Can DNA Testing Companies Sell Your Genetic Data?

Last updated 1 day ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.

Ancestry customers can get their DNA results without agreeing to the company’s research project. Agreeing adds a permission that can be difficult to reverse: Ancestry says data cannot be withdrawn from research already underway or completed, or from published findings.

Research sharing is different from a sale, and selling the company creates another route for information to move. Ancestry’s privacy statement allows personal information to pass to an acquiring business, including in bankruptcy, while its privacy promises continue to apply.

Taking a test is different from making DNA public

Ancestry’s terms allow its laboratories to extract and test DNA, store DNA data, and disclose results to the customer and people the customer authorizes. The terms also describe relative matching as a service that customers can choose whether to join. Those permissions describe controlled uses of a test, rather than making its results public property available to anyone.

Ancestry distinguishes the physical sample and extracted DNA from genetic information such as ancestry estimates and relative matches. Destroying the sample and deleting the information derived from it therefore answer different privacy questions. A sample can be gone while a previously produced dataset remains subject to its own retention or research rules.

The National Human Genome Research Institute says researchers have identified people by combining deidentified genomic information with other publicly available information. Deidentified means the data are separated from identifying details; it does not mean identification has become impossible. Consent to a research dataset deserves attention even when names are removed.

Federal laws protect different parts of the problem

The federal Health Insurance Portability and Accountability Act (HIPAA) definition of a covered entity includes health plans, health care clearinghouses and health care providers that transmit health information electronically in covered transactions. A clearinghouse processes health information for standard transactions; the definition does not include every business holding information about health. HIPAA coverage depends on the organization and its functions, rather than on the fact that a DNA result contains sensitive information.

The Genetic Information Nondiscrimination Act, or GINA, bars covered employers from using genetic information in employment decisions. It also bars health insurers from using genetic information to decide eligibility, coverage, underwriting or premiums. GINA’s health insurance protections do not cover life, disability or long-term-care insurance, although some states add protections. A restriction on discrimination is not the same as a complete prohibition on collecting or transferring a genetic record.

The Federal Trade Commission (FTC) Health Breach Notification Rule requires vendors of personal health records and related entities outside HIPAA to notify people and the FTC after a qualifying breach, and sometimes to notify the media. The rule includes unauthorized disclosures as well as data-security breaches. A breach can involve a company sending information to an unauthorized recipient, rather than someone breaking into a server. Notification is a response to a disclosure; it cannot make that disclosure never have happened.

State consent rules can add more control

California’s consumer genetic-privacy law defines a consumer as a California resident and covers companies offering consumer-initiated genetic tests, certain genetic-data analysts and entities handling consumer-provided or consumer-test data. Its exclusions include medical information governed by California medical-confidentiality law and protected health information handled under the specified HIPAA rules. A consumer ancestry kit and a test handled within regulated medical care can consequently follow different privacy frameworks.

The California law requires separate express consent for each transfer or disclosure of genetic data or a biological sample to a third party other than a service provider, including the recipient’s name. Separate consent also covers storing the sample after the initial test and each later use beyond the original test’s purpose and uses directly connected to that purpose. The consent paragraph excludes qualifying disclosures to public or private nonprofit postsecondary institutions for the specified scientific research or educational activities from its definition of a third party. To qualify, the institution must hold a federal human-subjects research assurance and conduct those activities in compliance with applicable federal and state protections for research participants. The recipient and the purpose matter, so a single permission to perform a test should not be read as blanket permission for every later use.

California requires sample destruction within 30 days of receiving a consumer’s revocation of consent to store it. It also requires accessible account and genetic-data deletion procedures, except for genetic data that must be retained to meet legal or regulatory requirements. The right to delete is substantial, but its retention exception makes it different from a promise that every trace will disappear.

The law generally bars genetic-data disclosure to insurance or employment decision-makers and their advisers. A limited exception permits disclosure to a qualifying multipurpose entity only when it is not primarily engaged in those functions, receives the data outside that role and keeps the relevant divisions or agents from accessing it. These are California rules for the covered setting, rather than a uniform national permission form.

Company policies require a closer reading

Ancestry: advertising data and genetic data are different

Ancestry says that outside targeted advertising, it does not sell or share personal information; it separately describes sharing for targeted advertising. It says it does not sell or share genetic information with third-party marketers, insurers or employers, and that genetic marketing or personalized advertising requires explicit consent. A notice about advertising cookies therefore should not automatically be read as a statement that DNA results are being sold to advertisers.

Ancestry says it shares deidentified genetic information with research partners only with express research consent, excluding people who do not provide that consent. Its privacy statement also describes laboratories, shipping companies, payment processors and cloud providers that help operate the service under contractual privacy and security obligations. A no-sale assurance does not remove the need to understand either relationship.

Ancestry describes its Family History membership and DNA test as separate products that can work separately or together. Access to its historical-record service is therefore not conditional on taking a DNA test.

Helix: identify the applicable notice and consent

Helix’s privacy notice says some personal-information disclosures may count as sales or shares under applicable law, and lists advertising networks and analytics providers as recipients of identifiers. The notice says sensitive data are used and disclosed only for legally authorized purposes. That language does not establish that Helix sells identifiable genetic results to advertisers. A general website notice should not be treated as the complete consent agreement for a particular test or research program.

