When you submit a DNA sample to a consumer testing company, you are doing something unprecedented in human history: voluntarily handing over the most personal biological information that exists about you — information that is shared with every blood relative you have, cannot be changed or recalled, and will remain meaningful for as long as genetic science continues to advance. The genealogical value of that decision is real and documented throughout this series. So are the privacy implications, which have come into sharp focus over the past two years in ways that every genealogical DNA tester should understand.

The 23andMe bankruptcy of March 2025 was a turning point. After declaring bankruptcy, 23andMe sold the data of more than 15 million people around the world to TTAM Research Institute, a nonprofit organization created by 23andMe’s founder and long-time CEO. The sale ended relatively benignly — the data went to a familiar party rather than an unknown buyer — but it exposed how fragile the privacy promises of consumer genetic testing companies actually are, and how few legal protections exist when a company’s financial situation changes.

Understanding those protections, and their limits, is now a basic requirement for anyone who has tested or is considering testing.

What Testing Companies Actually Do with Your Data

The privacy policies of major DNA testing companies vary considerably, and the details matter.

AncestryDNA stores both your physical DNA sample and your processed genetic data. Deleting your results is separate from destroying your physical sample — you must request sample destruction through Member Services if you want your biological material removed. The company shares de-identified data with research partners unless you opt out, and once data has been used in a completed study, withdrawal of consent cannot undo that use. In a corporate acquisition, your data may transfer to the new owner.

23andMe demonstrated the acquisition risk most vividly. Its data — including genetic results, health reports, family trees, and self-reported survey data — was treated as a company asset in the bankruptcy proceedings. The sale to TTAM Research Institute was permitted by the bankruptcy court despite objections from regulators and consumers.

FamilyTreeDNA takes a different position on law enforcement. Unlike AncestryDNA and MyHeritage, which refuse to cooperate with law enforcement without a valid court order, FamilyTreeDNA has historically allowed law enforcement to upload profiles for matching. Users can opt out of this matching specifically while remaining in the genealogical database — a nuanced position covered in more detail in our earlier article on DNA and law enforcement.

GEDmatch participates in law enforcement matching by default for users who have opted in. Users who do not wish to participate in law enforcement matching must actively opt out.

MyHeritage has among the strongest stated privacy protections of the major platforms — it does not share data with law enforcement without a court order and does not sell genetic data to third parties. Its acquisition history has been more stable than AncestryDNA or 23andMe.

The Legislative Landscape

The 23andMe bankruptcy accelerated legislative attention to genetic privacy that had been building for several years.

At the federal level, Senators Bill Cassidy (R-LA) and Gary Peters (D-MI) introduced the Genomic Data Protection Act on March 5, 2025, which would require direct-to-consumer genomic testing companies to enable consumers to access their genomic data, delete their genomic data, and destroy their biological samples, and provide notice to consumers if the company is purchased or acquired. The bill was introduced in a previous congressional session and stalled; the 2025 reintroduction follows the same text but with renewed political urgency given the 23andMe situation.

A companion measure, the Don’t Sell My DNA Act, would require companies to provide written notice and obtain affirmative consent from consumers before their genetic data could be used, sold or leased during bankruptcy proceedings, and would mandate the deletion of any genomic information not subject to a sale.

At the state level, several states introduced new genetic privacy bills in early 2026. Arizona, California, Kentucky, Maryland, Montana, Tennessee, Texas, Utah, Virginia, and Wyoming already have consumer protections related to genomic data held by direct-to-consumer genetic testing companies. The new wave of state legislation is attempting to close gaps that the 23andMe bankruptcy revealed — particularly around bankruptcy proceedings and data transfers.

Neither existing federal legislation nor the pending bills provides sufficiently robust protection. The Genomic Data Protection Act’s right to deletion places the onus on the consumer to affirmatively delete their data before a sale — something that many consumers will not know to do, or will not do in time.

