How to Delete Your Data From 23andMe, Ancestry, and Other Sites

Many people may not be aware of the requirements companies need to follow when you send them your genetic data, according to Mason Marks, MD, JD, a visiting professor of law at Harvard Law School and researcher who studies health law and data privacy.

There is an “air of medical-ness that engenders trust in consumers,” he says, because these companies work with DNA. But the HIPAA privacy laws that protect patients in a medical setting don’t apply to companies that do direct-to-consumer genetic testing, says Dena Mendelsohn, a former senior policy counsel for Consumer Reports.

That means that as long as their terms of service don’t specifically prohibit it, these companies can conduct research on your genetic data, sell it, or share it with third parties, according to Hazel. He says there’s a real risk that somewhere along the way, this information could be used in ways that are harmful to the person who submitted their data for testing or even to their relatives.

In one worst-case scenario, “an employer or insurance company might find you have a predisposition to develop early onset Alzheimer’s, cancer, mental illness, or substance use disorder, and discriminate against you based on that,” says Marks.

Current laws like the Genetic Information Nondiscrimination Act (GINA) prohibit employers or health insurance companies from discriminating against a person based on their genes, though that doesn’t mean it couldn’t happen. And GINA doesn’t apply to providers of life insurance, disability insurance, or long-term-care insurance, according to Mendelsohn.

Another worrying hypothetical: If a DTC genetic testing company were to be sold, and information about your health ended up in the hands of a pharmaceutical company, such information could be used to target you with ads for drugs based on your genetic health risks, says Angel Han, digital marketplace campaign manager with Consumer Reports.

Law enforcement officers have also used genetic data that’s been uploaded to a genetic database like GEDmatch—where people upload results from genetic tests to find people they may be related to—to help locate suspects or suspects’ relatives.

Some DNA testing companies may also continue to use your genetic data after you’ve sent it in and received a report. Once data has been used for research or otherwise shared with third parties, it generally can’t be called back or removed. Research using your genetic data may already be in progress or completed.

Last year, for example, 23andMe extended a deal to share its genetic databases with pharmaceutical company GSK, which agreed to license the data for drug development for $20 million. Meanwhile, the advocacy group Color of Change has called on 23andMe to stop profiting off of the genetic data of its Black customers, who may use DTC genetic testing services because the U.S.’ history of enslavement makes information on genealogy otherwise difficult to find for Black families.

Consumers should always read the privacy policies companies have listed to ensure they know exactly what their genetic information can be used for, advises Hazel. They should know whether their data will be shared with third parties, and if so, whether the information that’s shared will include individual-level genetic data, as opposed to aggregate data, which combines genetic information from a number of people.

Even if individual-level data has been “de-identified,” with names removed, researchers have demonstrated that in some cases a person can be “re-identified” based on their DNA, along with supporting information like a ZIP code or birth date, which is sometimes still associated with de-identified DNA.

Also, even if a company has excellent privacy policies, there’s always the possibility that data could be exposed through a security breach.

“Consumers should go in with eyes wide open to the information they are unlocking about themselves and their family, the limits of current privacy laws, and the impact of what they might learn on their ability to access life, disability, or long-term-care insurance,” says Mendelsohn.

We’ve asked three prominent DTC genetic testing companies—23andMe, Ancestry, and MyHeritage—what consumers can do if they want to remove their data from that company’s database.

You can also request deletion of your data via Permission Slip, an app created by Consumer Reports that helps you request deletion of your data from a variety of companies. Currently you can use Permission Slip to request data deletion from 23andMe and MyHeritage (but not Ancestry).

How to delete your genetic data: 23andMe customers can delete their account and personal information from the “23andMe Data” section in their account settings.

How to have your test sample destroyed: When you submit your test to 23andMe’s third-party lab, unless you consent to have it stored (or “biobanked”), your saliva sample and DNA will be destroyed after it is analyzed. If you opted to have it stored but want to change that preference, you can do so from your account settings page, under “Preferences.”

Is your data used for research, and can you revoke that permission? 23andMe and third-party researchers may use your genetic data and sample for research if you granted them consent to do so by completing a consent document.

You can withdraw consent for your information to be used in research from the account settings page.

“Data cannot be removed from research that’s already been conducted,” a spokesperson told CR. “Customers can view the publications to which their data has contributed from within their 23andMe account.

Will any data remain on research servers or in labs? If you consented to have your data used for research purposes, your genetic information cannot be removed from active or completed studies, but it will not be used in future research.

23andMe and third-party genotyping labs will retain genetic information, date of birth, and sex information, which a spokesperson says is required by some federal and state regulations.

How to delete your genetic data: Sign in to your account and navigate to your DNA Settings page. Click “Delete” next to “Delete DNA Test Results And Revoke Consent to Processing."

Deleting your overall Ancestry account will also result in your data being deleted.

How to have your test sample destroyed: Deleting your Ancestry account will result in the destruction of your biological sample. “You may also request the destruction of your sample at any time by contacting our Member Services. If you choose to delete parts of your Ancestry account, for example only deleting family trees or only deleting Genetic Information, you need to contact our Member Services to destroy your sample,” a spokesperson told CR.

Is your data used for research, and can you revoke that permission? Ancestry and third-party researchers may use your data for research purposes if you agreed to let them do so when you opened your account or in your account settings. If you’d like to opt out of future research projects, you can withdraw your consent in DNA Settings, under “Consents.”

Will any data remain on research servers or in labs? If you consented to have your data used for research purposes, that data cannot be removed from active or completed research projects, but it will not be used in future research.

At present, Ancestry says that lab regulations do not require them to retain Ancestry customer data, though a spokesperson tells us that these regulations could change in the future.

How to delete your genetic data: Users can delete their genetic data by going to the Manage DNA Kits section of their account settings and then selecting the button to delete data, according to a MyHeritage representative. They can also contact the MyHeritage customer support division by phone or email to have their data deleted.

How to have your test sample destroyed: To have DNA samples discarded, users can contact MyHeritage customer support by phone or email.

Is your data used for research, and can you revoke that permission? When you signed up for an account, you were given the option to allow MyHeritage to conduct research with your DNA data. To withdraw consent for internal research, users can go to their account settings page, select Privacy, and then select My DNA Preferences. A spokesperson told CR that MyHeritage has committed to never sharing genetic data with any third parties, so any research conducted with your data would be in-house.

Will any data remain on research servers or in labs? A company spokesperson told CR that no data will remain stored after you request your sample be destroyed.

The three companies above have comprehensive privacy policies online, and offer straightforward ways to remove data that has not been used in research. But approximately 40 percent of the 90 companies Hazel looked at while surveying privacy policies had no posted policy defining what they were or weren’t allowed to do with users’ genetic data. That’s something to consider before choosing a DNA testing company.

Also, Hazel says that some of the biggest privacy concerns come from users uploading their genetic data to external sites to further analyze health information or search for relatives. Checking the privacy policies of these sites is equally important.

The fact that data could be misused doesn’t mean you should never share genetic data with a company.

“There are great potential benefits to allowing these companies to analyze genetic data and combine many other different types of data,” says Marks. “They could make new discoveries, identify new drug targets, and develop new treatments for people.”

But users of these tests should know exactly what they’ve agreed to share.