Before donating DNA data, find out whether the consent covers one study or broad future use, who the data may be shared with, and whether results come back to you. Ask what withdrawal actually removes.
“De-identified” DNA can sometimes be re-identified, and data already used in research usually cannot be recalled. A Certificate of Confidentiality adds legal protection, but not every study has one.
Sharing your DNA with researchers can be a generous thing to do. Genetic studies need large numbers of participants, and many need people from groups that have been left out of past research. But a genome is unusually personal and unusually permanent. It also says something about your relatives, who never signed anything. Before you tick the box, it helps to know what kind of research you are joining, what the consent actually covers, and what you can and cannot take back later.
Three common routes into research
Company research programs
Some consumer DNA companies run research programs that are separate from the testing service and have their own consent. One example is the research consent of the 23andMe Research Institute. It describes participation as voluntary, overseen by an independent review board, and changeable in account settings. Its own document also says that withdrawing stops use in new research after 30 days, while research already performed or published will not be reversed. Read the research consent itself, not just the privacy policy. They are often different documents.
Academic and hospital studies
University and hospital studies recruit people for specific questions, such as a disease, a drug response or a population. They usually involve an institutional review board (IRB) and a consent form you can take home and read. Some ask for a new sample. Others may ask for an existing data file, so know what you are handing over. The file inspector identifies a DNA file locally in your browser without uploading it.
National research programs
The NIH’s All of Us Research Program is building a large, diverse health database for research. Depending on what participants agree to, it collects health surveys, electronic health records, data from connected wearables, biosamples (blood, urine or saliva), and physical measurements such as height, weight and blood pressure.
All of Us does offer genetic results, and they are optional. Participants can receive genetic ancestry information, a hereditary disease risk report, and a report on how their body may process certain medicines. When the program began returning health-related results in December 2022, the NIH said the hereditary disease risk report covered 59 genes and variants and the medicine report covered seven genes. Participants choose which results they want, if any, and genetic counselors are available to discuss them. Even research results like these deserve a clinical conversation. Our guide to confirmatory testing explains how that works.
Specific consent vs broad consent
Specific consent covers one study with a stated purpose. Broad consent lets researchers store your identifiable information or samples and use them for future studies that have not been designed yet. The revised federal Common Rule, the main regulation for government-funded human-subjects research in the US, formally allows broad consent. Organizations must follow it from January 21, 2019. When broad consent is used, 45 CFR 46.116(d) requires the form to tell you:
- the general types of research that may be done;
- what information or samples may be used, whether they may be shared, and with what kinds of institutions or researchers;
- how long they may be stored and used, which may be indefinitely;
- that you may not be told about specific studies, unless the program will disclose them; and
- that clinically relevant results may not be returned to you, unless the program will always return them.
The same regulation requires consent forms for research with biospecimens to say whether the research will or might include whole genome sequencing. Forms must also say whether your data could be stripped of identifiers and reused, or shared with other investigators, without asking you again. Those two lines are worth finding before you sign.
What "de-identified" can and cannot promise
Removing your name and contact details is a real protection, and programs like All of Us replace direct identifiers with a code before researchers get access. But DNA itself carries identifying information. Two peer-reviewed studies show how:
- Gymrek et al., Science (2013). Researchers took Y-chromosome markers from publicly available research genomes and searched them in recreational genealogy databases that link those markers to surnames. Combined with other public information, the recovered surnames let them identify nearly 50 research participants.
- Erlich et al., Science (2018). Using genomic data from 1.28 million consumer-genomics customers, the authors projected that about 60% of searches for people of European descent would turn up a third-cousin or closer match. In theory, that allows identification with a few demographic details. They also showed the technique could identify a participant in a public sequencing project.
Your genome is shared data by nature. Your parents, siblings and children share large parts of it. Treat "de-identified" as "harder to link to you," not "impossible to link to you." That matters most for sensitive findings and for data released openly rather than through controlled access.
