The American Genetic Privacy Act, which we covered here in September, only stops DNA testing companies from selling your data to China. The Genomic Data Protection Act (S. 863) is the bill that would actually reach everyone else — every data broker, every pharmaceutical partner, every buyer in a bankruptcy sale, regardless of what country they’re in. It has bipartisan sponsors, a much broader scope, and, as of this writing, exactly the same amount of floor time as its narrower cousin: none.

What the Bill Actually Says

S. 863 was introduced by Sens. Bill Cassidy (R-LA) and Gary Peters (D-MI) on March 5, 2025, and referred to the Senate Committee on Commerce, Science, and Transportation. It defines a “direct-to-consumer genomic testing company” broadly: any entity that manufactures genomic testing products, analyzes or collects genomic data, or “purchases or acquires genomic data from a direct-to-consumer genomic testing company.” That last clause matters enormously — it means the obligations follow the data even after it changes hands, rather than applying only to the company that originally collected your sample.

“Genomic data” is defined just as broadly: any data, in any format, resulting from analysis of a biological sample, whether or not it has been deidentified. That includes DNA, RNA, genes, chromosomes, SNPs, raw uninterpreted data, and anything derived from it. The one carve-out is deidentified data used for research consistent with HIPAA’s privacy standards. Compare that to the American Genetic Privacy Act, which only defines “genetic information” in the narrow sense of test results themselves and only restricts one specific destination.

The 30-Day Acquisition Notice

The provision most directly relevant to genealogists is the requirement that a covered company give 30 days’ advance notice before being purchased or acquired, identifying the buyer and explaining how consumers can exercise their rights under the Act. This is a direct response to exactly the situation our earlier privacy piece described: when 23andMe went bankrupt in 2025, its genetic database changed hands through a court-supervised sale process that gave customers no advance say in the matter. This bill would not have prevented that sale, but it would have required 23andMe to tell its 15 million customers who was buying their data and how to get it deleted before the sale closed — not after.

Access, Deletion, and Enforcement

Beyond the acquisition notice, the bill would require covered companies to give consumers a simple, effective way to access their own genomic data, delete their account, and request destruction of their physical biological sample, along with clear disclosures explaining these rights up front. Violations would be enforced by the Federal Trade Commission as unfair or deceptive trade practices, and the FTC would have one year after enactment to issue implementing rules. Notably, the bill does not preempt state law, so a stricter state statute would still apply on top of it. That matters because state protection is currently a patchwork: Nebraska and Virginia enacted their own genetic privacy laws in 2025, while states like Ohio and Mississippi have none at all. A federal floor would apply everywhere; it just wouldn’t lower the ceiling where states have already gone further.

Died Once Already

This is not the bill’s first attempt either. Cassidy and Peters introduced an earlier version, S. 5433, in the 118th Congress on December 5, 2024. It was referred to committee and expired unpassed when that Congress ended, which is what necessitated the March 2025 reintroduction as S. 863. As of this writing, S. 863 has not had a committee hearing or markup scheduled in the Senate Commerce Committee — the same committee-limbo status as the American Genetic Privacy Act, just one chamber and one committee over.

For DFA Researchers

Of the three genetic-privacy bills we’ve now covered, this is the one that would actually change how FamilyTreeDNA, Ancestry, MyHeritage, and every other testing company you might use handles your data — not just their dealings with one foreign government. It’s also the one with the least momentum in Congress; a broad consumer-protection mandate with FTC rulemaking authority draws more industry opposition than a narrowly targeted foreign-adversary restriction, which is very likely why the China-specific bill keeps getting reintroduced while this one sits untouched. Until something like it passes, the honest answer is that a testing company can be sold, and your data sold with it, with whatever notice its own privacy policy happens to promise you — nothing more. That is worth checking today, not after the fact.

Sources

U.S. Congress. “S.863 – Genomic Data Protection Act.” Congress.gov. Introduced March 5, 2025. congress.gov.

Cassidy, Bill. “Cassidy, Peters Introduce Bill to Protect Americans’ DNA, National Security.” U.S. Senate press release. March 5, 2025. cassidy.senate.gov.

HIPAA Journal. “Bipartisan Genomic Data Protection Act Reintroduced in Senate.” hipaajournal.com.

Covington & Burling. “U.S. Senate Introduces Genomic Data Protection Act.” Inside Privacy. insideprivacy.com.

Covington & Burling. “Multiple States Enact Genetic Privacy Legislation in a Busy Start to 2025.” Inside Privacy. insideprivacy.com.

U.S. Congress. “S.5433 – Genomic Data Protection Act, 118th Congress.” Congress.gov. congress.gov.

Note: This post was researched and written with the assistance of artificial intelligence (AI). All content has been reviewed for accuracy as of September 2026. All errors are the responsibility of the author.