Avoid Illinois Genetic Privacy Lawsuits With Training, Consent

The Illinois Genetic Information Privacy Act, which regulates collection and use of genetic information, has become a darling of the plaintiff bar. With provisions allowing statutory damages of $2,500 to $15,000 depending on negligence, intention, or recklessness, as well as attorneys’ fees, plaintiffs have filed dozens of cases within the last few years.

Many GIPA cases are brought as class actions, and common targets include insurance companies, employers who consider health information in their hiring process, and genetic information testing companies.

Given the statutory damages that may be available, the potential exposure can be immense. Companies should carefully assess whether they may be targets and mitigate risk accordingly.

GIPA lawsuits primarily are brought under three subsections.

Section 15(a). This states that genetic testing “may be released only to the individual tested and to persons specifically authorized.” Section 15(a) claims are commonly filed against genetic testing companies, alleging unauthorized disclosure. One example is Carter v. MyHeritage, Inc., where consumers of MyHeritage’s genetic testing kits sued, claiming MyHeritage transmitted genetic information to third parties without consent, allowing for targeted advertisements. Briefing recently concluded on MyHeritage’s motion to compel arbitration.

Section 20(b). This provides that insurers can’t disclose or use genetic information “for underwriting purposes.” While health insurers generally haven’t been the subject of 20(b) claims, some cases have targeted life insurers, even though two federal courts in Illinois generally have agreed GIPA doesn’t apply to life insurers: Thompson v. Prudential Life Ins. Co. of Am. in March 2025 and Anderson v. American Life Ins. Company in November 2024. In December, the Illinois Appellate Court in Reynolds v. State Farm Life Ins. Co. held 20(b) doesn’t apply to life insurers.

Section 25(c)(1). This states that an employer, neither directly nor indirectly, shall “solicit, request, require or purchase genetic testing or genetic information” as an employment condition. Most 25(c)(1) complaints allege defendants solicit job applicants’ medical history through a third party conducting physical exams.
Some cases have survived motions to dismiss, including:

Foster v. Service Sanitation, Inc. The US District Court in the Northern District of Illinois in August acknowledged a developing split, with defendants arguing GIPA should be limited to information “someone could use to determine the applicant’s likelihood to develop a genetic disease.” A broader reading held it encompasses any “request for family medical history.”

The court denied the motion to dismiss, embracing the broader interpretation. It also held the defendant could be liable for actions of third-party medical examiners and found GIPA can apply to non-Illinois residents for acts in Illinois.

Short v. MV Transp., Inc. The defendant claimed federal regulations for drivers’ physical qualifications preempted GIPA, but the Northern District disagreed and denied the motion to dismiss in March, finding federal regulations didn’t require soliciting medical history.

Collins v. NTN Bearing Corp. of America. The defendant used a third-party provider to conduct physical exams as part of its job application process, which collected information related to prospective employees’ medical history. Even if inadvertent, the Northern District in February 2025 found the defendant had plausibly “directly or indirectly” solicited genetic information.

Ginski v. Ethos Seafood Group, LLC. The plaintiff claimed she answered questions relating to medical conditions during a physical examination and wasn’t informed she was not required to answer. The Northern District in 2024 found the plaintiff sufficiently alleged a GIPA claim, that plaintiffs need not allege discrimination, and GIPA may impose strict liability.

Million v. Hospital Sisters Health System. The Central District of Illinois in November allowed 25(c)(1) claims to proceed, finding plaintiffs established subject matter jurisdiction under the Class Action Fairness Act. It also granted plaintiff’s motion to compel discovery and ordered the defendants to pay plaintiff attorneys fees and costs in making the motion, given the defendants’ refusals to provide certain information in discovery.

Taylor v. Union Pac. R. R. Co. The Northern District in 2024 held that the plaintiffs had standing even without an actual injury. The defendant argued plaintiffs were not “aggrieved” under GIPA because they merely had their information collected, but the court held actual harm isn’t required under GIPA. Per the court, an individual just needs to show the defendant violated their right to privacy to “control their biometric information.”

Not all Illinois federal courts have agreed with Taylor. The Southern District, in Thompson v. Continental Tire The Americas, LLC, held in November that pleading a violation of GIPA alone is insufficient for Article III standing.

In light of the litigation outcomes above, companies should consider the following strategies to mitigate GIPA risk.

Obtain written consent prior to collecting genetic information that clearly specifies any third parties to which such information may be disclosed. GIPA permits disclosure of genetic information to a person specifically authorized in writing to receive that information.

Review what you collect from employees that may be “genetic information” and consider whether it’s necessary for the business. Be aware that questions regarding family medical history may be deemed to solicit genetic information under GIPA.

Standardize pre-employment interview processes to inform job applicants that they’re not required to provide genetic information but beware of defining genetic information in an overly broad manner to applicants.

Train staff and contractors to avoid asking for genetic information and assess only those physical capabilities specific to the job at issue. Consider including provisions in agreements with third-party contractors requiring compliance with GIPA, including indemnification in the event of a violation or an alleged violation.

Consider avoiding collecting genetic information from prospective employees inside Illinois, and remain wary of similar statutes elsewhere (such as in California and Texas). Just because a prospective employee isn’t an Illinois resident doesn’t necessarily protect companies from liability under GIPA.

This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law, Bloomberg Tax, and Bloomberg Government, or its owners.

Author Information

David R. Singh is co-head of Weil’s national complex commercial litigation practice representing major global companies in state and federal courts and in arbitration.

Blake Steinberg is an associate in Weil’s complex commercial litigation, intellectual property and media, and privacy & cybersecurity practices.

Ian Smith is an associate in Weil’s complex commercial litigation practice.

Summer associates Ashley Oliver, Alex Colby, Ahan Dhar, and Morgan Edmonds contributed to this article.

Write for Us: Author Guidelines