Data Ownership and Consent in Direct-to-Consumer Genetic Testing

Abstract

Direct-to-consumer (DTC) genetic testing has built some of the largest genomic databases in existence outside clinical or research infrastructure, governed largely by consumer terms-of-service agreements rather than the informed-consent standards applied to clinical or research genomics. This review examines the unresolved legal status of ownership over DTC genetic data, the empirical
evidence on how customers actually understand what they have consented to, and the secondary uses -- research partnerships, corporate sale, and law-enforcement access -- that original consent language only loosely anticipated. It then turns to a problem distinctive to genetic data: because a single person's test result also reveals information about parents, siblings, children, and more distant relatives, individual consent structurally cannot protect the interests of the family members a test simultaneously implicates.
We survey recent state-level legislative responses and the scholarly debate over property-based versus privacy-based frameworks for genetic data, finding neither fully adequate on its own. We conclude that closing the gap between DTC consent's formal structure and its practical substance will require purpose-built genetic-privacy regulation, consent language specific enough to cover known
secondary uses, and some structural acknowledgment of relatives' interests that does not depend solely on a customer's voluntary disclosure.