Protecting Your Genetic Footprint: Privacy Concerns With DNA Testing for Seniors

By Chris Clark, founder of Senior Tech Cafe

Genetic privacy is about who gets to keep, share or sell your DNA once it leaves your cheek, and it matters more than most people realize when they mail off a test kit.

Back in the good old days, if you wanted to know about your ancestry, you asked your Uncle Larry at Thanksgiving. Ideally, right after he’d had two glasses of wine and was feeling chatty. Sure, some of the details were highly suspicious (like how your great-great-grandfather was supposedly a duke and a pirate). But it was completely free, and you didn’t have to mail a tube of your spit to Silicon Valley to get juicy details about your family history.

Fast forward to now, where discovering your family roots involves swabbing your cheek, clicking a few buttons, and trusting a tech company to handle the most personal thing about you, your DNA. What could possibly go wrong?

Well, in 2025 23andMe, one of the biggest names in the business, went bankrupt and was sold, less than two years after hackers got at the personal information of 6.9 million of its customers. If a company that tracks your shoe size or favorite casserole recipes gets hacked, it’s a minor annoyance. But your genetic blueprint is the literal instruction manual for how your body works. It’s not just sensitive. It’s permanent.

The Root of the Family Tree: Why Your Spit Matters

Here’s the most important thing to understand about sending your DNA to a lab: your DNA isn’t just yours. You are the root of the family tree. When you share your genetic code with a database, you’re also sharing half of your children’s DNA and roughly a quarter of your grandchildren’s.

Think of it like giving out the combination to a family vault. You might be perfectly fine with strangers knowing what’s inside, but the rest of the family didn’t necessarily agree to leave the door unlocked. Your choice today becomes your descendants’ digital footprint tomorrow.

It works the other way, too. Even if you’ve never swabbed your cheek, a relative who did has put part of your genetic information into the system. Testing companies look for shared stretches of DNA, so your sister’s or cousin’s sample points straight at the rest of the family. You could be contacted by relatives you never knew you had, or have your traits guessed at, without ever clicking “I agree.”

That’s exactly how the Golden State Killer was caught in 2018. He never mailed his own saliva to a genealogy website. Investigators uploaded crime-scene DNA to GEDmatch, a public genealogy site, found distant cousins who had tested, and built family trees until the branches led to him.

The Free DNA Test Trap: Avoiding Medicare Scams

There’s a huge difference between a legitimate medical test ordered by your doctor and a pop-up tent at a senior health fair. Say you’re at the community center, enjoying a lukewarm cup of decaf, and a very polite person offers you a “free, Medicare-covered” cheek swab to screen for cancer or heart disease. It sounds like a fantastic deal.

It’s a scam. The same pitch also arrives by phone and on the doorstep. The goal isn’t your family history or your health. They want your Medicare number so they can bill Medicare for tests you didn’t need, and once you hand over the swab, a stranger has your genetic material too.

Remember one rule: if someone you don’t know asks for your spit and your Medicare card in the same breath, walk away. If a genetic test kit shows up in the mail and your doctor didn’t order it, don’t accept it. Report offers like these to the HHS Inspector General at 1-800-HHS-TIPS (1-800-447-8477) or to Medicare at 1-800-MEDICARE.

GINA and the Insurance Loophole: What’s Protected (and What Isn’t)

When you read the fine print on consumer DNA kits, you’ll often see companies mention a federal law called GINA, the Genetic Information Nondiscrimination Act. That sounds official and comforting. And it is, mostly.

GINA stops health insurers and employers from discriminating against you based on your genetic information. If your test shows a marker for a specific illness, your health insurance can’t raise your premiums or cancel your coverage over it. That includes Medicare supplement (Medigap) policies.

However, and this is a “however” bigger than a 1970s station wagon, GINA has big gaps. It doesn’t cover life insurance, disability insurance or long-term care insurance, and its job protections don’t apply to employers with fewer than 15 workers. Some states fill part of that gap with their own laws, but many don’t.

And here’s the part that surprises people: HIPAA, the law that keeps your medical records private, generally doesn’t apply to consumer DNA companies. They aren’t your doctor or your health plan. What protects your DNA at a testing company is mostly that company’s own privacy policy, and a privacy policy can change.

What Happens to Your DNA If the Company Goes Under?

You use a popular DNA service, find out you’re 14% Irish, have a good laugh, and forget about it. A few years later, the company holding your data goes bankrupt or gets bought. What happens to your very personal, very permanent biological data?

In the corporate world, customer data is an asset. When companies go under, their assets get sold to pay off debts. That’s not a hypothetical. It’s what happened at 23andMe.

• The breach: In 2023, hackers broke into about 14,000 23andMe accounts using passwords stolen from other websites, then used a relative-matching feature to reach information on 6.9 million people.
• The bankruptcy: In March 2025 the company filed for bankruptcy. About 1.9 million customers, roughly 15%, asked to have their data deleted.
• The sale: In July 2025, 23andMe and its customers’ DNA were sold for $305 million to TTAM Research Institute, a nonprofit led by co-founder Anne Wojcicki. The buyer promised to keep the existing privacy policy and customers’ right to delete, and in 2026 a group of state attorneys general settled with the company on extra security and privacy conditions.

