{"formats":[{"name":"JSON","format":"json","url":"\/downloads\/2025\/code-json\/59.1-596.json"},{"name":"Plain Text","format":"text","url":"\/downloads\/2025\/code-text\/59.1-596.txt"},{"name":"XML","format":"xml","url":"\/downloads\/2025\/code-xml\/59.1-596.xml"},{"name":"HTML","format":"html","url":"\/downloads\/2025\/code-html\/59.1-596.html"}],"law_id":71838,"edition_id":1,"section_id":71838,"structure_id":14495,"section_number":"59.1-596","catch_line":"Express consent required; revocation of express consent","history":"2023, c. 526.","full_text":"A\n\nExpress consent required pursuant to this chapter requires a statement of the nature of the data collection, use, maintenance, or disclosure for which express consent is sought in plain and prominent language that an ordinary consumer would notice and understand and an affirmative authorization by the consumer granting permission in response to such statement. Express consent shall not be inferred from inaction.B\n\nEvery direct-to-consumer genetic testing company shall obtain a consumer’s express consent for the collection, use, and disclosure of the consumer’s genetic data, including, at a minimum, separate and express consent for each of the following:1\n\nThe use of genetic data collected through the genetic testing product or service offered to the consumer. Express consent for such use of genetic data shall include a statement describing who will receive access to the genetic data, how such genetic data will be shared, and the purposes for which such data shall be collected, used, and disclosed;2\n\nThe storage of a consumer’s biological sample after the initial testing required by the consumer has been completed;3\n\nEach use of genetic data or the biological sample beyond the primary purpose of the genetic testing or service and inherent contextual uses;4\n\nEach transfer or disclosure of the consumer’s genetic data or biological sample to a third party other than a service provider, including the name of the third party to which the consumer’s genetic data or biological sample will be transferred or disclosed; and5\n\nAny marketing or facilitation of marketing to a consumer based on the consumer’s genetic data or marketing or facilitation of marketing by a third party based on the consumer’s having ordered, purchased, received, or used a genetic testing product or service, except that a direct-to-consumer genetic testing company shall not be required to obtain a consumer’s express consent to marketing to the consumer on the company’s own website or mobile application based on the consumer having ordered, purchased, received, or used a genetic testing product or service from that company if (i) the advertisement does not depend on any information specific to that consumer other than information regarding the product or service that the consumer ordered, purchased, received, or used; (ii) the placement of the advertisement does not result in disparate exposure to advertising content on the basis of the sex, race, color, religion, ancestry, national origin, disability, medical condition, genetic data, marital status, sexual orientation, citizenship, primary language, or immigration status of the consumer; and (iii) the advertisement of a third-party product or service is clearly labeled as advertising content, is accompanied by the name of the third party that has contributed to the placement of the advertisement, and, if applicable, indicates that the advertised product or service and claims regarding the product or service have not been vetted or endorsed by the direct-to-consumer genetic testing company.C\n\nEvery direct-to-consumer genetic testing company shall provide a mechanism by which a consumer may revoke the express consent required pursuant to subsection B, which shall include an option for revocation of express consent through the primary medium through which the company communicates with consumers.D\n\nUpon revocation of the express consent required pursuant to subsection B by a consumer, a direct-to-consumer genetic testing company shall (i) honor such revocation of express consent as soon as is practicable but in all cases within 30 days of receipt of such revocation and (ii) destroy the consumer’s biological sample within 30 days of receipt of revocation of the consumer’s express consent to store such sample.","order_by":null,"text":{"0":{"id":258833,"text":"Express consent required pursuant to this chapter requires a statement of the nature of the data collection, use, maintenance, or