CONSUMER GENETIC TARGETING: LEGAL REGULATION, PRIVACY AND CONSUMER PROTECTION

1. INTRODUCTION

Consumer genetic targeting refers to the collection, analysis, profiling, and commercial use of genetic information to target individuals with personalised products, services, advertisements, health recommendations, insurance offers, or other commercial opportunities. It commonly arises through direct-to-consumer (DTC) DNA testing, ancestry services, nutrigenomics, genetic wellness platforms, and personalised medicine businesses.

Genetic information is particularly sensitive because it may reveal inherited disease risks, biological relationships, ancestry, and information about relatives who never consented to testing. The principal legal concerns include informed consent, misleading health claims, unauthorised data sharing, discriminatory profiling, cybersecurity, and the commercial exploitation of biological information.

There is no single universally applicable statute entitled the “Consumer Genetic Targeting Regulation Law.” Instead, the activity is regulated through data-protection legislation, consumer-protection laws, medical-device requirements, genetic-discrimination legislation, and contractual obligations. The applicable framework depends on the jurisdiction and the nature of the service.

2. LEGAL FRAMEWORK IN INDIA

A. DIGITAL PERSONAL DATA PROTECTION ACT, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act), together with the Digital Personal Data Protection Rules, 2025, notified in November 2025, provides an important framework for digital personal data processing in India. Its application must be assessed according to the operative provisions, commencement notifications, and applicable exemptions.

A genetic-testing business processing identifiable genetic results must examine its obligations concerning lawful processing, notice, consent where required, data security, individual rights, and disclosure to third parties. The Act does not create a separate, comprehensive statutory category of genetic data equivalent to the European Union's special-category regime. Consequently, businesses should not assume that genetic information automatically receives every protection available under foreign genetic-privacy legislation.

B. INFORMATION TECHNOLOGY ACT, 2000

Section 43 and Section 66 may apply to unauthorised access, extraction, damage, or other qualifying computer-related conduct. Section 43A historically addressed compensation for failure to protect sensitive personal data or information, subject to its statutory conditions and the applicable legal position following subsequent amendments and commencement of replacement provisions.

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, also require consideration where applicable. Their treatment of genetic information and the relationship with the later data-protection framework should be evaluated for the particular processing activity.

C. CONSUMER PROTECTION ACT, 2019

The Consumer Protection Act, 2019, is relevant where genetic-testing businesses make misleading representations about test accuracy, disease prediction, scientific validation, or commercial benefits.

False assurances about genetic privacy, undisclosed recurring charges, misleading product claims, and unfair contractual terms may raise consumer-protection issues. The Central Consumer Protection Authority can exercise statutory powers against covered unfair trade practices and misleading advertisements.

D. CONSTITUTIONAL PRIVACY

In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), the Supreme Court recognised privacy as a fundamental right under Article 21 and other applicable constitutional guarantees. This principle is relevant when evaluating the privacy interests implicated by the collection, processing, and disclosure of genetic information.

However, the constitutional judgment does not itself establish a complete commercial licensing regime for every private genetic-testing company. The precise statutory remedies depend on the circumstances and applicable legislation.

3. INTERNATIONAL REGULATORY APPROACHES

A. EUROPEAN UNION

The General Data Protection Regulation (GDPR), particularly Articles 4(13), 9, 13–14, 22, and 32, is relevant to genetic profiling. Genetic data is expressly recognised as a special category of personal data. Its processing is generally prohibited unless an applicable Article 9 exception is satisfied, alongside the other requirements of the GDPR.

Where applicable, Article 22 addresses certain decisions based solely on automated processing that produce legal or similarly significant effects. It does not prohibit every form of personalised advertising or automated genetic analysis.

B. UNITED STATES

The Federal Trade Commission Act prohibits unfair or deceptive commercial practices. The Federal Trade Commission (FTC) has acted against genetic-testing businesses over inadequate security, misleading privacy assurances, and improper changes to privacy practices.

The Genetic Information Nondiscrimination Act of 2008 (GINA) restricts specified uses of genetic information in employment and health insurance. It does not provide a universal prohibition on every form of genetic targeting and does not generally extend its federal protections to life, disability, or long-term-care insurance in the same way.

The Health Insurance Portability and Accountability Act (HIPAA) applies to covered entities and business associates within its scope; a direct-to-consumer testing company is not automatically covered merely because it handles genetic or health information.CONSUMER GENETIC TARGETING: LEGAL REGULATION, PRIVACY AND CONSUMER PROTECTION

1. INTRODUCTION

Consumer genetic targeting refers to the collection, analysis, profiling, and commercial use of genetic information to target individuals with personalised products, services, advertisements, health recommendations, insurance offers, or other commercial opportunities. It commonly arises through direct-to-consumer (DTC) DNA testing, ancestry services, nutrigenomics, genetic wellness platforms, and personalised medicine businesses.

