The new law defines data to include genotypic and phenotypic information as well as "self-reported health information," going beyond raw sequence data. It defines "genetic testing" to include the "interpretation of a consumer's genetic data," going beyond the lab work to extract DNA.

It also establishes notice, use, and consent requirements for companies processing consumer genetic data and that companies provide clear information about their practices and privacy protections. Consumers must provide express consent at initial collection and separate and additional express consent for secondary uses of data, the retention of a sample, and data transferred or disclosed to third parties.

A consumer's genetic data cannot be shared with any employer or entity offering health or life insurance without express consent from the consumer. The law also reinforces a 2021 state law requiring a warrant for DNA searches, leaving open the possibility that, after June 1st, 2025, other government actions involving genetic data would also require a warrant.

The state attorney general will have the power to enforce the law, but consumers will not be able to privately sue companies for violations.

The Genetic Information Privacy Act will be effective as of October 1st and follows a law restricting the use of facial recognition among police and government entities that took effect at the end of June this year.