What “De-identified” Actually Means

Most testing companies commit to sharing only “de-identified” data with research partners. This sounds reassuring. It is less reassuring on close examination.

De-identification in the context of genetic data is technically difficult to guarantee in ways that de-identification of, say, health records is not. Your genetic data is, by definition, uniquely identifying — it is literally the most unique identifier you have. When a company removes your name and address from a genetic profile, the underlying data still contains enough information to potentially re-identify you if it is ever combined with other databases, a risk that grows as genetic databases expand. The legal definition of “de-identified genetic data” varies by state; some require only that name and address be removed, while others impose more stringent standards.

Researchers have demonstrated that genetic data de-identified by standard methods can be re-identified using publicly available genealogical databases — the same databases, ironically, that genealogists use. This is not a theoretical risk.

Practical Steps for Protecting Your Privacy

Understanding the risk landscape does not require stopping genealogical DNA testing. It does require making informed decisions. Here are the most important practical steps:

Read the privacy policy before you test. Focus on three questions: What data does the company share with third parties? What happens to your data if the company is acquired? How do you delete both your profile and your physical sample?

Opt out of research sharing where available. Most major platforms allow you to opt out of having your de-identified data used in third-party research. This is typically buried in account settings. Find it and use it if you have concerns.

Manage your law enforcement settings. FamilyTreeDNA and GEDmatch both have explicit opt-out mechanisms for law enforcement matching. If this matters to you, check your settings.

Know how to delete your data. On AncestryDNA, deleting your profile does not automatically destroy your physical sample; you must request sample destruction separately. If you decide to close an account, request physical sample destruction in writing.

Consider testing under a managed account. Some researchers test using a dedicated email address and username rather than their primary accounts, reducing the linkage between their genetic profile and their broader online identity. This does not prevent re-identification from the genetic data itself but adds a modest layer of separation.

Transfer raw data rather than retesting. Rather than testing at multiple platforms (and placing your data in multiple company databases), test at one platform and upload your raw data to others. Your genetic information exists in only one company’s proprietary database; the others see only a processed file.

For Dillman Researchers

The privacy calculus for Dillman researchers is ultimately the same as for any genealogical DNA tester, with one additional consideration: the collaborative nature of surname and Y-DNA project research means that joining the Dillman DNA Project on FamilyTreeDNA shares some information with the project administrator and other participants. Joining a project does expose some identifying information about you to the project volunteer administrator, and it may also expose non-identifying information about you through the project’s public page.

The Dillman DNA Project, like all FamilyTreeDNA group projects, is run by volunteer administrators who are themselves DFA members and researchers — not a commercial entity with financial incentives to monetize your data. That distinction is worth keeping in mind as you evaluate where and how to share your genetic information.

The genealogical benefits of DNA testing for Dillman research are real and growing. So is the importance of understanding what you are agreeing to when you submit that sample.

Sources

Ram, Natalie, et al. “The Precarious Future of Consumer Genetic Privacy.” Science 389, no. 6765 (September 11, 2025): 1092–1094. pmc.ncbi.nlm.nih.gov.

U.S. Senate. “Cassidy, Peters Introduce Bill to Protect Americans’ DNA, National Security.” Press release. March 5, 2025. cassidy.senate.gov.

Inside Privacy. “Several States Introduce New Genetic Privacy Bills in Early 2026.” January 30, 2026. insideprivacy.com.

Orrick. “Navigating Privacy Gaps and New Legal Requirements for Companies Processing Genetic Data.” August 8, 2025. orrick.com.

Terms.law. “Ancestry DNA Privacy 2026: Does Ancestry Sell Your DNA?” January 28, 2026. terms.law.

FamilyTreeDNA. “Introduction to Group Projects.” FamilyTreeDNA Learning Center. Accessed July 2026. familytreedna.com.

Note: This post was researched and written with the assistance of artificial intelligence (AI). All content has been reviewed for accuracy as of September 2026. All errors are the responsibility of the author.