DNA Test Privacy Comparison: How Each Major Brand Handles Your Data
Research-sharing defaults, breach history, deletion mechanics, jurisdiction and corporate stability across the five major consumer DNA tests.
Picking a DNA test on price alone ignores what happens to the genetic data afterward. Defaults vary, breach histories vary, and the legal jurisdiction your data lands in matters. Here is a privacy-focused side by side of the five mainstream consumer tests as of early 2026. Our full privacy pillar goes much deeper.
Research-sharing defaults
Most consumer DNA tests ask whether you want to share de-identified data with research partners. The default and the wording matter.
- AncestryDNA requires explicit opt-in for the Informed Consent to Research. Opt-in is not on by default.
- 23andMe historically asks for research consent during setup. The 2025 corporate reshuffling has changed who holds that research data; see the caveat below.
- MyHeritage DNA does not run a comparable research consent program.
- FamilyTreeDNA has a separate law-enforcement matching opt-in, which is distinct from research. Read both settings.
- Living DNA is UK-headquartered and applies UK research consent norms.
Default settings shift, so check your account’s actual privacy dashboard rather than relying on what was true the year you took the test.
Breach history
23andMe disclosed in late 2023 that credential-stuffing attacks reached data on roughly 6.9 million users, including some ethnicity and relative-match data. That breach is part of the story behind the company’s later financial trouble. The other four brands have not had a comparable consumer-scale breach, though no company is immune.
Corporate stability and jurisdiction
This is the section that matters most in 2026.
23andMe filed Chapter 11 in March 2025 and the genetic data and core assets were sold to TTAM Research Institute, a nonprofit founded by co-founder Anne Wojcicki, in mid-2025. The consumer test still operates, but corporate stability, the privacy story and the affiliate program are all moving targets. We mark 23andMe status:“verify” across the site for that reason. Our genetic data privacy guide covers the situation in depth.
The other four brands are stable as of this writing. AncestryDNA is held by Blackstone. MyHeritage is held by Francisco Partners. FamilyTreeDNA is privately held under myDNA. Living DNA is privately held and UK-headquartered, which puts it under UK and EU privacy law including GDPR rights of access, correction and erasure.
Deletion mechanics
All five tests let you delete the account and request destruction of the stored biological sample. The friction varies. AncestryDNA and MyHeritage offer self-service deletion from the account dashboard. 23andMe and FamilyTreeDNA may require a support request to confirm sample destruction. Living DNA’s GDPR right to erasure is the strongest on paper.
A deletion request does not retroactively pull back data already shared to research partners under prior consent. That is one of the most important and most underexplained pieces of consumer DNA privacy.
How to read this section
Privacy is not one variable. It is a stack: who holds the data, what they can do with it, how easy it is to revoke consent, and how solid the company itself is. For the full deep dive, the genetic data privacy pillar walks through each layer.
For other comparison angles, see our feature comparison, price comparison and turnaround comparison. The DNA test comparison pillar collects every head-to-head we have published.