Direct-to-Consumer Genetic Tests: FDA, FTC, Privacy, Clinical Validity, and Claims Control
Guide to regulatory, privacy, and commercial risks for DTC genetic tests, including FDA oversight, FTC claim substantiation, clinical validity, GINA, state privacy laws, and risk-report claims.
The DTC Genetic Testing Landscape in 2026
Direct-to-consumer genetic testing has undergone a dramatic regulatory arc. In 2013, FDA ordered 23andMe to stop marketing its Personal Genome Service (PGS) for lacking evidence of analytical and clinical validity. By 2015, FDA authorized the first DTC genetic test (Bloom Syndrome carrier status) as a Class II device with special controls. In 2025, 23andMe filed for Chapter 11 bankruptcy, and its genetic database — covering over 15 million users — was acquired by TTAM Research Institute (a non-profit founded by former CEO Anne Wojcicki) for $305 million, raising profound questions about data ownership, consent, and privacy in bankruptcy proceedings.
Meanwhile, the state-level legislative landscape is accelerating rapidly. In 2025–2026, Utah (HB 182), South Dakota (SB 49, effective July 1, 2026), Indiana (HB 1521), and Montana (SB 163) enacted new genetic privacy laws. At the federal level, the Genomic Data Protection Act (GDPA) was introduced in Congress in March 2025, and the "Don't Sell My DNA Act" followed in May 2025 to address genetic data treatment in bankruptcy.
This guide covers the full regulatory, commercial, and privacy risk landscape for DTC genetic testing companies: FDA authorization pathways, the wellness vs. medical claims boundary, analytical and clinical validity, privacy obligations, FTC advertising requirements, and practical guidance on claims that trigger (or avoid) regulatory scrutiny.
FDA Oversight of DTC Genetic Tests
Regulatory Framework
FDA regulates DTC genetic tests as in vitro diagnostic (IVD) devices. The specific requirements depend on the risk classification and the claims made:
| Claim Category | FDA Pathway | Examples |
|---|---|---|
| General wellness / ancestry | Enforcement discretion (not reviewed) | Ancestry composition, trait reports (eye color, earwax type) |
| Carrier status | De Novo / 510(k) with special controls | Bloom syndrome, cystic fibrosis carrier status |
| Genetic health risk | De Novo / 510(k) with special controls | Late-onset Alzheimer's risk, Parkinson's risk, BRCA 1/2 mutations |
| Pharmacogenomic | Premarket review required | Drug metabolism predictions (CYP2C19, CYP2D6) |
| Diagnostic | PMA or De Novo | Disease diagnosis (e.g., hereditary cancer diagnosis) |
FDA Authorization History for 23andMe DTC Tests
| Authorization | Date | Device | Regulation |
|---|---|---|---|
| DEN140044 | February 2015 | Bloom Syndrome carrier status (first DTC genetic test) | De Novo → Class II, special controls |
| DEN160002 | April 2017 | Genetic health risk reports (10 conditions) | De Novo → Class II, special controls |
| K163458 | November 2017 | Additional carrier status reports | 510(k) cleared |
| DEN170045 | March 2018 | BRCA1/2 (3 mutations) risk reports | De Novo → Class II, special controls |
| DEN180028 | January 2019 | Pharmacogenomic reports (8 genes) | De Novo → Class II, special controls |
FDA's Assessment Criteria for DTC Tests
When reviewing DTC genetic tests, FDA evaluates:
Analytical validity: Can the test accurately detect the genetic variants it claims to detect? (Typically ≥ 99% accuracy and ≥ 99% reproducibility required for authorized DTC tests)
Clinical validity: Is there evidence that the detected variants are associated with the health condition claimed?
User comprehension: Can consumers understand the test results, limitations, and appropriate next steps without clinical guidance?
Labeling adequacy: Is the result report written in plain language that consumers can understand?