Helix says it will not share information with third-party researchers without consent and allows people to opt out of research invitations. Helix directs customers seeking deletion of personal and genetic information to a separate deletion request; closing an account alone leaves information retained under its policies. Open Helix’s deletion-request form. It describes physical, technical and organizational safeguards but says no data-security measures can guarantee security. To assess a specific Helix service, check its test or research agreement alongside the privacy notice.

GeneSight: laboratory records differ from website information

Myriad’s HIPAA notice identifies its covered laboratory subsidiaries, including the Assurex operation offering GeneSight, as part of an affiliated covered entity. The notice says written authorization is required for disclosures that constitute a sale of protected health information under HIPAA. A clinician-ordered laboratory result should therefore be evaluated under the laboratory’s medical privacy notice, rather than assumed to follow the same rules as an ancestry account. Myriad’s notice permits uses and disclosures for treatment, payment and health care operations. A patient may revoke a disclosure authorization in writing, stopping future authorized use or disclosure except where Myriad or its business associates have already acted in reliance on it.

An enforcement case shows what can go wrong

In a complaint announced in June 2023, the FTC accused 1Health.io, formerly Vitagene, of misleading consumers about privacy, deletion and sample destruction. The FTC alleged that a 2020 policy change retroactively expanded potential data recipients to supermarket chains and nutrition or supplement manufacturers without notifying existing customers or obtaining their consent. The alleged problem was a change in what could be done with information people had already supplied. That is a different claim from proving that every customer’s DNA was actually sold.

The FTC also alleged that Vitagene stored raw genetic data in publicly accessible cloud storage, sometimes with a first name. In 2023, the FTC finalized an order settling the charges against 1Health.io. The settlement required affirmative express consent for third-party health-data sharing and instructions to laboratories to destroy samples retained for more than 180 days. A privacy promise can be enforced after an alleged violation without having prevented the exposure in the first place.

Business transfers and government access follow different routes

In a March 31, 2025 letter, FTC Chairman Andrew N. Ferguson expressed concern about a potential sale or transfer of sensitive information in 23andMe’s bankruptcy and the need to keep privacy promises. In a July 30, 2025 consumer notice, Utah officials reported approval of the sale of 23andMe’s assets, including genetic data and samples, to the nonprofit TTAM. The notice said TTAM would retain policies allowing account, genetic-data and sample deletion and research opt-outs, with Utah monitoring the transition. The example shows why acquiring a company is a privacy event even when the service continues and deletion rights remain. Permission for a business transfer is not permission for the new owner to ignore every existing protection.

Ancestry says it does not voluntarily give customer data to law enforcement and requires a valid, legally binding court order. It also bars law enforcement and people working on its behalf from using the platform to investigate crimes or identify remains. For 2025, Ancestry reported zero valid requests for customer DNA data, nine valid requests for non-DNA data and responses to seven of those requests. This is a dated report of requests, rather than a guarantee that a future court order cannot reach customer information.

The Justice Department’s forensic genetic genealogy policy describes comparing shared DNA blocks between a forensic sample and potential relatives to generate investigative leads. The policy permits searching only genealogy services that explicitly notify users and the public that law enforcement may use them. The policy covers criminal investigations conducted by Justice Department agencies and specified genealogy work involving Department funding, employees or contractors. It supplies internal Department guidance and does not create enforceable individual rights. Investigators using a genealogy database and the government buying a company’s entire genetic dataset are different transactions. Company access rules and the rules governing an investigation must both be examined; a general fear that DNA is sold to the government does not identify which route occurred.

Deletion, research withdrawal and family privacy need separate decisions

Ancestry says it will destroy biological samples if storage consent is refused, and accepts destruction requests through Member Services or account deletion. Its research consent allows withdrawal in account settings and says use for the project will stop within 30 days. Data cannot be withdrawn from research already in progress or completed, or from published findings. Withdrawing now can prevent later research use without pulling information out of a study already underway. Check sample storage, results deletion and research consent separately instead of relying on the word delete alone.

California’s attorney general describes separate 23andMe controls for deleting account and genetic data, destroying stored samples and revoking research consent. For any testing account, ask what is removed, what must be retained and whether the request affects future use or existing research. Keep the company’s confirmation so the requested action is clear.

The FTC warns that DNA reveals information about relatives as well as the person taking a test, and that hacking remains possible even when sharing is restricted. Posting a child’s DNA profile is therefore a decision about more than the parent’s own information. Consider the child’s future control and relatives’ privacy before publishing a profile, rather than treating online disclosure as an ordinary family photo. The policy choice over commercial genetic-data use turns on meaningful permission, enforceable limits and the ability to change course, rather than the usefulness of research alone.

The FTC invites consumers to report genetic-testing companies that do not live up to their promises. Before agreeing to a test or a new use, read the permission that governs the actual transfer and the limits on reversing it. The strongest privacy question is whether the next decision still belongs to the person who supplied the DNA.