Genetic information is particularly sensitive because it may reveal inherited disease risks, biological relationships, ancestry, and information about relatives who never consented to testing. The principal legal concerns include informed consent, misleading health claims, unauthorised data sharing, discriminatory profiling, cybersecurity, and the commercial exploitation of biological information.

There is no single universally applicable statute entitled the “Consumer Genetic Targeting Regulation Law.” Instead, the activity is regulated through data-protection legislation, consumer-protection laws, medical-device requirements, genetic-discrimination legislation, and contractual obligations. The applicable framework depends on the jurisdiction and the nature of the service.

2. LEGAL FRAMEWORK IN INDIA

A. DIGITAL PERSONAL DATA PROTECTION ACT, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act), together with the Digital Personal Data Protection Rules, 2025, notified in November 2025, provides an important framework for digital personal data processing in India. Its application must be assessed according to the operative provisions, commencement notifications, and applicable exemptions.

A genetic-testing business processing identifiable genetic results must examine its obligations concerning lawful processing, notice, consent where required, data security, individual rights, and disclosure to third parties. The Act does not create a separate, comprehensive statutory category of genetic data equivalent to the European Union's special-category regime. Consequently, businesses should not assume that genetic information automatically receives every protection available under foreign genetic-privacy legislation.

B. INFORMATION TECHNOLOGY ACT, 2000

Section 43 and Section 66 may apply to unauthorised access, extraction, damage, or other qualifying computer-related conduct. Section 43A historically addressed compensation for failure to protect sensitive personal data or information, subject to its statutory conditions and the applicable legal position following subsequent amendments and commencement of replacement provisions.

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, also require consideration where applicable. Their treatment of genetic information and the relationship with the later data-protection framework should be evaluated for the particular processing activity.

C. CONSUMER PROTECTION ACT, 2019

The Consumer Protection Act, 2019, is relevant where genetic-testing businesses make misleading representations about test accuracy, disease prediction, scientific validation, or commercial benefits.

False assurances about genetic privacy, undisclosed recurring charges, misleading product claims, and unfair contractual terms may raise consumer-protection issues. The Central Consumer Protection Authority can exercise statutory powers against covered unfair trade practices and misleading advertisements.

D. CONSTITUTIONAL PRIVACY

In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), the Supreme Court recognised privacy as a fundamental right under Article 21 and other applicable constitutional guarantees. This principle is relevant when evaluating the privacy interests implicated by the collection, processing, and disclosure of genetic information.

However, the constitutional judgment does not itself establish a complete commercial licensing regime for every private genetic-testing company. The precise statutory remedies depend on the circumstances and applicable legislation.

3. INTERNATIONAL REGULATORY APPROACHES

A. EUROPEAN UNION

The General Data Protection Regulation (GDPR), particularly Articles 4(13), 9, 13–14, 22, and 32, is relevant to genetic profiling. Genetic data is expressly recognised as a special category of personal data. Its processing is generally prohibited unless an applicable Article 9 exception is satisfied, alongside the other requirements of the GDPR.

Where applicable, Article 22 addresses certain decisions based solely on automated processing that produce legal or similarly significant effects. It does not prohibit every form of personalised advertising or automated genetic analysis.

B. UNITED STATES

The Federal Trade Commission Act prohibits unfair or deceptive commercial practices. The Federal Trade Commission (FTC) has acted against genetic-testing businesses over inadequate security, misleading privacy assurances, and improper changes to privacy practices.

The Genetic Information Nondiscrimination Act of 2008 (GINA) restricts specified uses of genetic information in employment and health insurance. It does not provide a universal prohibition on every form of genetic targeting and does not generally extend its federal protections to life, disability, or long-term-care insurance in the same way.

The Health Insurance Portability and Accountability Act (HIPAA) applies to covered entities and business associates within its scope; a direct-to-consumer testing company is not automatically covered merely because it handles genetic or health information.4. RELEVANT CASE LAWS

The following cases and enforcement proceedings illustrate judicial and regulatory principles relevant to consumer genetic targeting. Some are direct authorities on genetic-data privacy or commercial genetic testing; others are analogous authorities concerning privacy, bodily autonomy, and personal-data protection.

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1

Authority: Direct constitutional authority on privacy in India.

The Supreme Court recognised privacy as a fundamental right, including informational privacy and individual autonomy. The judgment provides a constitutional foundation for scrutinising intrusive collection and use of personal information.

Application: Genetic-testing businesses should consider whether their collection, disclosure, and commercial use of genetic information respect privacy and applicable legal requirements. The judgment does not independently create a detailed licensing system for genetic-marketing companies.

