Your raw DNA file feels like just another download, a text file full of letters, easy to hand off to a genealogy site or a health-analysis tool. But it is the most personal data you will ever share. It is permanent, it identifies you and your blood relatives, and once you upload it somewhere, you cannot truly take it back. Genetic data is also unusually exposed under the law, and the recent turmoil at big testing companies has shown how quickly the terms you agreed to can change. None of this means never test, but it does mean understanding what you are giving up before you click upload.
Here are seven privacy traps to know before you send your genetic data to any testing or matching service, and how to protect yourself at each step.
The short version
Before uploading raw DNA, know that every place you send it becomes another copy under another company’s rules, so limit how many services you trust. Many genealogy databases can be searched by law enforcement, sometimes by default, so check and set your matching preferences. Understand that a company’s promises can change if it is sold or goes bankrupt, as the 23andMe bankruptcy showed. Remember that your DNA also reveals information about relatives who never consented, that “deleting” your data may not erase copies already shared or backed up, and that genetic-privacy law has real gaps, since the main federal protection does not cover life, disability, or long-term-care insurance. Finally, weigh the company’s security record and read what you are consenting to at signup. Read the policy, share sparingly, use your deletion and opt-out rights, and treat your DNA as permanent.
Table of Contents
1. Every upload is another copy you no longer control
The first trap is treating your raw DNA file as harmless because it is just data. Every time you upload it, to a second ancestry site, a health-report tool, or a genealogy matcher, you create another copy on another company’s servers, governed by that company’s privacy policy, security, and business decisions. You can delete the original account and still have your genome sitting in three other databases you forgot about. The safest habit is to minimize: upload to as few services as you genuinely need, keep a list of everywhere your DNA lives, and treat each new upload as a real decision, not a quick convenience.
2. Law enforcement can search many genealogy databases
Some genealogy matching sites can be used by law enforcement to identify people through their relatives’ DNA, the technique that famously cracked cold cases. Whether your kit is included often comes down to a privacy setting, and the defaults have shifted over the years. GEDmatch, for example, now generally requires users to opt in before their data is compared against law-enforcement kits, and lets you set a privacy level per uploaded file. The trap is assuming you are private by default. If being searchable by police, through your own DNA or a relative’s, matters to you, find the matching setting on every service and choose it deliberately rather than leaving it to the default.
3. The terms can change if the company is sold or goes bankrupt
A privacy promise is only as durable as the company that made it. When a genetic-testing firm is acquired or goes bankrupt, its most valuable asset is often the database of customer DNA, and what happens to your data can change with new ownership. This is not hypothetical: 23andMe filed for bankruptcy in 2025, and its assets, including the genetic data of millions of customers, were sold, prompting several state officials to urge people to consider deleting their data. The new owner pledged to honor the old privacy terms, but the episode is a clear warning. When you upload, assume the company might not exist, or might not be the same company, in a few years.
4. Your DNA exposes your relatives, who never agreed
Genetic data is never only about you. Your parents, siblings, children, and even distant cousins share large portions of your DNA, so uploading yours reveals information about people who never consented and may not want to be findable. This is exactly how investigative genetic genealogy identifies someone through a relative’s uploaded kit. The trap is thinking of the decision as personal when it is really familial. Before you upload, consider that you are making a privacy choice for your whole genetic family, and that a relative’s upload can expose you the same way, whether or not you ever tested yourself.
5. “Delete” may not erase every copy
Deletion rights are real and worth using, but they are not always complete. When you delete your account, the company may remove your data from its active systems, yet copies can persist, in backups, or in de-identified datasets already shared with research partners before you asked to leave. After the 23andMe bankruptcy, large numbers of customers requested deletion, but the reality is that data already distributed or aggregated cannot always be fully clawed back. Use your right to delete and to withdraw research consent, and do it sooner rather than later, but go in understanding that deletion reduces your exposure without guaranteeing your genome is gone everywhere it has been.
