Genetic Data Privacy and Safety: The 2026 Guide

DNA data is genuinely different from other personal data. You cannot rotate it the way you would a leaked password, your sequence is also partially the sequence of relatives who never consented to a test, and the buyer-and-seller landscape for the companies that hold it has turned over significantly in the past two years. The right moment to think about what happens to your sample, the genotype data derived from it, and the consent you click through at signup is before you mail the kit, not after.

This pillar covers everything we know about genetic data privacy in 2026. What the major companies actually do with your data, how to delete it, who has gotten to it through breaches or law enforcement requests, and what laws like GINA, GDPR, and the patchwork of US state genetic-privacy statutes actually protect.

The 23andMe situation, briefly

The 23andMe situation is what makes this an urgent topic right now. In March 2025 the company filed for Chapter 11 bankruptcy. Its genetic data and core operating assets were sold to TTAM Research Institute, a nonprofit founded by 23andMe co-founder Anne Wojcicki, in mid-2025. The wind-down plan was approved by the bankruptcy court later that year. The consumer service still operates under new ownership, but three things changed in ways that matter for privacy: the corporate entity holding the data is different from the one most users consented with; the company that experienced the 2023 breach affecting roughly 6.9 million users is no longer the company storing the data going forward; and the legal mechanics of what a future owner can do with that data are now a live question rather than a theoretical one. We cover the bankruptcy timeline, the TTAM transfer, the breach settlement, and the practical “how do I delete my data” steps in dedicated articles below.

Why the rest of the field matters too

23andMe is the headline case but it is not unique. Nebula Genomics shut its consumer service down in February 2025. MyHeritage has had its own historical breach. Every major test runs a research-sharing program that defaults to either opt-in or opt-out, and the difference matters more than the marketing copy suggests. We treat each company’s policies as moving targets and verify them against the live policy pages, not the press releases.

A few principles that apply to any test you choose.

Read the consent screen at signup. The opt-in for research participation is usually separate from the basic terms of service, and you can decline it without losing access to your results.

If a company lets you download your raw DNA data, do it. It is your strongest hedge against a company shutting down, being acquired, or changing its policies after you have already paid.

“Delete my account” is not the same as “destroy my sample.” They are usually two separate requests, and skipping the second one leaves your physical biological sample in cold storage with the lab.

For our public privacy-and-buying checklist, see the DNA testing privacy checklist. For the comparison tool that shows each company’s policies side by side in neutral factual chips, see Genetic Privacy Comparison.