Can DNA Testing Companies Sell Your Genetic Data?

Last updated 1 week ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.

Whether a DNA testing company can sell or share genetic data, and what a customer can later delete or withdraw, depends on what the customer agreed to, the company’s privacy promises and the laws that apply. Taking a test does not make DNA public property. Ancestry, for one, says it does not sell genetic information to insurers, employers or third-party marketers.

Data can still move in other ways. Ancestry customers can get their results without joining the company’s research project, but those who join cannot pull their data out of research already underway or completed. A company can also change hands: when 23andMe went bankrupt, a court approved the sale of its customers’ genetic data and samples to a nonprofit.

Taking a test is different from making DNA public

Ancestry’s terms allow its laboratories to extract and test DNA, store DNA data, and disclose results to the customer and people the customer authorizes. The terms also describe relative matching as a service that customers can choose whether to join. Those permissions cover specific uses of a test; they do not make its results public property available to anyone.

Ancestry distinguishes the physical sample and extracted DNA from genetic information such as ancestry estimates and relative matches. Destroying the sample and deleting the data are therefore separate steps: a sample can be gone while data already produced from it remain under their own retention or research rules.

A research dataset deserves attention even when names are removed. Deidentified means the data are separated from identifying details; it does not mean identification has become impossible. The National Human Genome Research Institute says researchers have identified people by combining deidentified genomic information with other publicly available information.

Federal laws protect different parts of the problem

The Health Insurance Portability and Accountability Act (HIPAA), the federal health-privacy law, defines a covered entity as a health plan, a health care clearinghouse or a health care provider that transmits health information electronically in covered transactions. As the Federal Trade Commission (FTC) describes it, HIPAA addresses privacy and security for most doctors’ offices, hospitals and insurance companies, and a lot of health-related information falls outside it. Ancestry says it is not a HIPAA covered entity. So HIPAA coverage depends on the organization and what it does, not on how sensitive a DNA result is.

The Genetic Information Nondiscrimination Act, or GINA, bars covered employers from using genetic information in employment decisions. It also bars health insurers from using genetic information to decide eligibility, coverage, underwriting or premiums. GINA’s health insurance protections do not cover life, disability or long-term-care insurance, although some states add protections. A ban on discrimination is not a ban on collecting or transferring a genetic record.

The FTC’s Health Breach Notification Rule applies to vendors of personal health records and related entities not covered by HIPAA; the FTC says health apps and similar technologies are covered. Those businesses must notify people and the FTC after a qualifying breach, and sometimes the media. The rule covers unauthorized disclosures as well as data-security breaches, so a breach can be a company sending information to an unauthorized recipient, not just someone breaking into a server.

State consent rules can add more control

California shows what a state law can add, though its rules are not a national standard. California’s consumer genetic-privacy law defines a consumer as a California resident and covers companies offering consumer-initiated genetic tests, certain genetic-data analysts and entities handling consumer-provided or consumer-test data. Its exclusions include medical information governed by California medical-confidentiality law and protected health information handled under the specified HIPAA rules. A consumer ancestry kit and a test handled within regulated medical care can therefore fall under different privacy rules.

The California law requires separate express consent for each transfer or disclosure of genetic data or a biological sample to a third party other than a service provider, including the recipient’s name. Separate consent is also needed to store the sample after the initial test and for each later use beyond the original test’s purpose and the uses directly connected to it. The law makes an exception for research: a public or private nonprofit postsecondary institution does not count as a third party when data or a sample is disclosed to it for the scientific research or educational activities the law specifies. To qualify, the institution must hold an assurance filed with the U.S. Department of Health and Human Services under federal human-research rules and must follow applicable federal and state protections for research participants.

California requires sample destruction within 30 days of receiving a consumer’s revocation of consent to store it. It also requires accessible account and genetic-data deletion procedures, except for genetic data that must be retained to meet legal or regulatory requirements. Because of that exception, the right to delete is not a promise that every trace will disappear.

The law generally bars genetic-data disclosure to insurance or employment decision-makers and their advisers. A limited exception applies only when all of these are true: the recipient is not primarily engaged in insurance or employment administration, it does not receive the data in its role as a decision-maker or adviser, and any division or agent of it that handles those decisions is barred from accessing the data.

Company policies require a closer reading

Ancestry: advertising data and genetic data are different

Ancestry says that outside targeted advertising, it does not sell or share personal information; it separately describes sharing for targeted advertising. It says it does not sell or share genetic information with third-party marketers, insurers or employers, and that genetic marketing or personalized advertising requires explicit consent. So a notice about advertising cookies is not, on its own, a statement that DNA results are being sold to advertisers.

Ancestry says it shares deidentified genetic information with research partners only with express research consent, excluding people who do not provide that consent. Its privacy statement also describes laboratories, shipping companies, payment processors and cloud providers that help operate the service under contractual privacy and security obligations. A promise not to sell data, in other words, does not mean no one else handles it.

Ancestry describes its Family History membership and DNA test as separate products that can work separately or together.

Helix: identify the applicable notice and consent

Helix’s HIPAA notice applies to germline genetic testing and related health screening and risk assessment services; other activities fall outside that notice. Helix is a genetics company that collaborates with researchers studying how genetics affects human health. Its privacy notice says some personal-information disclosures may count as sales or shares under applicable law, and lists advertising networks and analytics providers as recipients of identifiers. The notice says sensitive data are used and disclosed only for legally authorized purposes. That language does not establish that Helix sells identifiable genetic results to advertisers.

