REQUIRED CONSENT.

(a) A direct-to-consumer genetic testing company engaging in any of the following activities must obtain:

(1) an individual's separate express consent for:

(A) the transfer or disclosure of the individual's genetic data to any person other than the company's vendors and service providers;

(B) the use of genetic data for a purpose other than the primary purpose of the company's genetic testing product or service; or

(C) the retention of any biological sample provided by the individual following the company's completion of the initial testing service requested by the individual;

(2) an individual's informed consent in accordance with guidelines for the protection of human subjects issued under 45 C.F.R. Part 46, for transfer or disclosure of the individual's genetic data to a third party for:

(A) research purposes; or

(B) research conducted under the control of the company for the purpose of publication or generalizable knowledge; and

(3) an individual's express consent for:

(A) marketing by the company to the individual based on the individual's genetic data; or

(B) marketing by a third party to the individual based on the individual's ordering or purchasing of a genetic testing product or service.

(b) For purposes of Subsection (a), "marketing" does not include providing customized content or offers to an individual with whom a direct-to-consumer genetic testing company has a first-party relationship on the company's Internet website or through an application or service provided by the company to the individual.