The Wellness vs. Medical Claims Boundary
How Claims Determine Regulatory Status
The single most important factor determining whether a DTC genetic test is regulated by FDA is the claims made about the test's purpose and output. FDA evaluates the "intended use" based on labeling, advertising, and promotional materials:
| Claim Language | Regulatory Status | Why |
|---|---|---|
| "Reports your genetic ancestry composition" | Not regulated as IVD by FDA | Wellness/recreational, no medical claim |
| "Identifies genetic variants associated with bitter taste perception" | Not regulated | Trait report, no health implication |
| "Indicates whether you carry a variant associated with higher risk of developing late-onset Alzheimer's disease" | FDA-regulated (Class II) | Health risk prediction |
| "Reports if you have BRCA1/2 mutations that increase breast cancer risk" | FDA-regulated (Class II) | Disease risk prediction |
| "Predicts your response to specific medications" | FDA-regulated (premarket review required) | Pharmacogenomic claim |
| "Diagnoses hereditary cancer syndrome" | FDA-regulated (Class III likely) | Diagnostic claim |
Practical Claims Control Framework
DTC companies must implement a claims review process that evaluates every marketing statement, product description, report language, and customer communication:
Pre-publication review: All marketing materials, website copy, and report language reviewed by regulatory affairs
Claims categorization: Each claim categorized as wellness, risk, or diagnostic
Evidence mapping: Medical/risk claims mapped to FDA authorization or published clinical evidence
Customer support scripts: Call center and chat scripts must not make unauthorized claims
Social media monitoring: User-generated content and influencer posts that make unauthorized claims must be addressed
Claims That Changed Regulatory Status: Case Examples
| Company | Original Position | FDA Action | Outcome |
|---|---|---|---|
| 23andMe (2013) | Marketed PGS with health risk reports without authorization | Warning letter (November 2013) — cease marketing | Suspended health reports; subsequently obtained De Novo authorizations |
| Pathway Genomics (2010) | Planned OTC sale of genetic test kits via Walgreens | FDA letter stating product was an unapproved medical device | Walgreens partnership cancelled; company shifted to provider-ordered model |
| Multiple companies (2024–2025) | Pharmacogenomic DTC tests predicting drug response | FDA safety communication — no DTC pharmacogenetic tests authorized for specific drug response | Companies must obtain premarket review or modify claims |
Analytical and Clinical Validity Requirements
Analytical Validity
FDA requires DTC genetic tests to demonstrate analytical validity through:
| Parameter | Requirement | Typical Standard |
|---|---|---|
| Accuracy | Concordance with orthogonal method | ≥ 99% genotype concordance |
| Precision (repeatability) | Within-run and between-run reproducibility | ≥ 99% concordance |
| Limit of detection | Minimum DNA input, variant detection at low allele frequency | Specified per platform |
| Analytical specificity | Interference, cross-reactivity, population-specific performance | No false positives from known interferents |
| Specimen type validation | Saliva (Oragene Dx) or other self-collected specimen | Validated collection device and transport conditions |
Clinical Validity
Clinical validity requires evidence that the genetic variant(s) detected are associated with the health condition or trait claimed:
| Evidence Source | Strength | FDA Acceptance |
|---|---|---|
| Well-established variant-disease associations (e.g., BRCA1/2, CFTR ΔF508) | Strong | Peer-reviewed literature sufficient |
| Professional society guidelines (e.g., ACMG, NCCN) | Strong | Referenced in special controls |
| Genome-wide association studies (GWAS) | Moderate to weak | May require additional evidence for clinical validity |
| Proprietary risk algorithms | Variable | Must be validated and disclosed to FDA |
| Limited population studies | Weak | Generally insufficient without confirmation |
The Problem of Population Bias
A critical clinical validity concern for DTC genetic tests is that many genetic associations were discovered predominantly in European-ancestry populations:
Polygenic risk scores derived from European-ancestry GWAS data have reduced predictive accuracy in other populations
Some variants are population-specific and may not be detected by panels designed for European-ancestry populations
DTC companies must disclose population-specific performance limitations in labeling
Privacy and Data Protection
Federal Privacy Landscape
| Law | Coverage | Gaps for DTC Genetic Data |
|---|---|---|
| HIPAA | Covered entities (healthcare providers, insurers, clearinghouses) | DTC companies are not covered entities unless acting on behalf of one |
| GINA (Genetic Information Nondiscrimination Act) | Prohibits genetic discrimination in health insurance and employment | Does not cover life, disability, or long-term care insurance |
| FTC Act (Section 5) | Unfair or deceptive trade practices | Enforcement after the fact; no proactive privacy requirements |
| No comprehensive federal genetic privacy law | — | Major gap; states are filling the void |
State Genetic Privacy Laws (2025–2026)
| State | Law | Key Provisions | Effective Date |
|---|---|---|---|
| Utah | HB 182 | Restricts "foreign adversary" access to genetic sequencing data; storage requirements | January 1, 2028 |
| South Dakota | SB 49 | Regulates DTC genetic testing companies; consent, disclosure, data rights | July 1, 2026 |
| Indiana | HB 1521 | DTC genetic testing provider framework; prohibits genetic discrimination | May 6, 2025 (immediate) |
| Montana | SB 163 | Expands Genetic Information Privacy Act; includes neurotechnology data | 2025 |
| Connecticut | HB 5128 (proposed) | Consumer property right in biological sample and genetic test results | Pending |
| Rhode Island | S 2203 / H 7639 (proposed) | DTC genetic testing company regulation; express consent required | Pending |
| Illinois | SB 2994 (proposed) | Amends Genetic Information Privacy Act to include neurotechnology | January 1, 2027 (proposed) |
Federal Legislative Proposals
| Bill | Status | Key Provisions |
|---|---|---|
| Genomic Data Protection Act (GDPA) | Introduced March 2025; referred to committee | Focuses on DTC genomic testing company privacy practices |
| Don't Sell My DNA Act | Introduced May 2025 | Amends Bankruptcy Code to require consumer notice and consent before genetic data is sold/transferred in bankruptcy |
The 23andMe Bankruptcy Precedent
The 23andMe bankruptcy (Chapter 11, filed 2025) established critical precedents for genetic data in corporate transactions:
Customer database as asset: The genetic database of 15+ million users was treated as a corporate asset subject to sale
Consent concerns: Customers who consented to research use of their data did not necessarily consent to transfer of that data to a new entity
"Free and clear" sale: Bankruptcy sales typically transfer assets free of existing encumbrances, potentially overriding prior privacy commitments
State intervention: Multiple state attorneys general and consumer advocacy groups filed objections
Resolution: TTAM Research Institute (non-profit led by Anne Wojcicki) acquired assets for $305 million, with commitments to honor existing privacy policies
Legislative response: The "Don't Sell My DNA Act" was introduced in direct response to this case
DOJ Bulk Data Rule
The Department of Justice's "Bulk Data Rule" (effective April 8, 2025) adds a significant compliance layer for companies handling genetic data. The rule restricts — and in some cases prohibits — certain data transfers and transactions involving large volumes of Americans' sensitive personal data, including genetic information, to "countries of concern" and "covered persons." DTC genetic testing companies must assess whether their data storage, processing, and transfer practices comply with these restrictions.