disclosure for which express consent is sought in plain and prominent language that an ordinary consumer would notice and understand and an affirmative authorization by the consumer granting permission in response to such statement. Express consent shall not be inferred from inaction.","type":"section","prefixes":["A"],"prefix":"A","entire_prefix":"A","prefix_anchor":"A","level":1,"next_prefix":"B"},"1":{"id":258834,"text":"Every direct-to-consumer genetic testing company shall obtain a consumer’s express consent for the collection, use, and disclosure of the consumer’s genetic data, including, at a minimum, separate and express consent for each of the following:","type":"section","prefixes":["B"],"prefix":"B","entire_prefix":"B","prefix_anchor":"B","level":1,"prior_prefix":"A","next_prefix":"B1"},"2":{"id":258835,"text":"The use of genetic data collected through the genetic testing product or service offered to the consumer. Express consent for such use of genetic data shall include a statement describing who will receive access to the genetic data, how such genetic data will be shared, and the purposes for which such data shall be collected, used, and disclosed;","type":"section","prefixes":["B","1"],"prefix":"1","entire_prefix":"B1","prefix_anchor":"B1","level":2,"prior_prefix":"B","next_prefix":"B2"},"3":{"id":258836,"text":"The storage of a consumer’s biological sample after the initial testing required by the consumer has been completed;","type":"section","prefixes":["B","2"],"prefix":"2","entire_prefix":"B2","prefix_anchor":"B2","level":2,"prior_prefix":"B1","next_prefix":"B3"},"4":{"id":258837,"text":"Each use of genetic data or the biological sample beyond the primary purpose of the genetic testing or service and inherent contextual uses;","type":"section","prefixes":["B","3"],"prefix":"3","entire_prefix":"B3","prefix_anchor":"B3","level":2,"prior_prefix":"B2","next_prefix":"B4"},"5":{"id":258838,"text":"Each transfer or disclosure of the consumer’s genetic data or biological sample to a third party other than a service provider, including the name of the third party to which the consumer’s genetic data or biological sample will be transferred or disclosed; and","type":"section","prefixes":["B","4"],"prefix":"4","entire_prefix":"B4","prefix_anchor":"B4","level":2,"prior_prefix":"B3","next_prefix":"B5"},"6":{"id":258839,"text":"Any marketing or facilitation of marketing to a consumer based on the consumer’s genetic data or marketing or facilitation of marketing by a third party based on the consumer’s having ordered, purchased, received, or used a genetic testing product or service, except that a direct-to-consumer genetic testing company shall not be required to obtain a consumer’s express consent to marketing to the consumer on the company’s own website or mobile application based on the consumer having ordered, purchased, received, or used a genetic testing product or service from that company if (i) the advertisement does not depend on any information specific to that consumer other than information regarding the product or service that the consumer ordered, purchased, received, or used; (ii) the placement of the advertisement does not result in disparate exposure to advertising content on the basis of the sex, race, color, religion, ancestry, national origin, disability, medical condition, genetic data, marital status, sexual orientation, citizenship, primary language, or immigration status of the consumer; and (iii) the advertisement of a third-party product or service is clearly labeled as advertising content, is accompanied by the name of the third party that has contributed to the placement of the advertisement, and, if applicable, indicates that the advertised product or service and claims regarding the product or service have not been vetted or endorsed by the direct-to-consumer genetic testing company.","type":"section","prefixes":["B","5"],"prefix":"5","entire_prefix":"B5","prefix_anchor":"B5","level":2,"prior_prefix":"B4","next_prefix":"C"},"7":{"id":258840,"text":"Every direct-to-consumer genetic testing company shall provide a mechanism by which a consumer may revoke the express consent required pursuant to subsection B, which shall include an option for revocation of express consent through the primary medium through which the company communicates with consumers.","type":"section","prefixes":["C"],"prefix":"C","entire_prefix":"C","prefix_anchor":"C","level":1,"prior_prefix":"B5","next_prefix":"D"},"8":{"id":258841,"text":"Upon