The American Genetic Privacy Act of 2025 bans the sale and disclosure of genetic information to the People’s Republic of China and to entities under PRC influence or ownership. It targets two pathways: the sale or offer to sell covered information, and disclosures by commercial DNA testing services.
The bill assigns enforcement to the Federal Trade Commission, treating violations as unfair or deceptive acts or practices under the FTC Act. It also establishes specific definitions to anchor what counts as genetic information, a genetic test, and what constitutes a commercial DNA testing service.
At a Glance
What It Does
The bill prohibits selling or offering to sell covered information to the PRC or PRC-controlled entities and prohibits disclosures by commercial DNA testing services to the PRC or PRC-controlled entities.
Who It Affects
It directly affects US-based commercial DNA testing services and any entities tied to the PRC, as well as consumers who have genetic data collected through these services.
Why It Matters
It sets a federal privacy guardrail for genetic data, reducing foreign access risk and signaling a higher standard for how genetic information can be shared or monetized.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The act creates a federal prohibition on the cross-border flow of genetic information captured through consumer DNA testing. It makes it illegal to sell or offer to sell covered information to the PRC or any entity under PRC influence or ownership, and it also bars disclosures by commercial DNA testing services to the PRC or PRC-controlled entities.
Enforcement rests with the Federal Trade Commission, which will treat violations as unfair or deceptive practices and apply the FTC Act’s penalties and remedies. The bill then defines key terms—what counts as a commercial DNA testing service, what qualifies as covered information, and what is meant by a genetic test—using the Genetic Information Nondiscrimination Act of 2008 for the genetic-test standard.
In short, the bill aims to prevent Americans’ genetic data from being shared with or sold to China through consumer DNA testing channels, while establishing a clear enforcement and definitional framework for industry compliance.
The Five Things You Need to Know
The bill prohibits selling or offering for sale covered information to the PRC or PRC-affiliated entities.
No commercial DNA testing service may disclose covered information to the PRC or PRC-affiliated entities.
Violations are enforceable as unfair or deceptive acts under the FTC Act.
Covered information is genetic information originally obtained through a commercial DNA testing service.
A genetic test is defined by the Genetic Information Nondiscrimination Act of 2008 (GINA).
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Short title
The act may be cited as the American Genetic Privacy Act of 2025. This establishes the framework name and scope for all subsequent provisions.
Sale prohibitions
No individual or entity may sell or offer for sale covered information to the PRC or to any entity under the PRC’s influence, control, or ownership. This creates a hard boundary on monetization or transfer of genetic data sourced from consumer testing within the U.S. market.
Disclosures by commercial DNA testing services
No commercial DNA testing service may disclose covered information to the PRC or to any entity under PRC influence, control, or ownership. The prohibition extends to disclosed data irrespective of the data’s aggregate form, reinforcing strict limitations on cross-border sharing.
Enforcement by FTC
The FTC is tasked with enforcing these prohibitions in the same manner as it enforces unfair or deceptive acts or practices under the FTC Act. Violators face the same powers, duties, and penalties as those statutes, ensuring a federal compliance regime with typical consumer-protection remedies.
Definitions
Definitions establish what counts as a commercial DNA testing service (providers of genealogical or ancestry-related information), what constitutes covered information (genetic information originally acquired via such services), what genetic information includes, and how a genetic test is defined (per GINA, 42 U.S.C. 3000ff). These definitions anchor the bill’s reach and enforceability.
This bill is one of many.
Codify tracks hundreds of bills on Privacy across all five countries.
Explore Privacy in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Consumers who used or may use consumer DNA testing services gain stronger protections against unknown cross-border data sharing with PRC-linked entities.
- US-based genetic testing companies that comply with the act gain a clearer, domestic data-privacy framework and reduced risk of foreign data exposure.
- Privacy regulators and consumer-protection advocates gain a concrete tool to curb cross-border genetic data transfers and enforce privacy standards.
Who Bears the Cost
- DNA testing companies must implement compliance measures, auditing, and data-handling controls to prevent prohibited disclosures.
- Data processors and partners handling genetic data must adjust workflows to avoid PRC-linked disclosures and sales.
- Researchers and institutions relying on multi-national data partnerships may face new restrictions or need to reconfigure data-sharing agreements to stay compliant.
- Companies with existing cross-border data-sharing arrangements may incur transition costs to re-structure data flows.
Key Issues
The Core Tension
Balancing Americans’ genetic privacy with the realities of global data sharing and research; the bill protects against foreign access while potentially constraining beneficial data partnerships and rapid data processing that rely on cross-border collaboration.
The act introduces a privacy constraint with a focused scope: it governs only “covered information” originally obtained through a commercial DNA testing service and only with respect to transfers to PRC or PRC-controlled entities. It does not explicitly address genetic data created in clinical or hospital settings, nor data that flows through non-commercial channels.
This narrow scope may be deliberate to minimize overreach, but it leaves questions about how and when data previously shared with foreign affiliates would be treated if streams were later severed. Enforcement relies on the FTC, which raises concerns about the definitional clarity around what constitutes a PRC-influenced entity and how to verify cross-border ownership or control.
These ambiguities could complicate compliance and dispute resolution, especially for multinational data service providers and research collaborations.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.