Consumer DNA Tests: What Happens to Your Genetic Data

You spat in a tube, mailed it off and got a fun ancestry pie chart. Then 23andMe filed for bankruptcy in 2025, and millions of people suddenly asked the same question: who actually owns my DNA now, and can I get it back?

The short version is that consumer DNA companies keep more than most customers realize, the rules protecting that data are thinner than medical privacy law, and you have more control than you might think. This guide explains where your genetic data goes, who can access it, and the exact steps to download and delete it.

What a DNA testing company keeps after you test

When you buy a direct-to-consumer DNA kit, the company typically ends up holding 4 kinds of information:

• Your raw genetic data. A file of hundreds of thousands of genetic markers read from your sample.
• Your biological sample. Many labs store leftover saliva or extracted DNA unless you ask them to destroy it.
• Your reports and matches. Ancestry breakdowns, health or trait reports, and relative matches built from your data and other customers’ data.
• Your profile and survey answers. Name, birth year, location, family tree details and any health questionnaires you filled out.

Genetic data is unusual because it is permanent and shared. You can change a leaked password. You cannot change your genome, and your DNA also reveals information about parents, siblings, children and cousins who never took a test.

Key takeaway: A DNA test is not a one-time transaction. Unless you act, the company may keep your raw data and your physical sample for years, and its policies can change if it is sold.

Why HIPAA usually does not protect consumer DNA tests

Many people assume genetic data is covered by HIPAA. In most consumer cases it is not. HIPAA applies to health plans, healthcare clearinghouses and providers that bill electronically, plus their business associates. A DNA company selling kits directly to you usually falls outside that list, which is the same gap we explain in our guide to health apps and HIPAA.

What does apply:

The Federal Trade Commission has used its authority against DNA companies. In 2023 it finalized an order against 1Health.io (formerly Vitagene), alleging the company left health reports and raw genetic data in publicly accessible cloud storage, misled customers about deleting data and retroactively expanded who it could share data with. The order required a $75,000 payment for refunds and destruction of DNA samples held longer than 180 days.

GINA, the Genetic Information Nondiscrimination Act, is important but narrow. The National Human Genome Research Institute notes that its health insurance protections do not extend to life, disability or long-term care insurance, though some states add their own protections.

State laws fill some gaps. California’s Genetic Information Privacy Act took effect January 1, 2022. It requires separate express consent for different uses of genetic data, a plain-language privacy notice, and destruction of a consumer’s biological sample within 30 days of revoking consent. Our state data privacy laws guide covers broader state rules. This is not legal advice.

Research use and data sharing

Most large DNA companies ask whether you want to participate in research. If you say yes, your de-identified or aggregated data may be shared with academic, pharmaceutical or other research partners. When 23andMe was sold, the company said roughly 80% of its customers had agreed to research use.

Things to check in your settings and privacy policy:

1. Research consent. Is it on? Can you withdraw it? Withdrawal usually stops future use but cannot pull data out of studies already completed.
2. Sample storage. Did you agree to have your sample stored? You can usually change this.
3. Third-party sharing. Does the policy allow sharing with service providers, partners or a future buyer of the company?
4. Relative matching. Is your profile visible to other customers? Matching can reveal family secrets, and it can expose relatives’ information.

Security matters too. Between April and September 2023, attackers used passwords stolen from other breaches to log into about 14,000 23andMe accounts and reach information on millions of linked relatives through the matching feature. The UK Information Commissioner’s Office fined the company £2.31 million in June 2025, citing the lack of measures such as mandatory multi-factor authentication. Turn on two-factor authentication for any DNA account you keep, and check whether your password has leaked.

What happens if a DNA company is sold or goes bankrupt

Customer data is a business asset. If a company is sold, your data usually goes with it. 23andMe filed for bankruptcy in March 2025, and a federal bankruptcy judge approved its sale to TTAM Research Institute, a nonprofit led by co-founder Anne Wojcicki, at the end of June 2025 for $305 million. TTAM said it would honor existing policies that let customers delete their data and opt out of research.

Before the sale, California Attorney General Rob Bonta issued a consumer alert urging customers to consider deleting their data, and several other state attorneys general made similar recommendations. Many states had objected to the sale.

