10
An act relating to genetic data privacy 11
It is hereby enacted by the General Assembly of the State of Vermont: 12
Sec. 1. 9 V.S.A. chapter 61A is added to read: 13
CHAPTER 61A. DATA PRIVACY 14
Subchapter 1. Genetic Information Privacy 15
§ 2411. SHORT TITLE AND DEFINITIONS 16
(a) This subchapter shall be known, and may be cited, as the “Genetic 17
Information Privacy Act.” 18

BILL AS INTRODUCED S.248
2026 Page 2 of 16

VT LEG #385797 v.1
(b) As used in this subchapter: 1
(1) “Affirmative authorization” means an action that demonstrates an 2
intentional decision by a consumer. 3
(2) “Biological sample” means any material part of the human, 4
discharge therefrom, or derivative thereof, such as tissue, blood, urine, or 5
saliva, known to contain deoxyribonucleic acid (DNA). 6
(3) “Consumer” means an individual who is a Vermont resident. 7
(4) “Dark pattern” means a user interface designed or manipulated with 8
the substantial effect of subverting or impairing user autonomy, decision 9
making, or choice. 10
(5) “Direct-to-consumer genetic testing company” means an entity that: 11
(A) sells, markets, interprets, or otherwise offers consumer-initiated 12
genetic testing products or services directly to consumers; 13
(B) analyzes genetic data obtained from a consumer, except to the 14
extent that the analysis is performed by a person licensed in the healing arts for 15
diagnosis or treatment of a medical condition; or 16
(C) collects, uses, maintains, or discloses genetic data that is: 17
(i) collected or derived from a direct-to-consumer genetic testing 18
product or service; or 19
(ii) directly provided by a consumer. 20

BILL AS INTRODUCED S.248
2026 Page 3 of 16

VT LEG #385797 v.1
(6) “Disclose,” “disclosing,” or “disclosure” means to solicit, sell, 1
assign, transfer, give, provide, or trade, whether or not for valuable 2
consideration. 3
(7) “Express consent” means a consumer’s affirmative authorization to 4
grant permission in response to a clear, meaningful, and prominent notice 5
regarding the collection, use, maintenance, or disclosure of genetic data for a 6
specific purpose. Express consent cannot be inferred from inaction. 7
Agreement obtained through the use of dark patterns does not constitute 8
express consent. 9
(8)(A) “Genetic data” means any data, regardless of its format, that 10
results from the analysis of a biological sample from a consumer, or from 11
another element enabling equivalent information to be obtained, and concerns 12
genetic material. Genetic material includes deoxyribonucleic acids (DNA), 13
ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or 14
modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), 15
uninterpreted data that results from the analysis of the biological sample, and 16
any information extrapolated, derived, or inferred therefrom. 17
(B) “Genetic data” does not include deidentified data. For purposes 18
of this subdivision (B), “deidentified data” means data that cannot be used to 19
infer information about, or otherwise be linked to, a particular individual, 20
provided that the business that possesses the information: 21

BILL AS INTRODUCED S.248
2026 Page 4 of 16

VT LEG #385797 v.1
(i) takes reasonable measures to ensure that the information cannot 1
be associated with a consumer or household; 2
(ii) publicly commits to maintain and use the information only in 3
deidentified form and not to attempt to reidentify the information, except that 4
the business may periodically attempt to reidentify the information solely for 5
the purpose of determining whether its deidentification processes satisfy the 6
requirements of this subdivision (B), on the express condition that the business 7
does not use or disclose any information reidentified in this process and 8
destroys the reidentified information upon completion of that periodic 9
assessment; and 10
(iii) contractually obligates any recipients of the information to 11
take reasonable measures to ensure that the information cannot be associated 12
with a consumer or household and to commit to maintaining and using the 13
information only in deidentified form and not to reidentify the information. 14
(C) “Genetic data” does not include data or a biological sample to the 15
extent that data or a biological sample is collected, used, maintained, and 16
disclosed: 17
(i) exclusively