Collect the privacy statement, terms, research consent and transparency report, then search each for nine topics: sample storage, deletion exceptions, research consent, partner sharing, law enforcement, de-identification, mergers and bankruptcy, data location and breaches.
Good policies name their exceptions specifically and require your explicit consent for anything beyond running your test.
First, find all the documents
A DNA company rarely puts everything in one place. Before you read a word, collect the set:
- The privacy statement (sometimes "privacy notice"). Note its "last updated" or "effective" date.
- The terms of service, which often hold the rules on samples, account closure and disputes.
- The research consent document, usually separate from the privacy statement and agreed to separately.
- A law enforcement guide and a transparency report, if the company publishes them.
- Regional notices, such as a separate notice for EU/UK residents or a US state-specific addendum.
Then use your browser's find-in-page (Ctrl+F on Windows and Linux, Cmd+F on a Mac) for the search terms below. Quotes in this article come from two policies we read in October 2026: the 23andMe Privacy Statement (last updated May 19, 2026) and the Ancestry Privacy Statement (effective May 12, 2026). Policies change, so check the live versions before relying on any wording.
Sample retention and destruction
Search for: "sample", "biobank", "storage", "destroy", "discard".
Your saliva or blood sample is separate from your data. Look for whether storage is opt-in or the default, who physically holds it (often a contracted lab), and how you ask for destruction. Clear wording is a good sign. Ancestry's statement says: "If you do not consent to the storage of your Biological Samples, we will destroy them." 23andMe's says that if you choose to discard your sample, "it will be securely destroyed after the lab completes its analysis."
This clause has teeth. In its 2023 case against 1Health.io (formerly Vitagene), the FTC alleged the company failed to make sure its contract lab destroyed samples as promised; the final order requires it to instruct those labs to destroy samples kept longer than 180 days.
Deletion, and what deletion leaves behind
Search for: "delete", "retain", "legal obligations", "backup", "CLIA".
The most important part of a deletion clause is the list of exceptions. Three are common:
- Lab record-keeping. Clinical labs can have legal retention duties. 23andMe's statement says it or its contracted lab will keep your Genetic Information, date of birth and sex "as required for compliance with applicable legal obligations", citing CLIA and California and accreditation requirements.
- Backups. Ancestry says it will "delete all Genetic Information from our production, development, analytics, and research systems within 30 days", with backup copies taking longer to clear.
- Research already done. Covered in the next section.
None of this is unusual. What matters is that the exceptions are named specifically rather than hidden behind "we may retain information as necessary".
Research consent
Search for: "research", "consent", "withdraw", "IRB", "de-identified".
Research participation should be a separate, optional consent, not a condition of getting your results. Check three things: what is shared (individual-level data or only aggregate statistics), with whom (internal researchers, academic collaborators, commercial partners), and what withdrawal actually stops. Withdrawal usually works going forward only. Ancestry is direct about it: "we will not be able to remove your de-identified Genetic Information from active or completed research projects." 23andMe says research already performed or published before you withdraw will not be reversed or withdrawn.
Sharing with partners, including pharma
Search for: "share", "sell", "partners", "affiliates", "service providers", "individual-level".
Sort every recipient into one of three buckets: service providers working on the company's behalf under contract, research or commercial partners who receive data for their own purposes, and anyone you separately authorize. The second bucket deserves the most attention. Look for a plain promise like 23andMe's: "We will not share individual-level Personal Information without your explicit consent."
Also look for how the company handles policy changes. In the 1Health.io case, the FTC alleged the company expanded third-party sharing in 2020 and applied it to data it already held, without notice or consent. A good policy says material changes to how existing data is used will need your consent, not just a banner on the website.
Law enforcement requests
Search for: "law enforcement", "subpoena", "warrant", "legal process", "transparency".
The key word is voluntarily. Ancestry's statement says: "Ancestry does not voluntarily provide access to user data to governmental or judicial bodies or to law enforcement agencies." 23andMe's says it "will not provide information to law enforcement unless required by law". Both companies point to a published transparency report. Read the report itself: it shows how many requests arrived and how many resulted in disclosure.
If a service offers DNA matching with other users, check its terms for a separate setting about matching in law enforcement investigations, and know which way it defaults.
De-identification language
Search for: "de-identified", "anonymized", "aggregate", "pseudonymized", "coded".
