DNA Test Privacy: What Happens to Your Data?
When you take a consumer DNA test, the company processes your sample, stores your genetic data and uses it for your reports and, if you agree, for relative matching and research. You control much of this through consent choices and account settings, so read the privacy policy before you test and review your settings after, especially if the company changes ownership.
When you send a DNA sample to a testing company, three things happen. The lab extracts and reads your DNA, the company stores the resulting genetic data in your account, and that data is used for your reports and for any extras you agree to, such as relative matching or research. Most of the privacy risk comes from those extras and from what happens to the company over time.
The good news is that you control a lot of it. The key is to make your choices before you send the kit, not after.
What a DNA company collects
A consumer DNA test usually involves more than just your genes. Expect the company to hold:
- Your sample, which may be stored or destroyed depending on your choice and the company's policy.
- Your genetic data, the raw readings used to build your reports.
- Your account details, such as name, email and payment information.
- Anything you add, such as survey answers, family trees and messages to matches.
Your genetic data is unusual because it is shared with your relatives. A result that reveals a close family connection affects them as well as you.
The settings that matter most
Every company structures its options differently, but these are the choices to look for.
| Setting | What it controls | What to consider |
|---|---|---|
| Relative matching | Whether other testers can see you as a match | Useful for family history; can reveal unexpected relationships |
| Display name and profile | What matches see about you | You can often use initials or a limited profile |
| Research consent | Whether your data is used in research | Usually separate and optional |
| Sample storage | Whether your physical sample is kept | Some let you request destruction |
| Data download | A copy of your raw data | Useful, but the file is sensitive once it leaves the company |
| Account deletion | Removal of your data and account | Check what is deleted and any exceptions |
| Law enforcement matching | Whether your profile can be used in such matching | Policies differ; some offer opt-outs |
Review each of these when you activate your kit. Defaults vary, and some features are on unless you change them.
Research consent is usually separate
Many testing companies run or support genetic research. Reputable companies typically ask for separate, explicit consent before using your data this way, and you can usually say no and still receive your results.
Read the consent form rather than clicking through. Look for what kind of research is involved, whether data is shared with outside partners, whether it is de-identified, and whether you can withdraw consent later. Withdrawing consent may not undo research that has already used your data, so the first decision matters.
When a company changes hands
Privacy policies usually allow customer data to transfer if a company is sold, merged or restructured. That means the company you trusted when you tested may not be the company holding your data years later.
23andMe is the clearest recent example. It filed for Chapter 11 bankruptcy in March 2025, and in July 2025 TTAM Research Institute, a nonprofit founded and led by co-founder Anne Wojcicki, completed its purchase of 23andMe's consumer DNA and research business. The service now runs as the nonprofit 23andMe Research Institute. If you have tested with 23andMe, review the current privacy policy and your data settings, including research consent and deletion options. Our 23andMe review covers what the service offers today.
The broader lesson applies to every company: when you hear that a DNA company has been sold or restructured, log in and check your settings.
Law enforcement and genetic genealogy
Investigators have used consumer DNA databases to help identify suspects and unidentified remains, usually by finding distant relatives of an unknown sample. Company policies on this differ. Some say they require valid legal process before sharing data. Some have published policies on law enforcement matching and offer users a way to opt in or out.
FamilyTreeDNA, for example, has published policies on law enforcement matching and user opt-outs. Read the current policy for any company you consider, because these policies have changed over time.
Your raw data file
Many companies let you download your raw genetic data, and some services, such as Sequencing.com, accept uploads from other companies. Upload policies change: MyHeritage DNA, for example, says it no longer accepts DNA uploads from other companies.
Once you download the file, though, you are responsible for it. Store it securely, think carefully before uploading it to third-party tools, and read each site's privacy policy before you do. A file shared widely is hard to take back.
A practical privacy checklist
Before you test:
- Read the privacy policy and research consent form, not just the summary.
- Decide on matching. If you only want an ethnicity estimate, you may not need to appear to relatives.
- Check deletion and sample options, so you know how to leave later.
- Use a strong, unique password and turn on two-step verification if offered.
After you test:
- Review every privacy setting when you activate the kit.
- Limit what matches can see, such as using initials as a display name.
- Revisit settings periodically and whenever the company announces a sale, merger or policy change.
- Prepare for surprises. Relative matching can reveal unexpected family information. Decide in advance how you would handle that.
Comparing companies on privacy
Privacy and data control is one of the five criteria in our methodology. We look at the clarity of the privacy policy, separate research consent, the ability to download and delete data, matching controls and recent ownership changes.
If privacy is your top concern, compare the policies directly. Our AncestryDNA vs 23andMe comparison and 23andMe vs MyHeritage DNA comparison include a privacy row for each. You may also want to read how accurate DNA ancestry tests are to decide whether the results are worth the trade-off for you.
The bottom line
A DNA test is a reasonable choice for many people, but your genetic data is sensitive and shared with your relatives. Read the policy, make deliberate consent choices, know how to delete your data, and check your settings again whenever the company changes. See our full DNA test rankings to compare options.
Frequently asked questions
Can I delete my DNA data after testing?
Most major companies offer a way to download and delete your data from your account settings, and many let you ask for your stored sample to be destroyed. The process differs by company, so check the current help pages before you test.
Do DNA companies share data with researchers?
Many companies ask for separate consent before using your data in research. You can usually decline research participation and still get your results. Read the consent form carefully and check whether you can change your choice later.
What happens to my data if a DNA company is sold?
Your data may transfer to the new owner under the terms of the privacy policy. 23andMe's ownership changed in 2025, which is a good example of why you should review the current policy and your settings whenever a company you tested with is sold or restructured.
Can police access DNA testing databases?
Policies vary. Some companies say they require legal process for law enforcement requests, and some have published policies on law enforcement matching with user opt-outs. Read each company's current policy before testing.