Trace your commute

Genetics and family data

How genetic testing creates a lasting data trail

DNA samples, derived results, relative matches and research consent create different privacy choices. Read current 23andMe and Ancestry disclosures and their limits.

Sources checked .

Conceptual illustration

The sample and the digital results are separate

Ancestry describes extracting DNA at partner laboratories and converting it into machine-readable data. Its genetic information includes derived ancestry estimates, traits and relative matches. The physical sample and extracted DNA have their own storage choices. Deleting a result and destroying a stored sample are separate tasks in its policy. Ancestry: data and deletion limits

23andMe lists genetic results, sample information, registration details, surveys and browsing information as distinct categories. Its May 19, 2026 U.S. statement describes account deletion subject to legal retention and exceptions, including required laboratory records. Deletion is not a promise that every category disappears immediately. 23andMe: data, sharing and retention

Relative matching can extend the exposure

Ancestry offers controls over appearing to DNA matches, ancestral-origin visibility and invited viewers, collaborators or a manager. Those roles provide different access. A manager has broader powers, including downloading data and deleting results; a matching switch is not the only sharing control. Ancestry: DNA privacy settings

California DOJ announced a May 28, 2026 lawsuit against Chrome Holding Co., formerly known as 23andMe, over the 2023 breach. Its allegations describe reused credentials and exploitation of the DNA Relatives feature to reach information beyond the directly accessed accounts. These are allegations in an announced suit, not findings of a final judgment or an audit of the current operator. California DOJ: lawsuit allegations

Research consent is another layer

23andMe's consent says research can use genetic information, surveys, connected third-party data and platform activity. It describes removing names/contact details and pooling data, while acknowledging possible reidentification and exposure involving relatives. Deidentification is not a guarantee of zero risk. Participation is voluntary and distinct from receiving the core service. 23andMe: research consent and withdrawal

Its biobanking consent permits further analyses of stored samples, including more advanced sequencing, for listed purposes. Permission does not expire unless withdrawn or the account is closed. Research use of samples has its own consent qualification. A storage decision therefore concerns more than keeping the original saliva tube on a shelf. 23andMe: stored samples and withdrawal

New connections and ownership deserve a fresh review

The company announced completion of TTAM's acquisition of the Personal Genome Service and Research Services businesses on July 14, 2025. A completed transaction is different from earlier proposed-sale headlines. The current site identifies 23andMe Research Institute; the California lawsuit names the former company. 23andMe: completed acquisition

A May 20, 2026 company announcement described a HealthEx medical-record connection for a Health Summary offering then in development and available to beta participants. That dated announcement does not establish universal availability today, clinical effectiveness or independently tested deletion. An optional medical-record link introduces another consent and another data holder to review. 23andMe: medical-record connection announcement

Questions and answers

Does a DNA result deletion automatically cover stored samples?

Ancestry's policy gives a separate Member Services route for sample destruction. Check the chosen service's actual process. Ancestry: data and deletion limits

Does removing names make research information risk free?

23andMe's consent acknowledges a possible reidentification risk. 23andMe: research consent and withdrawal

Is the California lawsuit a judgment against the current nonprofit?

The cited announcement identifies Chrome Holding Co., formerly 23andMe, and describes allegations. California DOJ: lawsuit allegations

Sources and scope

Sources checked 10-24-2026, including 23andMe's U.S. statement updated 05-19-2026 and Ancestry's statement effective 05-12-2026. Company privacy promises are attributed to their documents. The dated acquisition, lawsuit and beta-program announcements have separate scopes; they do not establish current security, clinical effectiveness or completed deletion.

Keep exploring