State-by-state genetic privacy legislation update, May 2026: four states acted in the last 60 days plus a bipartisan federal bill in motion.

A short tracker on where US state-level genetic privacy legislation actually stands as of May 2026.

Recently signed:

Utah HB 182, the Genetic Information Privacy Act (enrolled copy), signed by Gov. Cox on March 17, 2026 (signing announcement). Restricts foreign-adversary access to genetic sequencing data, restricts certain sequencers and software, sets storage requirements. Effective January 1, 2028.

South Dakota SB 49 (LegiScan history), signed by Gov. Rhoden in late March 2026 (KOTA News reported the signing March 24). Direct-to-consumer genetic testing oversight, consumer access and deletion rights, biological-sample destruction on request, civil penalties up to $5,000 per violation. Effective July 1, 2026. (Hunton analysis)

Recently moved but not yet signed:

Wisconsin AB 673 (bill page) passed both chambers in early 2026 and was vetoed by the Governor on March 27, 2026, citing potential unintended consequences for legitimate medical and research activities including multi-institution and international collaborations (signed veto message PDF). The political signal is that even a veto of a genetic-privacy bill is now substantive policy engagement, not a formality.

West Virginia HB 5034, the Genomic Information Privacy Act of 2026 (bill text). Restricts foreign-adversary access to genetic data, imposes consent/deletion/security obligations on entities collecting genetic data, includes a private right of action with statutory damages of $2,500 per violation. Status: introduced in the 2026 regular session.

Also active in the 2026 cycle (introduced earlier this year, status varies): Rhode Island S 2203, Vermont HB 639, Virginia HB 685, Alabama HB 265, Illinois SB 2886, South Carolina SB 731, plus DTC-focused bills in Connecticut (HB 5128) and California (AB 1727) (Inside Privacy overview).

Federal:

The Don't Sell My DNA Act (S.1916 bill text on congress.gov) has bipartisan sponsorship in both chambers. Senate (S.1916): Cornyn, Klobuchar, Grassley. House: Lofgren, Cline. Amends the Bankruptcy Code to classify genetic data as personally identifiable information, requires written consent before transfer during bankruptcy, and mandates deletion of genetic data not subject to an approved sale. (Cornyn press release, Grassley press release, Lofgren press release, Cline press release)

Existing state-level coverage from the 2023 to 2025 wave: Texas Genomic Act of 2025, HB 130, effective Sept 1, 2025 (statute); Tennessee Information Protection Act, HB 1181, effective July 1, 2025 (TN AG guidance); Virginia Genetic Data Privacy Act, SB 1087, effective July 1, 2023 (VA Code Chapter 56); plus separate genetic-privacy statutes in Montana, Florida, Nebraska, and Alabama. The 2024-vintage state laws are covered comparatively in the Future of Privacy Forum blog (FPF analysis).

Common thread across all of this: legislation is responding to the gap between privacy-policy boilerplate and observable behavior. The 23andMe bankruptcy in 2025 is the proximate cause of most of the federal and several of the state movements, but the policy direction was already heading this way before that case forced it.