DNA Test Privacy Policies Compared (2026)

Privacy policies are written by lawyers for lawyers, which is the polite way of saying they are not built for comparison. We have read through the policies of the four major consumer testing companies and pulled out the dimensions that actually differ across them. The result is the matrix below.

A note on 23andMe. As of early 2026, the company is operating under TTAM Research Institute’s ownership following the 2025 bankruptcy. Privacy policy language is being updated to reflect the new ownership. We have noted the verify caveat where the position is in transition, but read the current policy on 23andme.com before relying on any specific clause.

The dimensions that matter

Default research-sharing. Whether the company shares your de-identified data with research partners by default (opt-out) or only after an explicit yes (opt-in).

Sample storage default. Whether the physical saliva sample is retained after analysis or destroyed by default.

Data retention after deletion. What happens to your data when you request account deletion: how much is removed from live systems, what is retained for legal reasons, and how long.

Law enforcement policy. Whether the company requires a subpoena or warrant for access, whether it publishes transparency reports, and whether it allows opt-in matching.

Jurisdiction. Where the data is stored and which legal regime governs it.

Third-party disclosure. Other circumstances in which data may be shared.

Account security. Whether two-factor authentication is available.

AncestryDNA

Research sharing: Opt-in. You separately consent to participate in the Informed Consent for AncestryDNA research; it is not the default.

Sample storage: Stored by default after analysis. You can request destruction separately.

Data retention after deletion: Per the Ancestry Privacy Statement, deletion of test results removes the data from active matching and processing. Limited retention applies for legal and operational reasons.

Law enforcement: Subpoena or warrant required. Ancestry publishes an annual Transparency Report.

Jurisdiction: Primarily United States.

Third-party disclosure: Service providers, with the user’s consent for sharing with third-party applications, and under legal process.

Account security: Two-factor authentication available.

23andMe (verify)

Research sharing: Opt-in. Research consent is separate from the basic terms; you can decline without losing access to results.

Sample storage: Stored by default after analysis unless you opt out.

Data retention after deletion: Deletion removes data from the consumer-facing systems, subject to limited legal retention. As of early 2026, deletion processes operate under TTAM ownership; verify current policy.

Law enforcement: Subpoena or warrant required. 23andMe publishes a Transparency Report.

Jurisdiction: Primarily United States.

Third-party disclosure: Service providers, research partners under opt-in consent, asset transfer per the terms (which is how the TTAM transfer happened).

Account security: Two-factor authentication available.

Caveat: All of the above is in transition under TTAM ownership. See 23andMe bankruptcy: what it means for your data.

MyHeritage

Research sharing: Opt-in for the MyHeritage research program. Separate consent from the terms of service.

Sample storage: Sample handled by a third-party lab. Retention policies have varied; check the current policy.

Data retention after deletion: Deletion of DNA data removes the genotype data; the broader MyHeritage account may continue separately depending on what you delete.

Law enforcement: Subpoena or warrant required for non-public data. MyHeritage has publicly stated it does not voluntarily cooperate with law enforcement queries.

Jurisdiction: Israel-headquartered; data may be processed in Israel, the European Union, and the United States.

Third-party disclosure: Service providers, research partners with consent.

Account security: Two-factor authentication available.

Historical note: MyHeritage experienced a credential-stuffing incident in 2018 affecting around 92 million accounts (email addresses and hashed passwords, no raw DNA data).

FamilyTreeDNA

Research sharing: Limited research program; the company is not primarily a research-data-monetization business.

Sample storage: Long-term sample retention is a stated feature of the service. Samples are kept indefinitely for potential future testing (Y-DNA, mtDNA upgrades).

Data retention after deletion: Account and data deletion available through the customer service process.

Law enforcement: This is the most distinctive dimension. FamilyTreeDNA has allowed opt-in law enforcement matching since 2019 under its “Law Enforcement Matching” setting. Users can opt out. AncestryDNA and 23andMe do not have this option; access requires subpoena or warrant.

Jurisdiction: United States (Houston, Texas).

Third-party disclosure: Service providers, optional law enforcement matching for opted-in users.

Account security: Two-factor authentication available.

What to do with this matrix

A few practical takeaways.

If you do not want any law enforcement matching, FamilyTreeDNA requires you to check your setting (opt out). AncestryDNA and 23andMe do not have this dial because they do not allow open matching.

If you do not want to participate in research, all four require an affirmative opt-in. Make sure you actually decline at signup.

If you want your physical sample destroyed, you have to request it separately in all four. Account deletion is not the same action.

If jurisdiction matters to you (for example, GDPR considerations), MyHeritage’s mixed Israel/EU/US processing is different from the US-only processing of the other three.

For deletion steps, see how to delete your 23andMe data and how to delete your AncestryDNA data. For the broader framework, see is it safe to do a DNA test in 2026 and questions to ask before DNA testing.

This piece is part of our Genetic Data Privacy guide.