The lesson applies to every DNA company: your privacy protections depend on the current policy and whoever owns the company next. If you would not be comfortable with a future owner holding your data, delete it now.

Can police access your DNA test results?

Yes, in some circumstances, and it depends on the service.

Legal process. Large ancestry companies generally say they require a valid warrant, subpoena or court order before handing over customer data, and some publish transparency reports on these requests.

Genetic genealogy searches. Investigators can upload DNA from a crime scene to databases that allow it and look for relatives of an unknown suspect. The US Department of Justice interim policy on forensic genetic genealogy, effective November 1, 2019, limits its agencies and federally funded labs to services that give users explicit notice of law enforcement use. It generally reserves these searches for violent crimes and unidentified human remains, after other methods such as a CODIS search have been tried. It also states a genetic association alone is not grounds for arrest.

Opt-in versus opt-out. Services handle this differently:

• GEDmatch made law enforcement matching opt-in in 2019, and lets users choose privacy settings per DNA kit.
• FamilyTreeDNA lets users control whether their data can match law enforcement uploads. Check the current default in your privacy settings.
• Major ancestry and health testing companies say they do not allow law enforcement database searches without legal process.

Even if you never test, a cousin’s upload can lead investigators to your family tree. That is why genetic privacy is a family decision as much as a personal one.

How to download your raw DNA data

Download your data before deleting an account, if you want to keep it for health conversations, other genealogy tools or your own records.

1. Log in on a desktop browser and open Settings or Account settings.
2. Find the section for your DNA or genetic data. It is usually labeled “Download your data” or “23andMe Data”.
3. Request the raw data file. Many services email a link when the file is ready and may ask you to confirm your identity.
4. Save the file somewhere encrypted. Treat it like a medical record, not a casual download.
5. Be careful uploading the raw file to free third-party analysis sites. Each new site is another company holding your genome under its own privacy rules.

How to delete your genetic data and destroy your sample

The California Attorney General’s 2025 alert laid out the 23andMe process, and most services follow a similar pattern:

1. Log in and open Settings.
2. Find the data deletion option, often labeled “Delete data” or “Delete account”.
3. Confirm by email. Most companies send a confirmation link. The request is not complete until you click it.
4. Ask for sample destruction. If you agreed to sample storage, change that setting or ask customer support to destroy your stored sample.
5. Withdraw research consent separately if the company lists it as a separate setting.
6. Keep records. Screenshot the confirmation and save the emails.

Know the limits. Companies may keep some information to meet legal or lab regulatory requirements, and data already used in completed research cannot be pulled back. If you live in a state with a genetic privacy or consumer privacy law, cite it in your request.

Where to start: a 10-minute DNA privacy checkup

If you have taken any consumer DNA test, do this today:

• Turn on two-factor authentication and change a reused password.
• Review research consent and relative matching settings.
• Decide whether you still want the company to keep your sample.
• Download your raw data if you want a copy.
• Delete your account if you no longer use the service or do not trust a future owner.
• Watch for breach notices and follow our health data breach checklist if one arrives.

If your DNA account was ever exposed alongside your Social Security number or insurance details, also read our guides to freezing your credit and medical identity theft.

The bottom line

Consumer DNA tests can be useful and fun, but they create a permanent data record that the law protects less than your medical chart. Assume the company keeps your data and sample until you tell it not to. Use the settings you have, download what you want to keep and delete the rest.

Sources

• California Attorney General: consumer alert for 23andMe customers — deletion steps and rights under California’s Genetic Information Privacy Act and CCPA
• FTC: final order with 1Health.io over DNA data privacy and security — FTC enforcement against a DNA testing company
• US Department of Justice interim policy on forensic genetic genealogy — rules for law enforcement use of genealogy databases
• National Human Genome Research Institute: Genetic Discrimination — what GINA covers and excludes
• UK Information Commissioner’s Office: 23andMe fined £2.31 million — 2023 credential stuffing breach findings
• NPR: Judge approves sale of 23andMe to TTAM Research Institute — sale approval, price and privacy commitments