revocation of the express consent required pursuant to subsection B by a consumer, a direct-to-consumer genetic testing company shall (i) honor such revocation of express consent as soon as is practicable but in all cases within 30 days of receipt of such revocation and (ii) destroy the consumer’s biological sample within 30 days of receipt of revocation of the consumer’s express consent to store such sample.","type":"section","prefixes":["D"],"prefix":"D","entire_prefix":"D","prefix_anchor":"D","level":1,"prior_prefix":"C"}},"ancestry":[{"id":14495,"edition_id":1,"name":"Genetic Data Privacy","identifier":"56","label":"chapter","depth":2,"order_by":1,"parent_id":12809,"metadata":{},"date_created":"2026-06-26 03:48:21","date_modified":"2026-06-26 03:48:21","permalink":{"id":262825,"object_type":"structure","relational_id":14495,"identifier":"56","token":"59.1\/56","url":"\/59.1\/56\/","edition_id":1,"permalink":0,"preferred":1}},{"id":12809,"edition_id":1,"name":"Trade and Commerce","identifier":"59.1","label":"title","depth":1,"order_by":1,"parent_id":null,"metadata":{},"date_created":"2026-06-26 03:43:54","date_modified":"2026-06-26 03:43:54","permalink":{"id":259521,"object_type":"structure","relational_id":12809,"identifier":"59.1","token":"59.1","url":"\/59.1\/","edition_id":1,"permalink":0,"preferred":1}}],"structure_contents":[{"id":63239,"structure_id":14495,"section_number":"59.1-593","catch_line":"Definitions","url":"\/59.1-593\/","token":"59.1\/56\/59.1-593","metadata":false},{"id":58499,"structure_id":14495,"section_number":"59.1-594","catch_line":"Exclusions","url":"\/59.1-594\/","token":"59.1\/56\/59.1-594","metadata":false},{"id":79801,"structure_id":14495,"section_number":"59.1-595","catch_line":"Information to be made available to consumers","url":"\/59.1-595\/","token":"59.1\/56\/59.1-595","metadata":false},{"id":71838,"structure_id":14495,"section_number":"59.1-596","catch_line":"Express consent required; revocation of express consent","url":"\/59.1-596\/","token":"59.1\/56\/59.1-596","metadata":false},{"id":56619,"structure_id":14495,"section_number":"59.1-597","catch_line":"Other requirements applicable to direct-to-consumer genetic testing companies","url":"\/59.1-597\/","token":"59.1\/56\/59.1-597","metadata":false},{"id":78669,"structure_id":14495,"section_number":"59.1-598","catch_line":"Contracts with service providers","url":"\/59.1-598\/","token":"59.1\/56\/59.1-598","metadata":false},{"id":56035,"structure_id":14495,"section_number":"59.1-599","catch_line":"Certain disclosures of genetic data prohibited","url":"\/59.1-599\/","token":"59.1\/56\/59.1-599","metadata":false},{"id":55900,"structure_id":14495,"section_number":"59.1-600","catch_line":"Discrimination prohibited","url":"\/59.1-600\/","token":"59.1\/56\/59.1-600","metadata":false},{"id":61312,"structure_id":14495,"section_number":"59.1-601","catch_line":"Enforcement; civil penalty","url":"\/59.1-601\/","token":"59.1\/56\/59.1-601","metadata":false},{"id":68507,"structure_id":14495,"section_number":"59.1-602","catch_line":"Limitations","url":"\/59.1-602\/","token":"59.1\/56\/59.1-602","metadata":false}],"previous_section":{"id":79801,"structure_id":14495,"section_number":"59.1-595","catch_line":"Information to be made available to consumers","url":"\/59.1-595\/","token":"59.1\/56\/59.1-595","metadata":false},"next_section":{"id":56619,"structure_id":14495,"section_number":"59.1-597","catch_line":"Other requirements applicable to direct-to-consumer genetic testing companies","url":"\/59.1-597\/","token":"59.1\/56\/59.1-597","metadata":false},"metadata":false,"official_url":"https:\/\/law.lis.virginia.gov\/vacode\/59.1-596\/","history_text":"

This law was first created in 2023. The record of its establishment is cataloged in chapter 526<\/a> of that year\u2019s edition of \u201cActs of Assembly,\u201d the annual state publication listing all changes made to the Code of Virginia in that year.<\/p>","references":[{"id":79801,"section_number":"59.1-595","catch_line":"Information to be made available to consumers","order_by":null,"url":"\/59.1-595\/"}],"refers_to":false,"permalink":{"id":262839,"object_type":"law","relational_id":71838,"identifier":"59.1-596","token":"59.1\/56\/59.1-596","url":"\/59.1-596\/","edition_id":1,"permalink":0,"preferred":1},"url":"\/59.1-596\/","token":"59.1\/56\/59.1-596","dublin_core":{"Title":"Express consent required; revocation of express consent","Type":"Text","Format":"text\/html","Identifier":"\u00a7 59.1-596","Relation":"Code of Virginia"},"html":"\n\t\t\t\t\t\t

