There's plenty of news coming out of the State House this summer — but I want to focus on a law that most Rhode Islanders probably haven't heard of, even though it directly concerns something more personal than a Social Security number: their DNA.
On June 19, Governor Dan McKee signed the Genetic Information Privacy Act (S2203), and it took effect immediately. If you've ever spit into a tube for 23andMe or AncestryDNA — or you're thinking about it — you now have enforceable rights over what happens to that data under Rhode Island law.
Here's the shape of the story: a national scare exposed a legal gap, and two Providence lawmakers spent two years writing that gap closed.
The scare was 23andMe. The company filed for bankruptcy in March 2025, putting the genetic data of more than 15 million people around the world into play as a bankruptcy asset. Senator Samuel Zurier, a Providence Democrat and the bill's Senate sponsor, began work on the legislation after news of 23andMe's financial troubles broke in September 2024. The company's data was ultimately sold for $305 million to TTAM Research Institute, a nonprofit created by 23andMe's own founder, which pledged to uphold existing privacy policies — an outcome Zurier described as a "catastrophe avoided by good luck."
Why was luck required? Because federal law barely touches this industry. HIPAA covers health care providers and insurers, not direct-to-consumer testing companies. The Genetic Information Nondiscrimination Act bars employers and health insurers from discriminating based on your genes — and, as University of Iowa law professor Anya Prince told reporters covering the bankruptcy, "that's pretty much it on the federal level."
So what does Rhode Island's law actually do? The mechanics matter here.
First, consent. Testing companies need explicit consent — consent that "cannot be inferred from inaction" — to collect, use, or disclose your genetic data, with separate consent required for storage, third-party sharing, and marketing.
Second, deletion. You can revoke consent, and once you do, the company has 30 days to destroy your biological samples.
Third, a ban on "dark patterns" — the manipulative interface tricks that nudge users into data-sharing choices they didn't intend to make.
Fourth, teeth. The Rhode Island Attorney General has exclusive enforcement authority, with civil penalties of up to $1,000 for negligent violations and $1,000 to $10,000 for willful ones — penalties paid to the affected consumer. One important precision: you can't sue a company directly under this statute. Your recourse runs through the Attorney General's office.
One could expect a story like this to feature industry lobbyists fighting the bill. It didn't happen. Ancestry.com submitted written testimony in support, according to the Rhode Island Current, with the company's head of government affairs pointing to a 2018 model for genetic-testing privacy best practices shaped by industry and advocates. The ACLU of Rhode Island backed the measure too, emphasizing in written testimony how much genetic data reveals — potential health risks, food preferences, ancestral origins. The votes reflected that consensus: 37-0 in the Senate, 69-0 in the House. 23andMe did not respond to the Rhode Island Current's request for comment ahead of the Senate vote.
That doesn't mean the law arrived easily. Zurier noted on the Senate floor that his first attempt passed the Senate in 2025 but died in the House Judiciary Committee. This year's version — co-sponsored in the House by Representative Edith Ajello, also a Providence Democrat — made it through. "Genetic data warrants protections similar to the rest of our personal medical information," Ajello said. "Rhode Islanders deserve to know if their data might be shared or sold, and they should be able to opt out or request that their information be deleted, particularly in cases where the entity holding it changes hands."
Some legal commentators argue laws like this mostly codify what large testing companies already do voluntarily — and note gaps, like what happens if genetic data ends up in the hands of a company that isn't a testing service at all. Fair points, worth watching. The law is only weeks old, and no enforcement actions have been reported yet.
Still, the change is real. According to legal analyses from Covington & Burling's Inside Privacy blog, Rhode Island is the fifth state to enact genetic privacy legislation in 2026, joining at least 13 states with similar laws — and it's the only New England state on the list. Zurier put the stakes plainly: "The privacy of our personal genetic data is only as good as the policies of the companies holding it, and those policies can change at a moment's notice."
That was the whole problem. As of June 19, in Rhode Island, it no longer takes good luck to avoid the catastrophe. It takes the law.