A bill has been sitting in the House Energy and Commerce Committee since March 2025 with a title broad enough to suggest it might finally give Americans some say over what happens to their genetic data. It doesn’t, not really — and understanding exactly what the American Genetic Privacy Act of 2025 (H.R. 2286) does and doesn’t do matters for anyone in the DFA who has ever spit in a tube for AncestryDNA, FamilyTreeDNA, or 23andMe.

What the Bill Actually Says

H.R. 2286 was introduced by Rep. Tim Burchett (R-TN), joined by Reps. Anna Paulina Luna and Warren Davidson, on March 24, 2025. Its operative language is short. It prohibits two things: selling “covered information” — including aggregated covered information — to the People’s Republic of China or any entity under Chinese government influence, control, or ownership; and, separately, it prohibits any “commercial DNA testing service” from disclosing that same covered information to China or a Chinese-controlled entity, in any manner, for any reason.

The bill defines a commercial DNA testing service as “a person that provides genealogical or ancestry-related information based on an individual’s DNA” — language written squarely around companies like Ancestry, MyHeritage, FamilyTreeDNA, 23andMe, and Living DNA, not just health-testing labs. “Covered information” means genetic information originally acquired from an individual through their use of one of these services. In other words, this bill is not a broad data-privacy measure that happens to touch genealogy; genealogy DNA testing is exactly what it was written to regulate.

Enforcement: The FTC, Not a New Privacy Right

The bill doesn’t create a private right of action — you couldn’t sue a testing company under this law if it violated it. Instead, a violation would be treated as an unfair or deceptive trade practice under the Federal Trade Commission Act, giving the FTC authority to investigate and penalize violators using its existing enforcement powers. That’s a meaningful mechanism, but it also means enforcement depends entirely on the FTC’s priorities and resources, the same as with any other consumer-protection statute.

What It Doesn’t Cover

This is the part worth sitting with before assuming the bill would meaningfully change how your DNA data is handled. H.R. 2286 only restricts disclosure to China and Chinese-government-controlled entities. It does nothing to restrict a testing company from selling or sharing your genetic data with a data broker, a pharmaceutical company, an insurer, or a foreign government other than China’s — all of which remain legal today, limited only by individual companies’ own privacy policies and a patchwork of state laws.

It also doesn’t address the scenario the DFA covered on this site earlier this month: what happens to genetic data when a testing company goes bankrupt. When 23andMe filed for bankruptcy in 2025, its store of genetic profiles became a company asset, sold through the bankruptcy process to a new owner — a transaction this bill would not have touched, because the buyer wasn’t a Chinese entity. Nor does the bill touch law enforcement access to genealogy databases, an issue that has directly affected sites like GEDmatch and FamilyTreeDNA, which genealogists have relied on for identifying unknown matches for over a decade.

A broader alternative, the Genomic Data Protection Act (S. 863), would establish more general federal standards for how genetic data can be collected, used, and shared regardless of the buyer’s nationality. It, too, remains in committee.

Third Time Introduced

This is not Burchett’s first attempt. He introduced a similar bill targeting DNA data sales to the CCP in 2021, followed by the American Genetic Privacy Act of 2023 (H.R. 5830), introduced September 29, 2023. Both were referred to committee, and neither received a floor vote before their respective Congresses ended — the fate of the great majority of bills introduced in Congress, which simply expire unpassed at the end of a two-year session and must be reintroduced from scratch to be considered again. H.R. 2286 is that reintroduction, and as of this writing it has not advanced beyond its committee referral either.

The bill exists within a broader wave of China-focused genetic-data legislation, including the BIOSECURE Act aimed at Chinese genomics firms, and follows intelligence-community warnings and the 23andMe bankruptcy, both of which raised the profile of genetic data as a national-security and a consumer-protection issue at the same time.

For DFA Researchers

Practically speaking, this bill — even if it eventually passes in its current form — would not change how FamilyTreeDNA, Ancestry, or any other provider treats your data with respect to anyone other than China. It would not restrict data brokers, would not restrict bankruptcy sales, and would not restrict law enforcement matching. If you tested through the DFA’s own Y-DNA project at FamilyTreeDNA, a U.S. company, this bill’s China-specific prohibition is not really the risk that should keep you up at night — the terms of service and privacy policy you agreed to when you tested are. For a fuller look at what those policies actually allow and what recourse exists, see our earlier piece, Your DNA, Your Data: Privacy in the Age of Genetic Genealogy. Worth watching, not worth waiting on.

Sources

U.S. Congress. “H.R.2286 – American Genetic Privacy Act of 2025.” Congress.gov. Introduced March 24, 2025. congress.gov.

GovTrack.us. “American Genetic Privacy Act of 2025 (H.R. 2286).” Accessed September 2026. govtrack.us.

PoliScore. “American Genetic Privacy Act of 2025.” 2026. poliscore.us.

GovInfo.gov. “H.R. 5830 (118th Congress): American Genetic Privacy Act of 2023.” govinfo.gov.

U.S. Congress. “S.863 – Genomic Data Protection Act.” Congress.gov. congress.gov.

Select Committee on the Chinese Communist Party. “U.S. Will Not Sit Idly as CCP Steals Our Genetic Data.” chinaselectcommittee.house.gov.

HIPAA Journal. “Bankruptcy Court Approves Sale of 23andMe.” hipaajournal.com.

Note: This post was researched and written with the assistance of artificial intelligence (AI). All content has been reviewed for accuracy as of September 2026. All errors are the responsibility of the author.