We’ve all heard the feel-good stories about DNA testing exonerating the wrongly accused, catching a killer or reuniting long-lost relatives. These situations are often framed by local news anchors and law enforcement as triumphs of technology, and sometimes they are. But voluntarily submitting your DNA to a genealogy testing company—as 21% of Americans have, according to a 2025 YouGov poll—can have unintended consequences.
I can hear you thinking: What could be the harm? I’m not a criminal! And I would love to meet my fourth cousin twice removed! Of course, a family reunion sounds fun (and hopefully you’re not on the FBI’s Most Wanted list), but once you give that spit or swab sample over to one of those companies, the “good” and “bad” tentacles of DNA testing can be impossible to untangle.
“Nobody is against catching serial killers,” says Natalie Ram, a professor of law at the University of Maryland Francis King Carey School of Law whose research focuses on genetic privacy and how it intersects with the criminal legal system. “But privacy is also a really important human value—and an American legal value, in particular.”
I spoke with Ram and Fadi Matthew Kazandji, a criminal defense lawyer and founder and managing partner at Kazandji Law in Canada, to understand the risks of genealogical testing. What could go wrong when you submit your sample to one of these companies? Quite a bit, actually, so read on.
Get Reader’s Digest’s Read Up newsletter for more genealogy, news, tech, humor, travel and fun facts all week long.
Your sample could be retained indefinitely
Whether you spit in a cup or swab your cheek, once you send off your sample to a genealogical testing company, “they typically hold onto that biospecimen unless or until you request that they destroy it,” Ram says. And that’s two valuable things the company now has control over: your genetic data and the raw sample, which could be used for further sequencing at a later time.
What kind of further testing are we talking about? One likely candidate is whole-genome sequencing, which gives a much more extensive profile than the typical “genotyping” done by these companies. “The specific details of a specific platform are likely buried in the terms of service and privacy policy, so you should consult that before you use one of their kits,” Ram says.
But, as you’ll see coming up, reading the terms isn’t a fail-safe.
The terms of service can be changed at any time
“You should also know that it is extremely common, across the internet, including on these consumer genetics platforms, for a vendor to reserve the right to change the terms of service and privacy policy at any time,” Ram says. “Your continued use of the service, which means your non-deletion of your account, is considered consent to the updated terms.”
And sometimes the companies themselves don’t necessarily think the terms through. She points to the 23andMe bankruptcy from 2025: The company had recently updated their terms to allow the sale of consumer data, but didn’t address the actual physical specimens. That left a kind of “gray zone” about what might happen to them.
“Your data” might not be yours after all
“One thing that is quite common in the consumer genetic space is that companies, in their terms of service and privacy policies, often take great pains to say your genetic data is yours,” Ram says. “Which, on the one hand, sounds great. On the other hand, [it] doesn’t actually provide a lot of robust protection.”
She cautions people “not to be wooed” by the language of ownership. Your data and sample may be your “property,” but property rights are not absolute. They’re affected by what you’ve consented to allow others to do with it, which again, is buried in the fine print. “The terms of service will say ‘this is your data,’ but you also grant us all of the rights to do thus and such with it,” Ram says.
Breaches could expose your sensitive information
This is the one most people are worried about, Ram says, and there have been multiple instances of hacking and other breaches at these companies. A particularly worrisome one affected 23andMe customers of Asian and Ashkenazi Jewish heritage, whose data was sold on the dark web.
The state of California sued 23andMe over this exposure in May 2026. “The sale of this data on the dark web took place amidst a period of mounting anti–Asian American and Pacific Islander and anti-Semitic hate and violence—and explicitly called attention to the deeply personal and identifying nature of that information,” California Attorney General Rob Bonta said when announcing the suit.
Remember that unlike a credit card number, you can’t get new DNA. “So once it’s fallen into dark-web hands, it’s there forever and you can’t change it, no matter what,” Ram says.
Law enforcement doesn’t always follow the rules
You’ve probably heard of the Golden State Killer, who eluded capture for decades until 2018, when investigators uploaded a DNA sample to something called GEDmatch. That’s a free database that allows users to upload their genetic data so it can be accessed and searched by others to look for matches.
“Since then, over 1000 cases have been investigated using what is now called forensic investigative genetic genealogy, or FIGG,” Ram says. You might think this is good news (killers off the streets!), but she warns that law enforcement doesn’t always play by the rules and is “largely unburdened by law” in this space.
Let’s say the police are looking for a suspect and they have a DNA sample from a crime scene. “Rather than saying, ‘Hi, I’m law enforcement, and I’d like to search for suspects in your database,’ they will instead pretend to be an ordinary user and say, ‘This is my data,'” Ram says.
After a series of scandals, Ram says GEDmatch created a portal for law enforcement and gave users the option to opt out of allowing investigators to comb through their genetic info. But both law enforcement and genetic genealogists have been caught using loopholes to get around these privacy restrictions.
The company could sell your genetic data
When 23andMe filed for bankruptcy protection in 2025, the company sold the genetic data of its 15 million–plus users to a new nonprofit created by 23andMe’s co-founder. But the first bidder was a pharmaceutical company called Regeneron, prompting worries from consumers about what they would do with the data and samples.
