Who Owns Your DNA? The Hidden Risks of At-Home Genetic Tests
You send off a saliva sample, wait a few weeks, and voilà—you find out you’re 32% Scandinavian. It’s fun, it’s fast, and it feels empowering. But when you take an at-home DNA test from companies like 23andMe or Ancestry, you may be giving away more than you bargained for.
So let’s ask the question: Who really owns your genetic data—and what can be done with it?
How At-Home DNA Tests Work
Companies like 23andMe, AncestryDNA, MyHeritage, and others analyze your genetic code to give you:
Ancestry breakdowns (e.g., ethnic origins, migration paths)
Health risk assessments (e.g., predispositions to certain diseases)
Carrier status for inherited conditions (e.g., cystic fibrosis)
Personalized reports on traits like sleep patterns or caffeine tolerance
But behind the scenes, they’re also collecting one of the most sensitive data sets possible: your unique genetic blueprint.
Ownership vs. Access: The Legal Gray Area
When you provide your DNA sample:
You typically retain ownership of the physical sample and raw data, but...
You grant the company a license to use, store, and sometimes even share that data.
This license is often broad and long-term, especially if you consent to "research use." This means your DNA data may be:
Shared with pharmaceutical companies for drug discovery and development.
Used in academic or commercial research studies.
Stored in databases for years, even after you've canceled your account or requested deletion (though some companies do offer deletion options).
For example, in 2018, 23andMe announced a $300 million deal with GlaxoSmithKline to use customer data for drug development. While customers consented, they received no direct payment for the use of their genetic information. More recently, in 2025, 23andMe's data assets were acquired by Regeneron Pharmaceuticals following bankruptcy proceedings, further highlighting how valuable this data is to pharmaceutical giants.
Can Police Access Your Genetic Data?
Yes—under certain conditions.
Law enforcement can:
Request access through a warrant or subpoena directly from the DNA testing company. Companies vary in their cooperation, with some (like 23andMe) requiring legal orders and others having less stringent policies.
Search public genealogical databases like GEDmatch, where users voluntarily upload raw data for family tree research. This was famously used in the Golden State Killer case, where police identified a suspect by matching crime scene DNA to a distant relative's public profile.
This raises serious privacy concerns, especially if you didn’t upload your own data—but a relative did, effectively exposing parts of your shared genetic information to potential searches. After public outcry, some open-source databases like GEDmatch have changed their policies to require users to "opt-in" specifically for law enforcement matching.
What Are the Medical and Insurance Risks?
Genetic data can reveal predispositions to serious conditions like cancer, Alzheimer’s, or heart disease.
While U.S. federal law, specifically the Genetic Information Nondiscrimination Act (GINA), protects against genetic discrimination by health insurers or employers (e.g., they cannot deny you health insurance or a job based on your genetic information), it has significant limitations:
It does NOT cover life insurance, disability insurance, or long-term care policies.
This means:
A life insurer might deny you coverage or charge higher premiums based on disclosed DNA test results.
You may unintentionally disclose sensitive data when sharing raw results with third-party analysis apps that have weaker privacy protections.
How to Protect Yourself
If you're considering (or have already used) an at-home DNA test, here’s how to guard your rights:
Read the privacy policy carefully—especially the data sharing clauses and consent for research use. Don't just click "I agree."
Opt out of research use unless you're 100% comfortable with your data being used for commercial or academic studies.
Avoid uploading raw data to third-party analysis tools that may have less robust privacy standards than the original testing company.
Delete your data and sample if you no longer want it stored. Many companies offer this option in their account settings, though the effectiveness of full deletion can vary.
Remember: DNA is not just data—it’s identity.
So, Who Really Owns Your DNA?
Legally, you may own the physical sample and the raw data. But the moment you send it in, you’ve likely granted a private company extensive rights to use and store that information—possibly irrevocably, especially if you consented to research.
And in the digital age, once data is shared, it’s almost impossible to fully take back.
The promise of genetic insight is real—but so are the risks. Before spitting in that tube, make sure you understand what else you might be giving away. Because when it comes to your DNA, knowledge is power—but privacy is everything.
Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. For specific legal guidance regarding your situation, please consult with a qualified legal professional.