How to Take a DNA Test More Privately: A Practical Checklist
Concrete steps to harden a consumer DNA test against unwanted exposure. Dedicated email, strong password, 2FA, consent choices, raw data download, and account exit.
We get asked for the practical version of the privacy advice often enough that it deserves its own article. The general principles are covered in our DNA testing privacy checklist, which we recommend reading first. This is the operational companion: a specific sequence of decisions that hardens a consumer DNA test account from the moment you decide to buy through to the moment you no longer want it active. None of these steps require special tools or technical skill.
Before you buy the kit
Pick the right test for the right reason. If you want ethnicity composition, AncestryDNA or MyHeritage covers that without health predisposition reports. If you want only health reports without matching, that is a harder ask to satisfy in the consumer market. Our DNA test privacy policies compared shows what each company’s policy actually allows.
Create a dedicated email address for the account. A free Gmail or ProtonMail address used only for this account separates the account from your primary personal identity in obvious cleartext. If the company breaches and account information leaks (which is the most common breach pattern, as our dna-test-data-breach-history documents), the leak does not tie to your primary inbox.
Pick a long, unique password. The 2023 23andMe breach happened through credential stuffing, which only works against reused passwords. A password manager and a 16+ character unique password makes you immune to that specific attack class.
At signup and account creation
Use the dedicated email and the new password. Enable two-factor authentication immediately. Every major consumer DNA company supports 2FA. Our DNA test account security tips covers the per-company 2FA setup.
Use a display name that is not your full real name. Most companies default to your real first name and last initial in match lists. You can change this to a pseudonym or initials. The match still works because the matching uses your DNA, not your name.
Decline the research consent if you do not want your data used for internal or partner studies. This is a separately toggled consent at signup. You can change it later. We cover what it actually grants in research consent in DNA testing explained.
Decline the matching opt-in if you do not want to be visible to other testers. This is also separately toggled. Declining it gives you only the ethnicity composition results and removes you from the matching surface entirely. This was the surface that amplified the 2023 breach from 14,000 directly-affected accounts to roughly 6.9 million match-exposed users.
If you do want matching, leave display name and profile minimal. Display name is what other testers see.
After you receive results
Download your raw DNA data immediately. Every major consumer test allows this. AncestryDNA, 23andMe, MyHeritage, FamilyTreeDNA all offer raw data export. Keeping a copy on your own machine (in encrypted storage) is your strongest hedge against future company changes. Our how to download your raw DNA data walks through the steps per company.
If you uploaded the raw data to GEDmatch or another public matching service for additional matching coverage, decide consciously whether you want it there. GEDmatch’s opt-in for forensic genealogy searches is a separate decision from being on GEDmatch at all. The genetic genealogy and cold cases article covers this.
When you no longer want the account active
Delete the account through the company’s account deletion flow. This is a separate step from canceling any subscription. Our how to delete your 23andMe data and how to delete your AncestryDNA data walk through the deletion flows in detail.
Request sample destruction. Account deletion does not automatically destroy the physical biological sample held in the lab’s cold storage. That is a separate request, sometimes only available through customer support. The privacy policy will name the path; it is usually buried.
Confirm completion in writing. Companies typically email a deletion confirmation. Keep it. If you ever need to demonstrate that you exercised your deletion right (under California’s GIPA, GDPR, or similar laws), the confirmation is the evidence.
What this routine does not protect against
A few honest limitations.
Relatives’ choices. If your sibling, cousin, or parent tests at a company that offers matching and they opt in, your shared DNA segments are inferentially exposed through them. You cannot opt their data out. We cover this in family implications of DNA testing.
Subpoenas and warrants. A US-based company that holds your data can be compelled by a court to produce it. The published DNA testing and law enforcement article covers the warrant process and the published transparency reports.
Future policy changes. The privacy policy you accept today can change with notice tomorrow. Re-reading the policy periodically and being prepared to delete are the only real protections.
This article sits inside our genetic data privacy pillar. For the broader pre-purchase checklist, see DNA testing privacy checklist, and for the policy comparison see DNA test privacy policies compared.