HIPAA applies only to covered entities and their business associates, which many direct-to-consumer DNA companies are not. The FTC enforces companies' privacy promises, GINA limits genetic discrimination by health insurers and employers (not life, disability or long-term care insurers), states add their own genetic privacy laws, and the FDA reviews health-related test claims rather than privacy.
Not legal advice. This is a plain-language map of US rules as we understand them from official sources checked in October 2026. Laws change and apply differently to different companies. For your own situation, ask your state attorney general's consumer office or a lawyer.
The map at a glance
| Rule or agency | What it does | Where it stops |
|---|---|---|
| HIPAA (HHS) | Privacy and security rules for health plans, clearinghouses, many providers and their business associates | Organizations that aren't covered entities or business associates |
| FTC Act (FTC) | Polices deceptive and unfair practices, including broken privacy promises | Mostly acts case by case, after the fact |
| GINA (EEOC and others) | Bars genetic discrimination by health insurers and employers | Life, disability and long-term care insurance; employers with fewer than 15 employees |
| State laws | Genetic privacy, consumer privacy, health data and breach rules | Vary by state; coverage depends on where you live |
| FDA and CLIA | Test claims and lab quality | Not privacy rules |
HIPAA: often not the rule you think
People assume HIPAA protects anything health-related. It doesn't work that way. HIPAA applies to covered entities, which are health plans, health care clearinghouses and health care providers that conduct certain electronic transactions such as billing, plus their business associates. The HHS covered entities page is direct: an organization that is neither "does not have to comply with the HIPAA Rules."
Many direct-to-consumer DNA companies sell kits to you and are paid by you, not by a health plan, so they may not meet that definition. The same genetic data can be HIPAA-protected in one setting and not in another. A test your doctor orders through a clinical lab that bills your insurance is a different situation from a kit you buy online. What decides it is the company's role, not the type of data.
The FTC: enforcing the promises companies make
Where HIPAA doesn't apply, the Federal Trade Commission is the main federal privacy enforcer for consumer businesses. Its tool is the FTC Act's ban on deceptive and unfair practices. In practice, that means a DNA company's privacy policy and marketing are enforceable promises.
- 1Health.io (Vitagene), 2023. The FTC alleged the company left health and genetic data in publicly accessible cloud storage, didn't keep promises about deletion and sample destruction, and retroactively expanded data sharing. The final order (September 2023) requires affirmative express consent before sharing health data with third parties, destruction of samples kept more than 180 days, and a security program.
- CRI Genetics, 2023. In a joint action with California's Attorney General, the FTC alleged deceptive accuracy claims, fake reviews and checkout dark patterns. The order also requires consent before sharing DNA information.
The FTC also enforces the Health Breach Notification Rule, which applies to vendors of personal health records and related entities that are not covered by HIPAA. It requires notice to affected people no later than 60 calendar days after a breach is discovered.
The limit is that FTC enforcement mostly happens after something goes wrong, and it largely holds companies to what they said. A vague policy promises less, so there is less to enforce.
GINA: discrimination rules with known gaps
The Genetic Information Nondiscrimination Act became law in 2008. NHGRI's summary explains its two main parts:
- Title I (health insurance) stops health insurers from using genetic information for eligibility, coverage, underwriting or premiums, and from requiring genetic tests.
- Title II (employment), enforced by the EEOC, stops employers from using genetic information in decisions such as hiring and firing, and generally from requesting it.
The gaps matter if you are deciding whether to test:
- GINA's health insurance protections do not cover life, disability or long-term care insurance.
- It does not apply to employers with fewer than 15 employees.
- The US military may use genetic information in employment decisions, and TRICARE protection is more limited.
GINA sets a floor, and some states go further, including extending protection to life, disability or long-term care insurance. Notice what GINA isn't, though: it limits what insurers and employers can do with genetic information. It isn't a privacy law governing how a testing company stores or shares your data.
State laws: a patchwork
Many of the rules written specifically for genetic testing companies come from the states, and they differ in scope, consent requirements and enforcement. Broadly, you'll find:
- Genetic privacy laws addressing consent, deletion and sample destruction. California's Genetic Information Privacy Act, for example, gives Californians the right to delete their account and genetic data, have their sample destroyed, and revoke consent, according to the California Attorney General.
