Lifestyle

7 Things Genetic Testing Companies Hope You Never Ask

By Erica Coleman · September 23, 2026

More than 30 million Americans have sent saliva samples to direct-to-consumer genetic testing companies for ancestry, health, or trait reports. Very few of them read the fine print before they clicked “accept.” The industry was rattled by 23andMe’s Chapter 11 bankruptcy filing in March 2025 — putting the genetic data of roughly 15 million customers into the hands of the court, potential buyers, and eventually a new owner. What the bankruptcy exposed applies to every genetic testing company still operating.

Here’s what the genetic testing industry hopes you never ask before you send your saliva in.

HIPAA doesn’t cover them. Most consumers assume the same federal privacy law that protects their doctor’s records also protects their genetic data. It doesn’t. The Health Insurance Portability and Accountability Act applies only to health insurers and health care providers — not to direct-to-consumer genetic testing companies, whose users are legally designated as “consumers,” not “patients”, Scientific American reported. The federal medical-privacy floor most people take for granted doesn’t apply.

Their terms of service usually authorize a sale of your data in bankruptcy. Buried in most genetic testing privacy policies is a clause that says if the company files for bankruptcy, merges, or sells its assets, your genetic data can be transferred to the new owner. 23andMe explicitly cited this clause in defending its right to include customer genetic data in the bankruptcy sale, arguing customers had consented to the transfer when they signed up, the International Association of Privacy Professionals reported. Most customers did not realize they had.

Your DNA reveals information about relatives who never consented. When you submit a saliva sample, you’re not just handing over your own genetic information — you’re revealing information about your parents, siblings, children, and even distant cousins. A single genealogy database can be used to identify relatives who never signed up. Your consent is legally binding for you. It has no legal weight for the family members whose data you effectively donated with you.

They can share your data with pharmaceutical companies. Direct-to-consumer genetic testing is often subsidized by data-sharing deals with drugmakers. 23andMe entered a $300 million deal with GlaxoSmithKline in 2018 that gave the pharmaceutical company access to customer genetic data for drug research, The Conversation reported. Customers technically had to opt in — but the opt-in is often bundled with the initial signup and easy to click through without noticing.

They can be breached — and their breaches are worse than most. In 2023, 23andMe suffered a data breach that exposed the genetic and personal information of 6.9 million users. Unlike a stolen credit card, stolen genetic information can never be reissued. You can’t change your DNA. And genetic data can be used for insurance discrimination, targeted phishing, or worse — a fact that state attorneys general have specifically warned about in recent months.

You can delete your data — but you have to actually do it. Even under the shadow of bankruptcy proceedings, only about 1.9 million of 23andMe’s 15 million customers had deleted their data as of mid-2026. The delete process typically requires logging in, navigating to account settings, requesting sample destruction separately, and revoking research consent as a third step. Most consumers assume closing their account is enough. It isn’t.

State attorneys general are your best allies. Following 23andMe’s bankruptcy, state attorneys general in California, New York, Massachusetts, and Iowa issued consumer alerts advising past users to request their data be deleted and their biological samples destroyed, the HIPAA Journal reported. If your state’s AG has issued a similar alert about a genetic testing company, follow its instructions to the letter — and file a complaint with the office if the company fails to comply.

Genetic testing has produced legitimate insights for many families — health risks flagged, ancestry connected, unknown relatives found. It also created the largest private genetic database in human history, subject to breach, bankruptcy sale, and policy changes with no federal privacy backstop. Before you or a family member sends a new saliva sample, ask what the company would do with your DNA if it went out of business tomorrow. The answer is in the terms of service.