6. Genetic-privacy law has real gaps
Many people assume the law fully protects them, and it does not. The main federal genetic-privacy law, the Genetic Information Nondiscrimination Act, bars discrimination based on genetic information in health insurance and employment, but it does not cover life insurance, disability insurance, or long-term-care insurance. That means those insurers can, in many states, ask about and use genetic test results when deciding whether to cover you and at what price. Some states add protections, but the federal floor leaves a real gap. You can read the specifics on the National Human Genome Research Institute’s page on genetic discrimination. Factor this in before testing, especially if those coverages matter to you.
7. Weak security and buried consent at signup
Finally, look at how the company protects your data and what you agree to on the way in. Genetic databases are high-value targets, and breaches happen; 23andMe experienced a significant data exposure that later led to a multi-state settlement over its handling of customer information. On top of that, research or data-sharing consent is often presented during signup in a way that is easy to accept without reading. The trap is a weak-security company plus a consent you did not realize you gave. Check the service’s security record and breach history, use strong, unique credentials and two-factor authentication, and read the research and sharing options carefully instead of clicking straight through.
How to protect your genetic privacy
You can still test and explore your ancestry while keeping the risks in check. Upload to as few trusted services as possible, and keep track of everywhere your DNA lives. On each one, find and set the matching and law-enforcement preferences deliberately, and turn off research or data-sharing consent unless you actively want it. Read the privacy policy for how your data can be sold, shared, or transferred if the company changes hands, and secure every account with a strong password and two-factor authentication. Use your deletion and opt-out rights when you are done, understanding they reduce but may not erase your footprint. And remember the decision affects your relatives too. For interpreting any health-related results, talk to a genetic counselor or clinician rather than relying on a raw report.
This article is general information about privacy, not medical, legal, or financial advice. Direct-to-consumer genetic services are generally not covered by medical privacy laws like HIPAA, and genetic-privacy protections vary by state, so read each service’s current terms, consult a qualified attorney about your rights, and speak with a genetic counselor or physician about the health meaning of any genetic results.
Frequently asked questions
Is it safe to upload my raw DNA to a third-party site?
It carries real privacy risk. Each upload creates another copy of your genome under another company’s rules, security, and future ownership, and you cannot fully undo it. It can be reasonable if you vet the service, read its policy, set matching and sharing preferences, and secure the account. The safest approach is to upload to as few trusted services as you truly need and to treat every upload as permanent.
Can police access my DNA from a genealogy site?
On some matching databases, yes, often to identify people through relatives’ DNA. Whether your kit is included usually depends on a privacy setting, and defaults have changed over time. GEDmatch, for instance, generally requires opting in before your data is compared to law-enforcement kits. Check the law-enforcement matching option on every service you use and choose it deliberately rather than relying on the default.
What happened to 23andMe customers’ data in the bankruptcy?
23andMe filed for bankruptcy in 2025, and its assets, including millions of customers’ genetic data, were sold to a new nonprofit owner that pledged to keep the existing privacy terms and deletion rights. Officials in several states urged customers to consider deleting their data during the process. It is a clear example of how the terms you agreed to can shift when a company changes hands.
Does the law protect me from genetic discrimination?
Partly. The federal Genetic Information Nondiscrimination Act prohibits genetic discrimination in health insurance and employment, but it does not cover life, disability, or long-term-care insurance, where insurers may use genetic information in many states. Some states add protections. Because of this gap, consider the implications for those coverages before testing, and check your own state’s rules.
Can I fully delete my DNA data once it is uploaded?
You can delete your account and reduce your exposure, and you should if you no longer want the service to hold your data. But deletion may not erase every copy, since data can remain in backups or in de-identified datasets already shared with research partners. Use your deletion and research-withdrawal rights promptly, while understanding they lower your footprint without always guaranteeing complete removal.
The bottom line
Uploading your DNA is a one-way decision about permanent, shared, and legally exposed data, so it deserves more thought than a quick download suggests. Limit where your genome lives, set matching and law-enforcement preferences on purpose, and read how your data can be sold or transferred if the company changes hands. Know that your relatives are affected, that deletion may be incomplete, and that key privacy laws leave life, disability, and long-term-care insurance uncovered. Test if you want to, but do it with your eyes open. For more on protecting your health and your information, browse The Other Stream’s Health section.
Related Posts