- Comprehensive consumer privacy laws that may treat genetic data as sensitive.
- Breach notification laws, which every state has, with differing definitions of covered data.
- Anti-discrimination laws that go beyond GINA.
To see what your state has, NHGRI's Genome Statute and Legislation Database lets you filter state bills and statutes by topic and status (it covers sessions through 2024, so check your legislature for newer laws). State attorneys general enforce many of these laws, and in 2025 a coalition of states took 23andMe's genetic data sale to court. That story is in what happens to your DNA data if the company is sold.
FDA and lab rules: accuracy, not privacy
The FDA's role concerns whether health-related tests do what they claim. According to the FDA's direct-to-consumer tests page:
- Companies must get FDA clearance before offering their first DTC genetic health risk test.
- DTC pharmacogenetic and cancer predisposition tests require premarket review.
- Carrier screening tests are exempt from premarket review but must meet specific requirements.
- The FDA does not review ancestry tests and generally does not review low-risk wellness tests.
Separately, CMS oversees lab quality through CLIA, which covers testing on human specimens for health assessment or for diagnosing, preventing or treating disease. In 2025 a federal court vacated an FDA rule that would have regulated laboratory-developed tests as medical devices, and the FDA later rescinded it, so oversight of those tests stays mainly with CLIA.
None of this governs privacy. A test can be FDA-authorized and still have a privacy policy you don't like, and the reverse is also true. The FDA itself says results should be discussed with a health care provider. Before acting on a consumer result, read our guide to understanding results and talk to a clinician or genetic counselor about clinical confirmation.
What this means for you
- Don't assume HIPAA applies. Read the company's own privacy policy, because for many DTC tests it's the main enforceable promise.
- Check your state's laws for rights to delete data, destroy samples and revoke consent.
- If life, disability or long-term care insurance matters to you, consider the GINA gap before testing.
- Look for FDA authorization when a test makes health claims, and treat it as an accuracy signal, not a privacy one.
Our genetic privacy checklist and the walkthrough of privacy clauses that matter walk you through checking any company yourself.
Common questions
Is data from a consumer DNA kit protected by HIPAA?
Often not. HIPAA covers health plans, clearinghouses, certain providers and their business associates, and companies that sell DNA kits directly to consumers often fall outside that definition. Check the company's privacy policy and your state's laws instead.
Can a life insurer use my DNA test results?
GINA doesn't cover life, disability or long-term care insurance, so federal law doesn't prohibit it. Some states add protections. Check your state's rules before testing if this matters to you.
Who do I complain to about a DNA company's privacy practices?
In the US, you can report it to the FTC and to your state attorney general's consumer protection office. A written record of what the company promised and what happened helps.
Does FDA authorization mean a test protects my privacy?
No. FDA review concerns whether health-related tests are accurate and properly labeled. Privacy depends on the company's policy and applicable privacy laws.
Does GINA apply to small businesses?
GINA's employment protections don't apply to employers with fewer than 15 employees. Some state laws may cover smaller employers.
Keep going
Sources
Checked in October 2026: HIPAA scope from HHS's covered entities page; FTC enforcement from the FTC's 1Health.io and CRI Genetics releases (2023) and its Health Breach Notification Rule guidance; GINA scope and gaps from NHGRI; FDA's DTC categories from FDA's direct-to-consumer tests page (content current as of Dec 2019, so check for updates); CLIA scope from CMS; the 2025 LDT rule vacatur and rescission from Venable and GenomeWeb reporting; California GIPA rights from the California Attorney General. We didn't name other states' genetic privacy laws because we couldn't verify an up-to-date list, and we left out penalty amounts.
- HHS: Covered Entities and Business Associates
- FTC: Order finalized against 1Health.io
- NHGRI: Genetic Discrimination and GINA
- FDA: Direct-to-Consumer Tests
- CMS: Clinical Laboratory Improvement Amendments (CLIA)
- NHGRI: Genome Statute and Legislation Database
Educational content, not medical advice. A genetic result is information, not a diagnosis; for anything medically important, talk to a qualified clinician or genetic counselor. Some outbound links are affiliate links; see the disclosure.