What a DNA test company collects
A home kit asks for a saliva sample. The lab reads your DNA and sends back a report on ancestry, traits or wellness. The company usually keeps more than the report. It may keep the raw genetic file, your answers to survey questions, your email and your payment details.
Some firms also ask if they can store the physical sample. Others ask if your data can be used in research. These are separate choices. Read each one on its own, because a yes to research is not a yes to everything.
DNA is different from a password. You cannot change it. It also says something about your parents, siblings and children. When you share your data, you share a little of theirs too.
Source: NPR, "How to delete your 23andMe data after the company filed for bankruptcy," March 25, 2025.
What GINA covers and what it leaves out
The main US law here is the Genetic Information Nondiscrimination Act of 2008, called GINA. It has two parts. Title I covers health insurance. Title II covers employment.
Under Title I, a health insurer may not use genetic information to decide if you qualify for coverage or what you pay. An insurer also may not ask or require you to take a genetic test. Under Title II, an employer may not use genetic information to hire, fire, promote or set pay. An employer also may not ask for it as a condition of a job.
The gaps matter. GINA does not cover life insurance, disability insurance or long-term care insurance. Some states add their own rules for those lines. GINA also does not cover the US military for employment decisions.
GINA is also not a privacy law for the DNA company itself. It limits what insurers and employers can do with genetic information. It does not tell a testing company how long to keep your data or who it may share it with.
Source: National Human Genome Research Institute, "Genetic Discrimination" overview of GINA.
What the FTC found at one DNA company
In June 2023, the Federal Trade Commission announced a proposed settlement with 1Health.io, a DNA health test company that was called Vitagene until 2020. The FTC said it was the first case it had settled that focused on both the security and the privacy of genetic information.
The FTC made three main claims. First, the company promised "rock-solid security," yet it stored nearly 2,400 health reports and raw genetic files in publicly reachable cloud storage. Researchers warned the company three times before it looked into the problem.
Second, the company told people they could delete their data at any time. The FTC said that from 2016 the company had no policy to make sure its lab destroyed the DNA samples.
Third, in 2020 the company changed its privacy policy to widen the list of outside groups that could receive data. The new list included supermarket chains and nutrition and supplement makers. The FTC said the company did not tell people who had already shared data, and did not ask for their consent.
The proposed order required a $75,000 payment and a ban on sharing health data with third parties without consent. The lesson for you is simple. A privacy promise on a website is only as good as the company behind it, and policies can change after you sign up.
Source: TechTarget Healthtech Security, "FTC Proposes Settlement With Genetic Testing Company Over Unsecured Health Data," June 20, 2023.
Why a bankruptcy raised new questions
In March 2025, 23andMe filed for bankruptcy protection and said it wanted to find a buyer. More than 15 million people had used the service. Many asked the same thing: what happens to my data?
The company told customers that the filing does not change how it stores or protects their data. It also said any buyer must follow the law on customer data. Still, the event showed a real risk. When a company is sold, its data may go with it.
Some states have acted. NPR reported that at least 11 US states had laws giving people a say in how their genetic data is used. Those laws often let you ask a company to delete your data. They also often require police to get a warrant or subpoena first.
Source: NPR, "How to delete your 23andMe data after the company filed for bankruptcy," March 25, 2025.
How to delete your DNA data
California Attorney General Rob Bonta published a step-by-step guide for 23andMe customers. Other companies set up their menus differently, but the steps are a useful model.
- Log in on the company website and open Settings.
- Find the section for your data and click View.
- Download a copy of your data if you want to keep one.
- Scroll to the delete option and choose to permanently delete your data.
- Open the email the company sends and follow the link to confirm.
Two more settings are worth a look. If you asked the company to store your saliva sample, you can change that under Preferences. If you agreed to research use, you can withdraw consent under the research and product consents section.
A short checklist before you buy
- Read what the company says it does with your raw data, not only your report.
- Look for a plain way to delete your data and to have your sample destroyed.
- Say no to research sharing unless you want it. You can change your mind later.
- Check what the policy says happens if the company is sold or goes bankrupt.
- Use a strong, unique password and turn on two-step login.
- Remember that relatives share part of your DNA.
Source: NPR, March 25, 2025; California Attorney General guidance as reported by NPR.
Sources
NPR, "How to delete your 23andMe data after the company filed for bankruptcy," March 25, 2025. National Human Genome Research Institute, "Genetic Discrimination." TechTarget Healthtech Security, June 20, 2023, reporting the Federal Trade Commission announcement on 1Health.io.