DNA Privacy: What Happens to Your Genetic Data After Testing?

GINA: What the Law Protects — and What It Doesn't

The Genetic Information Nondiscrimination Act (GINA), signed into law in 2008 after over a decade of congressional debate, is the primary federal protection for genetic privacy in the United States. GINA operates in two key domains:

• Title I — Health Insurance: Prohibits group and individual health insurers from using genetic information to determine eligibility, set premiums, or impose pre-existing condition exclusions. Insurers cannot request or require genetic testing as a condition of coverage.
• Title II — Employment: Prohibits employers with 15 or more employees from using genetic information in hiring, firing, promotion, compensation, or any other terms of employment. Employers cannot request, require, or purchase genetic information about employees — including family medical history.

However, GINA has major gaps that many consumers don't realize. The law does not apply to:

• Life insurance — Life insurers can legally request and use genetic test results in underwriting
• Long-term care insurance — LTC insurers can deny coverage or raise premiums based on genetic risk
• Disability insurance — Genetic predisposition to conditions affecting future employability can be considered
• Employers with fewer than 15 employees — Small businesses are exempt from Title II
• The U.S. military — Active-duty service members are not covered by GINA for employment discrimination
• Manifest disease — GINA does not protect against discrimination based on a condition you already have; it only protects against discrimination based on genetic predisposition

Several states have passed laws that go beyond GINA. Florida (2020) became the first state to prohibit life insurers from using genetic test results; California, New York, and Massachusetts have additional protections. If you're concerned about life insurance implications, the safest approach is to secure life insurance coverage before undergoing elective genetic testing.

How Major Companies Handle Your Data

Each genetic testing company has its own privacy policy, data-sharing practices, and law enforcement access policy. Here's how the major players compare:

Law Enforcement and Genetic Genealogy

The 2018 arrest of the Golden State Killer using genetic genealogy — uploading crime scene DNA to GEDmatch and identifying the suspect through distant relatives' DNA matches — marked a watershed moment for genetic privacy. Since then, genetic genealogy has been used to solve hundreds of cold cases, but the practice raises serious privacy questions.

Key facts about law enforcement access:

• Direct-to-consumer databases: 23andMe and AncestryDNA require a valid subpoena, court order, or search warrant to release individual user data. Both publish annual transparency reports documenting the number of law enforcement requests received and complied with. In 2024, 23andMe received 15 requests and complied with 10.
• GEDmatch: After policy changes in 2019, GEDmatch requires users to actively opt in for law enforcement matching. Only users who explicitly enable this feature have their data visible to law enforcement searches — and only for violent crimes (murder, sexual assault). The default setting excludes law enforcement access.
• FamilyTreeDNA: Unlike other major companies, FamilyTreeDNA openly cooperates with the FBI for violent crime investigations. Users can opt out of law enforcement matching in their privacy settings, but the company's default position is to cooperate.

HIPAA vs DTC: The Regulatory Divide

The privacy protections applied to your genetic data depend entirely on who orders the test and how it's processed:

• HIPAA-covered testing: When a genetic test is ordered by a healthcare provider and processed through a CLIA-certified clinical lab (e.g., Invitae, Color Health, GeneDx, clinical WGS), the results are Protected Health Information (PHI) under HIPAA. This means strict rules govern who can access the data, for what purposes, and with what safeguards. Data breaches must be reported. Unauthorized disclosure can result in significant fines and criminal penalties.
• Non-HIPAA testing: Direct-to-consumer tests (23andMe, AncestryDNA, MyHeritage, consumer WGS from Nebula) are not covered entities under HIPAA. Your privacy protections come from the company's privacy policy — a contract that the company can change — and from the FTC Act, which prohibits unfair or deceptive trade practices but provides far weaker protections than HIPAA.

A critical point many consumers miss: even a CLIA-certified test can be non-HIPAA if it's self-ordered. If you buy a Color Health test directly without a physician's order, it may not be protected by HIPAA — despite being processed in a CLIA lab. Always verify with the provider how your data is classified before testing.

Practical Steps to Protect Your Genetic Privacy

1. Read the privacy policy before testing — not after. Look for: data-sharing defaults (opt-in vs opt-out), research consent requirements, law enforcement cooperation policies, data retention/deletion procedures, and whether the company can sell or transfer your data in a merger or acquisition.
2. Use a pseudonym or anonymous identifier when possible — some services allow you to register without your real name. This limits the link between your genetic data and your identity if the database is breached.
3. Opt out of research if you're uncomfortable with your de-identified data being used in studies. Understand that "de-identified" data can sometimes be re-identified — genetic data is inherently identifying (your genome is unique).
4. Request sample destruction — most DTC companies destroy the physical saliva/DNA sample after processing, but some retain it. Confirm destruction in writing if this matters to you.
5. Consider paying out-of-pocket — submitting a genetic test through insurance creates a medical record that life insurers can potentially access during underwriting. Self-pay eliminates this paper trail.
6. Secure life insurance before elective genetic testing — if you're planning to buy life, long-term care, or disability insurance, do so before undergoing genetic testing that could reveal risk factors.
7. Use a HIPAA-covered clinical lab for medically-relevant testing — the privacy protections are legally enforced rather than dependent on a company's voluntary privacy policy.
8. Request data deletion if you no longer want your data stored. Most companies offer account deletion that removes your data from their active systems, though some information may be retained for regulatory compliance.

The Future of Genetic Privacy

Genetic privacy law is evolving, but slowly. Several bills have been introduced in Congress — including the Genetic Information Privacy Act and updates to GINA that would extend protections to life and disability insurance — but none have passed as of 2026. In the absence of comprehensive federal legislation, your genetic privacy depends on a patchwork of state laws, company policies, and your own vigilance.

The European Union's GDPR provides stronger protections: genetic data is classified as "sensitive personal data" requiring explicit consent for processing, and the "right to be forgotten" applies. If you're in the EU or can access EU-based genetic testing services, your data enjoys stronger legal protections.

Frequently Asked Questions

Related Articles