Genetic Privacy Law Overview
A jurisdiction-by-jurisdiction overview of what US, Canadian and EU official sources say about genetic privacy and discrimination law, including what GINA does not cover.
Content last updated . This page has not been medically reviewed.
Read this first
This page describes laws as published by official sources we read on 2026-10-22. Laws change, differ by place and depend on the facts, so this is not legal advice. For a specific situation, ask a lawyer or the relevant regulator. Countries not mentioned here were not verified.Genetic privacy is different from other health privacy because a DNA result can also say something about relatives. For how privacy risks and unexpected results work in practice, see genetic privacy and incidental findings.
United States: GINA
The Genetic Information Nondiscrimination Act of 2008 (GINA) protects against discrimination based on genetic information in health insurance (Title I) and in employment (Title II). [1]| Area | What the National Human Genome Research Institute (NHGRI) says | Limits it notes |
|---|---|---|
| Health insurance (Title I) | Health insurers may not use genetic information to determine eligibility, and may not request or require genetic testing. [1] | Does not cover long-term care, life or disability insurance. [1] Concerns remain about discrimination in those lines. [2] |
| Employment (Title II) | Employers may not use genetic information in decisions such as hiring or firing. The statute makes it unlawful for an employer to fail or refuse to hire, or to discharge, an employee because of genetic information. [1] [3] | Does not apply to employers with fewer than 15 employees. [1] The US military may use genetic information in employment decisions. [1] |
According to the NHGRI, genetic information as defined in the law includes family medical history and disease in family members. [1] The HIPAA rules define genetic information to include a person's genetic tests and those of family members. [4] Under the 2013 change to HIPAA, genetic information is considered health information. [1]
Other US points from the NHGRI page, last updated January 6, 2022: whether the Americans with Disabilities Act protects against workplace genetic discrimination has never been tested in court. [1] Some states have their own laws, and they vary substantially. [2] Check your state's law and current federal updates.
United States: consumer tests and companies
The NHGRI page on privacy (last updated February 6, 2024) says:- Direct-to-consumer (DTC) genetic tests have limited regulation. [2]
- No federal laws prohibit companies from providing individuals' genetic information to third parties, but the Federal Trade Commission (FTC) provides some protections and can act against companies that make false or misleading statements about privacy and security. [2]
- If you download your data from one service and upload it to another, the original company is no longer responsible for privacy problems that may occur. [2]
- No federal law prohibits surreptitious DNA testing, and state laws on this vary. [2]
The FTC has used its authority in this area. In June 2023 it announced a case against 1Health.io, calling it its first focused on both privacy and security of genetic information. [5] It alleged that the company retroactively expanded the types of third parties it could share consumers' data with. [5] Because the NHGRI page is dated 2024, newer federal or state laws may exist. We did not verify any.
Canada: Genetic Non-Discrimination Act
Canada's Genetic Non-Discrimination Act (S.C. 2017, c. 3), current to 2026-09-30 on the Justice Laws website, makes it prohibited for any person to require someone to undergo a genetic test as a condition of providing goods or services. [6] It also prohibits collecting, using or disclosing a person's genetic test results without written consent in those settings. [6] It does not apply to health care practitioners providing health services, or to people conducting research on participants. [6] The Act defines a genetic test as one that analyzes DNA, RNA or chromosomes for purposes such as prediction of disease risk. [6]European Union
The European Data Protection Board's guide for small businesses lists genetic data and data concerning health as special categories of sensitive data. [7] It says processing sensitive data is generally prohibited except in specific cases. [7] We did not read the full regulation or national laws, so details such as how member states add rules were not verified.Why laws alone may not settle it
Even with legal protection, a DNA sample can never be truly anonymized, because each sequence is unique, according to the NHGRI. [2] Related guides: direct-to-consumer genetic tests, raw genetic data and third-party analysis, and the broader health data privacy map.Frequently asked questions
Does GINA stop life insurers from using my genetic test results?
No. The NHGRI says GINA's health insurance protections do not cover long-term care, life or disability insurance, though some states offer additional protections. [1]
Does GINA cover small employers?
The NHGRI says GINA does not apply to employers with fewer than 15 employees. [1]
Can a DTC genetic testing company share my data?
The NHGRI said in 2024 that no federal law prohibits companies from providing genetic information to third parties, though the FTC can act on false or misleading privacy statements. [2] Read the company's policy and check for newer laws.
Does Canada have a genetic discrimination law?
Yes, the Genetic Non-Discrimination Act, which prohibits requiring a genetic test as a condition of goods or services in the settings it covers. [6]
Is genetic data treated as sensitive in Europe?
The European Data Protection Board's guide lists genetic data as a special category of sensitive data. [7]
References
- National Human Genome Research Institute. Genetic Discrimination (page last updated January 6, 2022). Read 2026-10-22.
- National Human Genome Research Institute. Privacy in Genomics (page last updated February 6, 2024). Read 2026-10-22.
- U.S. Equal Employment Opportunity Commission. Genetic Information Nondiscrimination Act of 2008 (statute text). Read 2026-10-22.
- U.S. Electronic Code of Federal Regulations. 45 CFR 160.103, Definitions (HIPAA) (current text). Read 2026-10-22.
- U.S. Federal Trade Commission. FTC Says Genetic Testing Company 1Health Failed to Protect Privacy and Security of DNA Data and Unfairly Changed its Privacy Policy (press release, June 16, 2023). Read 2026-10-22.
- Government of Canada, Justice Laws. Genetic Non-Discrimination Act, S.C. 2017, c. 3 (act current to 2026-09-30). Read 2026-10-22.
- European Data Protection Board. SME Data Protection Guide: Process personal data lawfully. Read 2026-10-22.