Privacy of Home DNA Testing

Written by Sarvesh Raghuraman

At-home DNA tests have exploded in popularity over the past decade. With just a saliva sample, companies promise insights into your ancestry, health risks, and family connections you did not know. However, behind that excitement are important questions about who owns your genetic data, how it is stored and shared, and what happens if company priorities or ownership change.

Unlike a password or a banking PIN, your DNA is unchangeable. As databases of genetic profiles grow, concerns about privacy, third-party access, and discrimination about your genetic information are real problems that are beginning to unfold.

When you send your DNA to a company like 23andME, AncestryDNA, or MyHeritage, you are agreeing to a privacy policy that explains how your biological information can be used. But what many people don’t realize is that genetic testing companies can control what happens to your DNA data once they receive it.

In most cases, no federal law mandates how this data must be stored or shared. The companies aren’t covered by HIPAA, so your genetic information is governed mainly by consumer protection and contract law rather than government enforced health privacy laws (Consumer Reports, n.d.; National Human Genome Research Institute, n.d.).

Companies such as 23andME ask you to opt in to research, which may result in the sharing of aggregated or anonymous genetic data with scientific or research partners. But even de-identified information (like DNA) can be re-linked to individuals or their relatives if combined with other data (National Human Genome Research Institute, n.d.; arXiv, 2021).

Privacy policies can — and do — change over time. A company reserves the right to update its terms, and users might only find out after they have sent genetic data (International Association of Privacy Professionals, n.d.). The case of 23andMe highlights real concerns about genetic privacy. After filing for bankruptcy in 2025, its database of over 15 million genetic profiles was treated as a corporate asset that could be sold. This sparked lawsuits from states like New York, arguing that DNA should not be treated like property and requires explicit consent (Reuters, 2024; GovFacts, n.d.).

The situation shows how genetic data is becoming a commodity when companies change owners or face financial pressure. One of the most high-profile uses of genetic databases has been in law enforcement. Forensic agencies have long used genetic tools — often with user data volunteered to third-party sites — to help with the identification of long-unsolved suspects. While this has brought closure in some cases, it continues to raise key ethical questions about consent and how far private DNA databases can be used for law enforcement purposes.

According to a survey by the Pew Research Center, close to 50% of Americans say it is acceptable for commercial genetic companies to share data with law enforcement to solve crimes, but may fail to fully understand how often or under what conditions this access can occur (Pew Research Center, 2020).

Researchers from Vanderbilt, Washington University, and Northeastern have noted that even when genetic data is anonymous, it can still be used to link relatives, which means you could be implicated or connected to genetic information that you never personally shared (arXiv, 2021).

One concern with DNA databases is the potential for genetic discrimination. This is being treated differently because of your genetic predisposition to certain diseases or traits.

The Genetic Information Nondiscrimination Act exists as a preventive measure to stop health insurers and employers from using genetic data to discriminate against you. What it fails to do however is cover life, disability, or long-term care insurance, which means others outside traditional employment and health coverage could potentially be treated differently based on DNA (National Human Genome Research Institute, n.d.).

There is also a risk that genetic information could be used in legal settings or targeted advertising if it gets into the wrong hands — something that is argued to be possible under current laws (National Human Genome Research Institute, n.d.).

Despite its benefits, collecting and storing genetic data raises concerns about privacy and potential exploitation, even as aggregated datasets help researchers identify disease markers, improve screening, and accelerate studies on health and genetic variation. At the same time, many users value DNA testing for insights into ancestry and family connections, explaining the widespread appeal.

As personal genomics becomes everyday life, individuals and policymakers alike must ask if we are trading away our own privacy for curiosity and what is the true cost of sharing this deeply personal code. The answers that we choose now will shape the ethics of biotechnology for decades to come.

References:

1. Consumer Reports. (n.d.). Your genetic data isn’t as private as you think with direct-to-consumer DNA tests. Consumer Reports. https://www.consumerreports.org/health/health-privacy/your-genetic-data-isnt-safe-direct-to-consumer-genetic-testing-a1009742549/
2. Pew Research Center. (2020, February 4). About half of Americans are OK with DNA testing companies sharing user data with law enforcement. https://www.pewresearch.org/fact-tank/2020/02/04/about-half-of-americans-are-ok-with-dna-testing-companies-sharing-user-data-with-law-enforcement/
3. National Human Genome Research Institute. (n.d.). Privacy and genetic testing. https://www.genome.gov/about-genomics/policy-issues/Privacy
4. International Association of Privacy Professionals. (n.d.). Data privacy and genetic testing: Guidance and enforcement from regulators. https://iapp.org/
5. Reuters. (2024). US states sue 23andMe to protect customers’ private data. Reuters.
6. GovFacts. (n.d.). Can DNA testing companies sell your genetic data? GovFacts.
7. arXiv. (2021). Re-identification of individuals in genomic datasets using public face images. https://arxiv.org/abs/2102.08557