These words aren't interchangeable. Aggregate data is summarized across many people, such as allele frequencies. De-identified or coded data is usually still individual-level, with names and contact details removed. A genome remains distinctive even without a name attached: a 2013 study in Science showed that surnames could be inferred from some research participants' genomes using public genealogy databases. Treat "de-identified" as reduced risk, not zero risk, and look for whether recipients are contractually barred from re-identifying anyone.
Mergers, sales and bankruptcy
Search for: "merger", "acquisition", "bankruptcy", "change of control", "successor".
This is the clause most people skip and the one that mattered most in 2025. Policies tend to take one of two approaches. Ancestry's says data may be shared with an acquirer and "the promises in this Privacy Statement will continue to apply" to the transferred information. 23andMe's current statement goes further for genetic data: it says "we will not sell or transfer your genetic data in connection with any merger, acquisition, bankruptcy" unless the buyer meets set conditions and agrees to adopt the statement. For what happens in practice, see what happens to your DNA data if the company is sold.
Where your data lives
Search for: "transfer", "countries", "Standard Contractual Clauses", "Data Privacy Framework", "located".
Look for the countries where data is stored and processed, and the legal mechanism for international transfers. Ancestry's statement names the United States, Ireland, the United Kingdom and France, and cites Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. If sequencing happens in a different country from the company's headquarters, the policy or FAQ should say so.
Breach notification
Search for: "breach", "incident", "notify", "security".
Don't be surprised if this is thin. In both statements we read, the security section described safeguards but not how or when customers would be told about a breach. Notification duties mostly come from law instead: every US state has a breach notification statute, and definitions of covered data vary. Some health record services that aren't covered by HIPAA fall under the FTC's Health Breach Notification Rule. Our guide to who regulates DNA testing companies covers where those protections stop.
A quick scorecard
- Sample storage is opt-in, and destruction can be requested in your account settings.
- Deletion exceptions are listed specifically (lab retention, backups, completed research).
- Research is a separate, optional consent, and withdrawal is explained honestly.
- Individual-level sharing with partners requires your explicit consent.
- No voluntary disclosure to law enforcement, and a published transparency report.
- The merger or bankruptcy clause limits who can receive genetic data and on what terms.
- Material changes to how existing data is used need your consent.
Our genetic privacy checklist turns these into ten questions you can answer for any company. If you already have a raw data file, the file inspector runs in your browser and identifies the file without uploading it. And if you are still choosing, the test finder helps you decide how much data you actually need to hand over.
Common questions
Does deleting my account delete everything?
Usually not quite. Policies commonly keep some data to meet lab record-keeping laws, clear backups on a delay, and cannot pull data back from research that has already been done. A good policy lists these exceptions plainly.
Is de-identified genetic data anonymous?
Not necessarily. De-identified data usually has names removed but stays individual-level, and genomes are distinctive. Look for contractual bans on re-identification by anyone who receives it.
What does a transparency report tell me?
It shows how many government or law enforcement requests a company received and how it responded. It's the best way to check the company's law enforcement promises against its record.
What should I do if a policy changes after I test?
Read what changed, especially sharing, research and merger clauses. If you no longer agree, you can usually download your data, revoke research consent, request sample destruction and delete your account.
Is this legal advice?
No. It's a reading guide. For questions about your rights under a specific law, contact your state attorney general's office or a lawyer.
Keep going
Sources
Policy quotes were checked against the live 23andMe Privacy Statement (last updated May 19, 2026) and Ancestry Privacy Statement (effective May 12, 2026) in October 2026. Quotes are short excerpts; read the full documents before relying on them. FTC case details are from the FTC's 2023 press releases on 1Health.io. The surname-inference finding is from Science, 2013. We did not quote other companies' policies because we did not review them for this piece, and we left out claims about specific law enforcement matching defaults that we could not confirm.
- 23andMe Privacy Statement
- Ancestry Privacy Statement
- FTC: Order finalized against 1Health.io (Sept 2023)
- Identifying personal genomes by surname inference (Science, 2013)
- FTC: Complying with the Health Breach Notification Rule
Educational content, not medical advice. A genetic result is information, not a diagnosis; for anything medically important, talk to a qualified clinician or genetic counselor. Some outbound links are affiliate links; see the disclosure.