A.<\/span> Express consent<\/span> required pursuant to this chapter requires a statement of the nature of the data collection, use, maintenance, or disclosure for which express consent<\/span> is sought in plain and prominent language that an ordinary consumer<\/span> would notice and understand and an affirmative authorization<\/span> by the consumer<\/span> granting permission in response to such statement. Express consent<\/span> shall not be inferred from inaction. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

B.<\/span> Every direct-to-consumer<\/span> genetic testing company<\/span> shall obtain a consumer<\/span>’s express consent<\/span> for the collection, use, and disclosure of the consumer<\/span>’s genetic data<\/span>, including, at a minimum, separate and express consent<\/span> for each of the following: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> The use of genetic data<\/span> collected through the genetic testing product or service offered to the consumer<\/span>. Express consent<\/span> for such use of genetic data<\/span> shall include a statement describing who will receive access to the genetic data<\/span>, how such genetic data<\/span> will be shared, and the purposes for which such data shall be collected, used, and disclosed; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> The storage of a consumer<\/span>’s biological sample<\/span> after the initial testing required by the consumer<\/span> has been completed; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> Each use of genetic data<\/span> or the biological sample<\/span> beyond the primary purpose of the genetic testing or service and inherent contextual uses; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> Each transfer or disclosure of the consumer<\/span>’s genetic data<\/span> or biological sample<\/span> to a third party<\/span> other than a service provider<\/span>, including the name of the third party<\/span> to which the consumer<\/span>’s genetic data<\/span> or biological sample<\/span> will be transferred or disclosed; and <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

5.<\/span> Any marketing or facilitation of marketing to a consumer<\/span> based on the consumer<\/span>’s genetic data<\/span> or marketing or facilitation of marketing by a third party<\/span> based on the consumer<\/span>’s having ordered, purchased, received, or used a genetic testing product or service, except that a direct-to-consumer<\/span> genetic testing company<\/span> shall not be required to obtain a consumer<\/span>’s express consent<\/span> to marketing to the consumer<\/span> on the company’s own website or mobile application based on the consumer<\/span> having ordered, purchased, received, or used a genetic testing product or service from that company if (i) the advertisement does not depend on any information specific to that consumer<\/span> other than information regarding the product or service that the consumer<\/span> ordered, purchased, received, or used; (ii) the placement of the advertisement does not result in disparate exposure to advertising content on the basis of the sex, race, color, religion, ancestry, national origin, disability, medical condition, genetic data<\/span>, marital status, sexual orientation, citizenship, primary language, or immigration status of the consumer<\/span>; and (iii) the advertisement of a third-party<\/span> product or service is clearly labeled as advertising content, is accompanied by the name of the third party<\/span> that has contributed to the placement of the advertisement, and, if applicable, indicates that the advertised product or service and claims regarding the product or service have not been vetted or endorsed by the direct-to-consumer<\/span> genetic testing company<\/span>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

C.<\/span> Every direct-to-consumer<\/span> genetic testing company<\/span> shall provide a mechanism by which a consumer<\/span> may revoke the express consent<\/span> required pursuant to subsection B, which shall include an option for revocation<\/span> of express consent<\/span> through the primary medium through which the company communicates with consumers<\/span>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