“It’s unclear whether they were most interested in the user data or the biospecimens, [which] would include not only the information that has already been developed but also all the other information that 23andMe, or whatever platform you’re using, didn’t even sequence yet,” Ram says.
Insurance companies could deny coverage
“I am less concerned with insurers trying to get access to these platforms,” Ram says. “I am more concerned about insurers conditioning your ability to get important forms of insurance, like life, long-term-care and disability insurance, based on genetic risks that you knew about because you used one of these services.”
Congress did enact the Genetic Information Nondiscrimination Act (GINA), which protects against discrimination in employment and health insurance under many circumstances. The Affordable Care Act has similar protections. But neither law applies to life, long-term-care and disability insurance, leaving states to create a patchwork of protections.
Kazandji says Canada’s laws are more robust. “It’s a crime here to make someone take a genetic test, or hand over results from one they already took, as a condition of selling them something or signing a contract with them,” he says. “That includes insurance and jobs. The maximum is five years in jail and a $1 million fine, and the Supreme Court of Canada upheld the law in 2020.”
You could open up old or unknown family wounds
Maybe it sounds exciting to trace your family history, or smart to research potential medical issues in your family tree. But there can be downsides, not the least of which is learning something you wish you hadn’t. “Misattributed paternity is surprisingly common—much more common that people realize,” Ram says. You could learn you have half-siblings, or adoptions that were never disclosed to the family.
Before you use these services, Ram says it’s also important to grapple with the fact that the data you’re sharing is not just your data. “It’s the data of dozens, hundreds or even thousands of other individuals” to whom you’re genetically related. On the other side of the issue, that means even if you haven’t taken one of these tests, your data may still be out there regardless.
Is there any way to protect yourself from these potential problems?
It’s easy to say “just don’t take the test,” and that’s one thing to consider. But if you do decide the benefits outweigh the risks, Ram and Kazandji have some advice.
- Make an informed decision. “Think carefully about the choice that you are making, both about whether to use one of these services, and if you do decide to do it, which one you use,” Ram says. Consider the wider exposure your genetic curiosity can bring to others in your family.
- Read the terms and conditions. “Some of these platforms openly cooperate with law enforcement,” she says. “That might influence your choice.” Others say law enforcement isn’t welcome “but still accept third-party uploads of data (data developed elsewhere), which allows law enforcement to access the data if they lie about who they are.”
- Be aware of how the privacy settings work. “If your DNA is on GEDmatch, look at your privacy setting, because the names can be confusing,” Kazandji says. “‘Opt-out’ doesn’t take you out of police matching completely.” (Under this setting, your DNA can be used to ID human remains.) “Only ‘Opt-in’ puts you in front of police looking for a suspect in a violent crime, and ‘Private’ takes you out of matching altogether,” he adds.
- Assert your rights. If law enforcement contacts you, it’s OK to take a step back and consider what to do next. “You can be polite about it,” Kazandji says. “‘I’d like to speak to a lawyer first’ is a full answer.”
Are the laws surrounding genetic testing changing?
Yes, but slowly, and not always in the direction of stronger privacy.
Ram is very proud of the work she’s done in her state to get protections on the books: “The Maryland law says when law enforcement approaches a person they know to be an innocent third party, to ask them to cooperate in an investigation, they are not allowed to lie.”
Utah is another state that has enacted a “relatively comprehensive regulatory scheme,” Ram says, though it’s less robust than Maryland’s. And Montana has a short statute that requires law enforcement to get a warrant before gaining access to DNA databases.
As for the overall trend with these laws? “I do not have high hopes that they will provide genuine data protection vis-à-vis the government,” Ram says.
About the experts
|
Why trust us
At Reader’s Digest, we’re committed to producing high-quality content by writers with expertise and experience in their field in consultation with relevant, qualified experts. We rely on reputable primary sources, including government and professional organizations and academic institutions as well as our writers’ personal experiences where appropriate. For this piece on the risks of genealogical testing, Ally Childress tapped her experience as a longtime journalist who frequently writes about facts, news and common curiosities for Reader’s Digest. We verify all facts and data, back them with credible sourcing and revisit them over time to ensure they remain accurate and up to date. Read more about our team, our contributors and our editorial policies.
Sources:
- Natalie Ram, professor of law at the University of Maryland Francis King Carey School of Law; phone interview, Oct. 13, 2026
- Fadi Matthew Kazandji, founder and managing partner at Kazandji Law; email interview, Oct. 12, 2026
- Science: “The precarious future of consumer genetic privacy”
- State of California Office of the Attorney General: “Attorney General Bonta Sues Chrome Holding Co., Formerly Known as 23andMe, Over 2023 Data Breach”
- NPR: “In Hunt for Golden State Killer, Investigators Uploaded His DNA to Genealogy Site”
- Los Angeles Times: “The risks of sharing your DNA with online companies aren’t a future concern. They’re here now”
- Guardian: “23andMe back on the auction block after former CEO makes 11th-hour bid”
- YouGov: “What Americans think about home DNA tests and their potential uses”
- University of Iowa: “Genetic Privacy in the U.S.: Insurance and Law Enforcement Use”
The post 8 Ways Doing a Genealogy DNA Test Can Come Back to Bite You—And Even Cause Legal Problems appeared first on Reader's Digest.
from Reader's Digest https://ift.tt/HUB60Iy
Comments
Post a Comment