(a) A direct-to-consumer genetic testing company engaging in any of the following activities must obtain:
(1) an individual's separate express consent for:
(A) the transfer or disclosure of the individual's genetic data to any person other than the company's vendors and service providers;
(B) the use of genetic data for a purpose other than the primary purpose of the company's genetic testing product or service; or
(C) the retention of any biological sample provided by the individual following the company's completion of the initial testing service requested by the individual;
(2) an individual's informed consent in accordance with guidelines for the protection of human subjects issued under 45 C.F.R. Part 46, for transfer or disclosure of the individual's genetic data to a third party for:
(A) research purposes; or
(B) research conducted under the control of the company for the purpose of publication or generalizable knowledge; and
(3) an individual's express consent for:
(A) marketing by the company to the individual based on the individual's genetic data; or
(B) marketing by a third party to the individual based on the individual's ordering or purchasing of a genetic testing product or service.
(b) For purposes of Subsection (a), "marketing" does not include providing customized content or offers to an individual with whom a direct-to-consumer genetic testing company has a first-party relationship on the company's Internet website or through an application or service provided by the company to the individual.