D.<\/span> Upon revocation<\/span> of the express consent<\/span> required pursuant to subsection B by a consumer<\/span>, a direct-to-consumer<\/span> genetic testing company<\/span> shall (i) honor such revocation<\/span> of express consent<\/span> as soon as is practicable but in all cases within 30 days of receipt of such revocation<\/span> and (ii) destroy the consumer<\/span>’s biological sample<\/span> within 30 days of receipt of revocation<\/span> of the consumer<\/span>’s express consent<\/span> to store such sample. <\/i><\/a><\/p><\/section>","plain_text":" CODE OF VIRGINIA\n\nEXPRESS CONSENT REQUIRED; REVOCATION OF EXPRESS CONSENT (\u00a7 59.1-596)\n\nA. Express consent required pursuant to this chapter requires a statement of the\nnature of the data collection, use, maintenance, or disclosure for which express\nconsent is sought in plain and prominent language that an ordinary consumer\nwould notice and understand and an affirmative authorization by the consumer\ngranting permission in response to such statement. Express consent shall not be\ninferred from inaction.\n\nB. Every direct-to-consumer genetic testing company shall obtain a\nconsumer’s express consent for the collection, use, and disclosure of the\nconsumer’s genetic data, including, at a minimum, separate and express\nconsent for each of the following:\n\n 1. The use of genetic data collected through the genetic testing product or\n service offered to the consumer. Express consent for such use of genetic data\n shall include a statement describing who will receive access to the genetic\n data, how such genetic data will be shared, and the purposes for which such\n data shall be collected, used, and disclosed;\n\n 2. The storage of a consumer’s biological sample after the initial\n testing required by the consumer has been completed;\n\n 3. Each use of genetic data or the biological sample beyond the primary\n purpose of the genetic testing or service and inherent contextual uses;\n\n 4. Each transfer or disclosure of the consumer’s genetic data or\n biological sample to a third party other than a service provider, including\n the name of the third party to which the consumer’s genetic data or\n biological sample will be transferred or disclosed; and\n\n 5. Any marketing or facilitation of marketing to a consumer based on the\n consumer’s genetic data or marketing or facilitation of marketing by a\n third party based on the consumer’s having ordered, purchased, received,\n or used a genetic testing product or service, except that a direct-to-consumer\n genetic testing company shall not be required to obtain a consumer’s\n express consent to marketing to the consumer on the company’s own\n website or mobile application based on the consumer having ordered, purchased,\n received, or used a genetic testing product or service from that company if\n (i) the advertisement does not depend on any information specific to that\n consumer other than information regarding the product or service that the\n consumer ordered, purchased, received, or used; (ii) the placement of the\n advertisement does not result in disparate exposure to advertising content on\n the basis of the sex, race, color, religion, ancestry, national origin,\n disability, medical condition, genetic data, marital status, sexual\n orientation, citizenship, primary language, or immigration status of the\n consumer; and (iii) the advertisement of a third-party product or service is\n clearly labeled as advertising content, is accompanied by the name of the\n third party that has contributed to the placement of the advertisement, and,\n if applicable, indicates that the advertised product or service and claims\n regarding the product or service have not been vetted or endorsed by the\n direct-to-consumer genetic testing company.\n\nC. Every direct-to-consumer genetic testing company shall provide a mechanism by\nwhich a consumer may revoke the express consent required pursuant to subsection\nB, which shall include an option for revocation of express consent through the\nprimary medium through which the company communicates with consumers.\n\nD. Upon revocation of the express consent required pursuant to subsection B by a\nconsumer, a direct-to-consumer genetic testing company shall (i) honor such\nrevocation of express consent as soon as is practicable but in all cases within\n30 days of receipt of such revocation and (ii) destroy the consumer’s\nbiological sample within 30 days of receipt of revocation of the\nconsumer’s express consent to store such sample.\n\nHISTORY: 2023, c. 526.","edition":{"id":1,"name":"2025","slug":"2025","date_created":"2026-06-21 22:39:22","date_modified":"2026-06-21 22:39:22","current":1,"order_by":1,"last_import":null}}