{"data":{"id":"us-ut/utah-code-13-60-104","jurisdiction":"us-ut","citation":"Utah Code § 13-60-104","heading":"Consumer genetic information -- Privacy notice -- Consent -- Access -- Deletion -- Destruction.","body":"(1) A direct-to-consumer genetic testing company shall:\n(a) provide to a consumer:\n(i) essential information about the company's collection, use, and disclosure of genetic data; and\n(ii) a prominent, publicly available privacy notice that includes information about the company's data collection, consent, use, access, disclosure, transfer, security, retention, and deletion practices;\n(b) obtain a consumer's initial express consent for collection, use, or disclosure of the consumer's genetic data that:\n(i) clearly describes the company's use of the genetic data that the company collects through the company's genetic testing product or service;\n(ii) specifies who has access to test results; and\n(iii) specifies how the company may share the genetic data;\n(c) if the company engages in any of the following, obtain a consumer's:\n(i) separate express consent for:\n(A) the transfer or disclosure of the consumer's genetic data to any person other than the company's vendors and service providers;\n(B) the use of genetic data beyond the primary purpose of the company's genetic testing product or service; or\n(C) the company's retention of any biological sample provided by the consumer following the company's completion of the initial testing service requested by the consumer;\n(ii) informed consent in accordance with the Federal Policy for the Protection of Human Subjects, 45 C.F.R. Part 46, for transfer or disclosure of the consumer's genetic data to a third party for:\n(A) research purposes; or\n(B) research conducted under the control of the company for the purpose of publication or generalizable knowledge; and\n(iii) express consent for:\n(A) marketing to a consumer based on the consumer's genetic data; or\n(B) marketing by a third party person to a consumer based on the consumer having ordered or purchased a genetic testing product or service;\n(d) require valid legal process for the company's disclosure of a consumer's genetic data to law enforcement or any government entity without the consumer's express written consent;\n(e) develop, implement, and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use, or disclosure; and\n(f) provide a process for a consumer to:\n(i) access the consumer's genetic data;\n(ii) delete the consumer's account and genetic data; and\n(iii) destroy the consumer's biological sample.\n(2) Notwithstanding Subsection (1)(c)(iii), a direct-to-consumer genetic testing company with a first-party relationship to a consumer may, without obtaining the consumer's express consent, provide customized content or offers on the company's website or through the company's application or service.","path":["Title 13 Commerce and Trade","Chapter 13-60 Genetic Information Privacy Act","Part 13-60-1 Genetic Information Privacy Act"],"source_url":"https://le.utah.gov/xcode/Title13/Chapter60/13-60-S104.html","current_through":"2026 General Session","vintage":"","retrieved_at":"2026-09-03T11:34:33Z","sha256":"27b78d71e49ae42c74608e56f8d590267ebc442ceb5256b9924d1b9b6beaae82","source_id":"us-ut","stale":false,"prev":"us-ut/utah-code-13-60-103","next":"us-ut/utah-code-13-60-105"},"notice":"GroundRules: Original legal text. Not legal advice."}