A direct-to-consumer genetic testing company, at a minimum, shall obtain the following consents from a consumer before collecting, using, or disclosing the consumer’s genetic data:

(1) Initial express consent that clearly:

(i) Describes the uses of the genetic data collected through the genetic testing product or service; and

(ii) Specifies:

1. Who has access to the results of the genetic testing; and

2. How the genetic data may be shared;

(2) Express consent for transferring or disclosing the consumer’s genetic data to a person other than the company’s vendors and service providers;

(3) Express consent for using genetic data beyond the primary purpose of the genetic testing product or service requested by the consumer;

(4) Express consent for the retention of a biological sample provided by the consumer after the initial testing service requested by the consumer is completed;

(5) Express consent to be marketed to by:

(i) The direct-to-consumer genetic testing company based on the consumer’s genetic data; and

(ii) A third party based on the consumer having ordered or purchased a genetic testing product or service; and

(6) Informed consent in compliance with the federal policy for the protection of human research subjects for transfer or disclosure of the consumer’s genetic data to third parties for research purposes or research conducted under the control of the company for the purpose of publication or generalizable knowledge.