Withdrawal: what you can and cannot take back
Under the Common Rule, consent forms must say that participation is voluntary and that you can stop at any time without penalty. Stopping, though, is not the same as erasing. Data already analyzed, shared or published generally cannot be recalled. All of Us puts it plainly: if researchers already have your information, the program cannot get it back. It does offer a withdrawal option where your data is no longer used for new studies and your samples are destroyed. Before you join, find out:
- whether withdrawal stops future use only, or also deletes stored data and destroys samples;
- how long the program takes to act on a request; and
- what copies partner researchers may keep.
Certificates of Confidentiality
A Certificate of Confidentiality is a US federal protection for research participants. According to the NIH, it prohibits researchers from disclosing identifiable, sensitive research information to anyone not connected to the research, including in response to legal demands such as a subpoena. Since October 1, 2017, under NIH policy implementing the 21st Century Cures Act, NIH-funded research that collects identifiable, sensitive information is automatically deemed to have one.
There are exceptions. Disclosure is allowed when required by federal, state or local law (but not for legal proceedings), when necessary for your medical treatment and you consent, when you consent, and for other scientific research that complies with human-subjects protections. Research not funded by NIH may be able to apply for a certificate, but it is not automatic. If the consent form does not mention one, ask.
Questions to ask before you say yes
- Is this specific consent for one study, or broad consent for future research?
- Who runs the program, and which review board oversees it?
- Will my data or samples be shared with other institutions or companies, and in what form?
- Is shared data released openly, or only through controlled access with a data-use agreement?
- Will the research include whole genome sequencing?
- Will I get any individual results back, and will a genetic counselor be available if I do?
- How long will my data and samples be stored?
- If I withdraw, what happens to stored data, samples and analyses already done?
- Is the study covered by a Certificate of Confidentiality?
- What happens to my data if the company or program is sold, merged or shut down?
For the company side of the same questions, including how long data is kept, deletion and ownership changes, work through our genetic privacy checklist and our explainer on what happens to your data when a DNA company is sold. If you already have results in hand, the I have results page helps you figure out what kind of result you have.
Common questions
Does the All of Us Research Program return genetic results?
Yes, optionally. Participants can choose to receive genetic ancestry, hereditary disease risk and medicine-response reports, and genetic counselors are available to discuss them.
What is broad consent?
Broad consent lets researchers store your identifiable data or samples and use them in future studies not yet designed. Under the revised Common Rule, the form must describe the types of research, sharing, and how long storage lasts.
Can de-identified DNA data be traced back to me?
Sometimes. Peer-reviewed studies have shown that research participants can be re-identified using genealogy databases and public records, so treat de-identification as risk reduction rather than a guarantee.
If I withdraw from a study, is my data deleted?
Not always. Withdrawal typically stops new use, and some programs destroy stored samples, but data already analyzed, shared or published generally cannot be recalled.
What does a Certificate of Confidentiality protect?
It bars researchers from disclosing identifiable, sensitive research information to people outside the research, including in response to subpoenas, with limited exceptions such as your own consent.
Keep going
Sources
Checked October 2026: 45 CFR 46.116 on eCFR (broad consent elements, whole genome sequencing statement, identifier-removal statement), the CRS summary of the revised Common Rule’s January 21, 2019 compliance date, the All of Us participant site and NIH’s December 2022 return-of-results release, All of Us privacy and withdrawal language (via a UAB All of Us partner page), the 23andMe Research Institute research consent, the Gymrek 2013 and Erlich 2018 Science papers (via institutional summaries and abstract), and NIH notice NOT-OD-17-109 on Certificates of Confidentiality. We did not include participant payment amounts, enrollment totals, or the policies of specific academic biobanks.
- eCFR: 45 CFR 46.116, general requirements for informed consent
- NIH: All of Us returns genetic health-related results (Dec 2022)
- All of Us Research Program: participant information
- Whitehead Institute: summary of Gymrek et al., Science (2013), surname inference
- Erlich et al., Science (2018): identity inference via long-range familial searches
- NIH NOT-OD-17-109: Certificates of Confidentiality policy
Educational content, not medical advice. A genetic result is information, not a diagnosis; for anything medically important, talk to a qualified clinician or genetic counselor. Some outbound links are affiliate links; see the disclosure.