Helix says it will not share information with third-party researchers without consent and allows people to opt out of research invitations. The company describes physical, technical and organizational safeguards but says no data-security measures can guarantee security. It directs customers seeking deletion of personal and genetic information to a separate deletion request; closing an account alone leaves information retained under its policies. To assess a specific Helix service, check its test or research agreement alongside the privacy notice.

GeneSight: laboratory records

GeneSight is one of the genetic tests offered by subsidiaries of Myriad Genetics; Assurex is the subsidiary for mental health tests. Myriad’s HIPAA notice says those subsidiaries are covered entities under HIPAA that act together as one affiliated covered entity. A clinician-ordered laboratory result should therefore be read under the laboratory’s medical privacy notice, not assumed to follow the same rules as an ancestry account. Myriad’s notice permits uses and disclosures for treatment, payment and health care operations. The notice says written authorization is required for disclosures that constitute a sale of protected health information under HIPAA. A patient may revoke a disclosure authorization in writing, stopping future authorized use or disclosure except where Myriad or its business associates have already acted in reliance on it.

An enforcement case shows what can go wrong

In a complaint announced in June 2023, the FTC accused 1Health.io, a genetic testing firm formerly known as Vitagene, of misleading consumers about privacy, deletion and sample destruction. The FTC alleged that a 2020 policy change retroactively expanded potential data recipients to supermarket chains and nutrition or supplement manufacturers without notifying existing customers or obtaining their consent. The allegation concerned a change in what could be done with information people had already supplied; that is a different claim from proving that customers’ DNA was actually sold.

The FTC also alleged that the company stored raw genetic data in publicly accessible cloud storage, sometimes with a first name. In 2023, the FTC finalized an order settling the charges against 1Health.io. The settlement required affirmative express consent for third-party health-data sharing and instructions to laboratories to destroy samples retained for more than 180 days. Enforcement came afterward: the settlement resolved the FTC’s charges, but it could not undo the exposure the FTC alleged.

Business transfers and government access follow different routes

In a March 31, 2025 letter, FTC Chairman Andrew N. Ferguson expressed concern about a potential sale or transfer of sensitive information in 23andMe’s bankruptcy and the need to keep privacy promises. In a July 30, 2025 consumer notice, Utah officials reported approval of the sale of 23andMe’s assets, including genetic data and samples, to TTAM, a nonprofit created by 23andMe’s founder. TTAM, a nonprofit research institute, says Anne Wojcicki founded and leads it; it completed the acquisition of 23andMe’s Personal Genome Service and Research Services businesses on July 14, 2025. The notice said TTAM would retain policies allowing account, genetic-data and sample deletion and research opt-outs, with Utah monitoring the transition. Ancestry’s privacy statement likewise allows personal information to pass to an acquiring business, including in bankruptcy, while its privacy promises continue to apply.

Ancestry says it does not voluntarily give customer data to law enforcement and requires a valid, legally binding court order. It also bars law enforcement and people working on its behalf from using the platform to investigate crimes or identify remains. Its privacy statement says it may share personal information if it believes doing so is reasonably necessary to comply with laws or valid legal process, enforce its terms, protect its services, or protect rights, property or safety. For 2025, Ancestry reported zero valid requests for customer DNA data, nine valid requests for non-DNA data and responses to seven of those requests. That is a report on one year, not a guarantee that future legal process cannot reach customer information.

The Justice Department’s forensic genetic genealogy policy describes comparing shared DNA blocks between a forensic sample and potential relatives to generate investigative leads. The policy permits searching only genealogy services that explicitly notify users and the public that law enforcement may use them. The policy covers criminal investigations conducted by Justice Department agencies and specified genealogy work involving Department funding, employees or contractors. It supplies internal Department guidance and does not create enforceable individual rights. Both routes, a court order to a company and an investigator’s search of a genealogy service, are different from the government buying a company’s genetic dataset.

Deletion, research withdrawal and family privacy need separate decisions

Ancestry says it will destroy biological samples if storage consent is refused, and accepts destruction requests through Member Services or account deletion. Its research consent allows withdrawal in account settings and says use for the project will stop within 30 days. Data cannot be withdrawn from research already in progress or completed, or from published findings.

In a March 21, 2025 alert about 23andMe’s reported financial distress, California’s attorney general described separate controls for deleting account and genetic data, destroying stored samples and revoking research consent. 23andMe’s May 19, 2026 policy allows account deletion in Account Settings, automatically opting users out of research and discarding samples, subject to retention requirements and exceptions. Completed or published research is not reversed, and sample destruction after laboratory analysis remains subject to legal and regulatory requirements. The company or its genotyping laboratory retains genetic information, birth date and sex when legally required, and limited account or deletion-request information for legal, contractual, claims or compliance purposes. With any testing company, check sample storage, results deletion and research consent separately instead of relying on the word delete alone, and keep the company’s confirmation of each request.

The FTC warns that DNA reveals information about relatives as well as the person taking a test, and that hacking remains possible even when sharing is restricted. That matters for a parent thinking of posting a child’s DNA profile online: the decision involves more than the parent’s own information. Consider the child’s future control and relatives’ privacy before publishing a profile, rather than treating online disclosure as an ordinary family photo.

Whether companies should be able to sell genetic data is a policy question, and the laws and cases above point to what it turns on: meaningful permission, enforceable limits and the ability to change course.

The FTC invites consumers to report genetic-testing companies that do not live up to their promises.