2. District Registrar and Collector v. Canara Bank (2005) 1 SCC 496

Authority: Analogous Indian authority on privacy and access to personal records.

The Supreme Court examined privacy concerns arising from access to private documents and emphasised the importance of protecting personal information against unjustified intrusion.

Application: The principles are relevant when considering unauthorised access to genetic reports, biological records, or confidential information held by testing providers.

3. Suchita Srivastava v. Chandigarh Administration (2009) 9 SCC 1

Authority: Analogous Indian authority on bodily autonomy.

The Supreme Court recognised reproductive autonomy as an aspect of personal liberty under Article 21.

Application: The decision supports the broader importance of individual autonomy in decisions involving the body and reproductive matters. It does not directly decide whether a private company may use genetic data for targeted advertising, so its relevance is limited to the underlying autonomy principle.

4. FTC v. 1Health.io Inc. (formerly Vitagene), FTC Matter No. 1923170 (2023)

Authority: Direct regulatory enforcement concerning consumer genetic information.

The FTC alleged that the company exposed genetic and health information through inadequate cloud security, misrepresented its data-deletion practices, and expanded permitted third-party sharing without appropriate notice and consent. The resulting consent-order process imposed privacy and security obligations. The matter is an administrative enforcement proceeding, not a conventional judicial precedent. <Cite refs={["turn782232search6","turn782232search12"]}/>

Application: Companies should accurately describe their security practices, explain what deletion covers, and obtain the required consent before materially expanding commercial uses of previously collected genetic data.

5. Association for Molecular Pathology v. Myriad Genetics, Inc., 569 U.S. 576 (2013)

Authority: Analogous United States Supreme Court authority on genetic material and biotechnology.

The Supreme Court held that naturally occurring DNA is not patent-eligible merely because it has been isolated, while synthetically created complementary DNA may be patent-eligible subject to the Court's reasoning.

Application: The judgment is relevant to the distinction between biological material and human-created biotechnology. It does not establish a general ownership right over personal genetic information or directly regulate genetic advertising.

6. Moore v. Regents of the University of California, 51 Cal. 3d 120 (1990)

Authority: Analogous United States authority on biological samples, research, and disclosure.

The California Supreme Court rejected Moore's conversion claim concerning his excised cells but allowed certain informed-consent and fiduciary-duty claims to proceed.

Application: The case demonstrates the legal distinction between ownership claims over biological material and obligations to disclose relevant research or commercial interests. It does not establish that companies have unrestricted permission to exploit consumer genetic information.

5. KEY COMPLIANCE REQUIREMENTS

Businesses conducting consumer genetic targeting should implement the following measures:

Informed consent: Explain the purpose of testing, intended analyses, commercial uses, and optional research participation in clear language.

Purpose limitation: Do not assume that consent to genetic testing automatically authorises targeted advertising, pharmaceutical partnerships, or data brokerage.

Transparent marketing: Substantiate claims about disease prediction, nutrition, ancestry, and clinical accuracy with appropriate scientific evidence.

Data minimisation: Collect and retain only information reasonably required for disclosed and lawful purposes.

Security controls: Apply access restrictions, encryption, incident response, and appropriate vendor oversight.

Deletion procedures: Explain separately how consumers can request deletion of digital results and destruction of physical samples, subject to lawful retention requirements.

Non-discrimination: Assess applicable laws before using genetic information in employment, insurance, eligibility, or other consequential decisions.

Third-party disclosure: Identify recipients and explain whether information is shared for research, service delivery, advertising, or commercial licensing.

Children's data: Apply the relevant child-protection and parental-consent requirements.

Cross-border transfers: Assess the applicable transfer restrictions and legal obligations before disclosing genetic information internationally.

These safeguards are particularly important because genetic information may permit re-identification even when conventional identifiers have been removed. The US National Human Genome Research Institute discusses this risk in its guidance on genomic privacy.

6. CONCLUSION

Consumer genetic targeting creates a legal intersection between biotechnology, privacy, consumer protection, commercial advertising, and anti-discrimination law. The central regulatory objective is to ensure that consumers understand how their genetic information is collected and used, that businesses make scientifically supportable claims, and that personal information is not exploited through deceptive or unauthorised practices.

In India, constitutional privacy principles, the DPDP Act and applicable rules, consumer-protection legislation, and relevant information-technology provisions provide important elements of the framework. In the United States and European Union, additional requirements may arise under the FTC Act, GINA, HIPAA where applicable, and the GDPR.

The cited cases demonstrate important principles but do not collectively establish a single, comprehensive genetic-targeting statute. Effective compliance therefore requires a jurisdiction-specific assessment of consent, commercial purpose, scientific validity, data security, and the legal consequences of genetic profiling.