Utah and South Dakota Enforce Genetic Privacy Laws
Utah and South Dakota now enforce laws enhancing genetic data privacy protections.
Why it matters: These laws require legal teams to reassess data handling and client advisement, integrating explicit consent and law enforcement limits.
- South Dakota's SB 49 penalizes genetic data misuse as of March 24, 2026.
- Utah's law demands explicit consent for data use, effective May 3, 2023.
- Over 15 states have similar genetic privacy laws.
- Utah restricts police access to genetic data without a warrant.
On March 24, 2026, South Dakota enacted SB 49, which imposes civil penalties on companies misusing genetic data. This follows concerns raised by a significant lawsuit against 23andMe in 2025 over unauthorized data sharing.
Utah's Genetic Information Privacy Act, which became effective May 3, 2023, mandates explicit consumer consent before genetic data is collected or shared. The law further protects privacy by requiring a warrant for police access to genetic information, setting a precedent for balancing consumer rights with legal enforcement.
With these regulations, Utah and South Dakota join the ranks of over 15 states with enacted genetic privacy laws since 2020. The proliferation of such laws highlights the shifting landscape where legal professionals need to diligently review and adapt compliance strategies to adhere to explicit consent requirements and limitations on law enforcement access.
By the numbers:
- 2026 — Year South Dakota enacted SB 49.
- 15 — States with genetic privacy laws since 2020.
What's next: Other states are considering similar legislation, which may push for federal action.