GDPR and EU Data Protection
For DTC genetic testing companies operating in the EU:
Genetic data is "special category" personal data under GDPR Article 9
Explicit consent is required for processing (Article 9(2)(a))
Right to erasure applies (Article 17) — but practical deletion of genetic data from research databases is complex
Data Protection Impact Assessment (DPIA) is mandatory
Cross-border data transfer restrictions (Chapter V) apply to companies processing EU resident data outside the EU
FTC Advertising and Claims Substantiation
FTC Authority Over DTC Genetic Testing
The Federal Trade Commission has authority over deceptive advertising for DTC genetic tests under Section 5 of the FTC Act. Key enforcement principles:
Claims must be substantiated: Any health, risk, or diagnostic claim must be supported by competent and reliable scientific evidence
Material omissions are deceptive: Failing to disclose significant limitations (e.g., "this test detects only 3 of thousands of known BRCA mutations") is a deceptive practice
Testimonials and endorsements: Customer testimonials must reflect typical results and disclose material connections
Claims That Trigger FTC Scrutiny
| Claim Type | FTC Risk | Mitigation |
|---|---|---|
| "Predicts your risk of developing cancer" | High — requires clinical evidence | Cite FDA authorization and published evidence |
| "Personalized nutrition plan based on your DNA" | Moderate — may lack substantiation | Disclose limited evidence base |
| "Find out what medications work best for you" | High — FDA has authorized no DTC pharmacogenetic tests for specific drug response | Avoid specific drug-response claims |
| "Understand your genetic blueprint" | Low — vague, non-medical | Ensure not implied as diagnostic |
| "Used by millions of satisfied customers" | Moderate — must reflect typical results | Disclose methodology and limitations |
Regulatory Strategy Checklist for DTC Genetic Testing
| Step | Action | Regulatory Reference |
|---|---|---|
| 1 | Audit all claims (marketing, reports, customer communications) | FDA intended use framework; FTC Section 5 |
| 2 | Categorize claims: wellness / carrier status / health risk / pharmacogenomic / diagnostic | FDA DTC test framework |
| 3 | Determine FDA pathway for each regulated claim category | 21 CFR 862–892; De Novo / 510(k) |
| 4 | Conduct analytical validation studies | CLSI guidelines; FDA analytical studies guidance |
| 5 | Compile clinical validity evidence | Peer-reviewed literature; professional society guidelines |
| 6 | Conduct user comprehension studies | FDA DTC test user comprehension guidance |
| 7 | Prepare premarket submission (eSTAR for 510(k)/De Novo) | FDA eSTAR |
| 8 | Implement privacy compliance program (state + federal) | GINA; state genetic privacy laws; GDPR (EU) |
| 9 | Establish FTC-compliant advertising review process | FTC Section 5; FTC health claims guidance |
| 10 | Monitor legislative developments (state + federal) | Track state bills; federal GDPA and Don't Sell My DNA Act |
Key Takeaways
Claims determine regulatory status: a DTC genetic test's regulatory classification depends entirely on the claims made about its purpose and output, not the underlying technology.
FDA has authorized specific categories of DTC genetic tests (carrier status, health risk, pharmacogenomics) but has not authorized any DTC pharmacogenetic test for predicting response to specific therapeutic drugs.
The 23andMe bankruptcy established that genetic databases are corporate assets subject to sale in bankruptcy, potentially overriding customer consent — the "Don't Sell My DNA Act" was introduced in direct response.
State genetic privacy laws are proliferating rapidly: Utah, South Dakota, Indiana, and Montana enacted new laws in 2025, with several more states proposing legislation in 2026.
GINA protects against genetic discrimination in health insurance and employment but does not cover life, disability, or long-term care insurance — a gap that DTC consumers may not understand.
FTC advertising requirements apply in parallel with FDA regulation: even if a test is FDA-authorized, marketing claims must be substantiated and material limitations must be disclosed.