The data landed with a buyer that made promises. The next company to go under may not. That’s why it’s worth deciding now whether you want your DNA sitting on a server, and why, if you or a loved one is facing memory problems, it’s smart to name a trusted family member who can manage or delete these accounts.

The breach has a lesson of its own: the hackers got in with reused passwords. A unique password and two-factor authentication on your DNA account would have kept them out of yours.

Does Ancestry Sell Your DNA?

No. Ancestry says it does not sell your DNA or genetic information to marketers, insurers or employers, and won’t share it with insurers or employers without your explicit consent. Police need valid legal process, like a subpoena or warrant, and Ancestry publishes a transparency report on those requests.

Two things are worth knowing before you relax completely. First, Ancestry’s privacy statement does say it shares some non-genetic personal information for targeted advertising, which California law counts as selling. Second, research is opt-in: if you agreed to Ancestry’s Informed Consent to Research, your DNA can be used in its research projects until you withdraw in your DNA settings.

The other big companies make similar promises. 23andMe says it won’t hand over data to insurers or employers and would only pass genetic data to a buyer that adopts its privacy statement. MyHeritage says it has never sold or licensed genetic data and bans law enforcement from using its DNA service.

Those promises are real, but they’re only as good as the company’s future owner. Ancestry has been owned by the investment firm Blackstone since 2020, and its privacy statement says its promises would carry over to any new owner. 23andMe’s customers found out in 2025 how quickly a company’s future can change.

How to Delete 23andMe Data

To delete 23andMe data, sign in, open Settings, and use the Permanently Delete Data option, then confirm by email. Deleting your account also opts you out of research and discards your saliva sample. The labels on screen may differ slightly, but here are the steps:

1. Sign in to your 23andMe account and click your name or profile icon, then Settings.
2. Scroll to the 23andMe Data section and click View. You may be asked to enter your date of birth.
3. If you want a copy of your raw data, download it now. (Save it on your own computer, not your nephew’s old laptop from 2008.)
4. Click Permanently Delete Data.
5. Open the email 23andMe sends you and click the link to confirm. Until you do, nothing is deleted.
6. Once you confirm, your account closes and your access disappears faster than the last brownie at a church potluck. Deletion can’t be undone.

Two things to know. Research that already used your data can’t be pulled back, and 23andMe’s lab keeps some information after deletion, including some genetic data, your date of birth and your sex, to meet lab regulations. If you’d rather not delete everything, you can still withdraw from research under Settings, then Research and Product Consents.

For the details straight from the source, see 23andMe’s privacy statement and the California Attorney General’s deletion guide..

How to Delete Your DNA From Ancestry and MyHeritage

Ancestry

1. Sign in and go to your DNA Settings.
2. Choose Delete, enter your password, and select Delete Test Results and Revoke Consent.

Ancestry says your genetic information is removed from its systems within 30 days. That step doesn’t destroy your physical saliva sample, though (the one sitting in a freezer somewhere, probably next to a Lean Cuisine). Ancestry’s privacy statement says that to have it destroyed, you must contact Member Services and ask. Ancestry’s help page on deleting DNA results walks through the steps above.

MyHeritage

1. Open the DNA tab and choose Manage DNA kits.
2. Click the three dots next to your kit and choose Delete kit. This can’t be undone.

MyHeritage destroys your sample during testing, unless you paid to have a spare stored, in which case ask through its Contact Us form. To withdraw from research, go to Settings, then My Privacy, then My DNA preferences. The details are on MyHeritage’s help page.

A Genetic Bill of Rights for Seniors

Staying curious about your family history shouldn’t require surrendering your privacy. Here’s a simple framework to keep your genetic data secure:

• The right to ignore free offers: You can always hang up the phone or walk away from anyone offering a free genetic test in exchange for your Medicare information.
• The right to say no to research: Every major DNA site asks separately before using your data for research. If you said yes years ago and have changed your mind, withdraw in your settings.
• The right to keep police out: The big companies require a court order or warrant. If you’ve uploaded your DNA to GEDmatch or FamilyTreeDNA, check their law enforcement matching setting and choose what you’re comfortable with.
• The right to delete: You don’t have to leave your DNA on a company’s server forever. The major companies let you delete your data and have your sample destroyed, and in California and a growing number of other states it’s a legal right.

Want the Health Answers Without the Privacy Risk? Ask Your Doctor

If you’re curious about your health risks but twitchy about mailing your DNA to a company that might be sold next year, there’s a safer route: genetic testing through your doctor.

It won’t come with colorful pie charts or a list of surprise cousins. But a test your doctor orders becomes part of your medical record, which HIPAA does protect. You get the results explained by a doctor or genetic counselor instead of a search engine. And if there’s a medical reason for the test, like a strong family history of cancer, insurance may help pay for it.

The trade-offs: medical testing looks at health, not whether you’re 4% Viking, and if you just want to satisfy your curiosity, insurance probably won’t cover it. In most states, life, disability and long-term care insurers can still ask about test results in your medical record.

Questions About DNA Testing Privacy

Is It Safe to Take a DNA Ancestry Test?

A DNA ancestry test is reasonably safe if you go in with your eyes open. Pick a company that says it won’t sell genetic data, skip research consent unless you want to take part, and download your results and delete your data once you’ve seen them. Remember that you’re also sharing your relatives’ DNA.

Can Police Search My DNA on Ancestry Sites?

On the biggest ancestry sites, police can’t search your DNA without a court order, subpoena or warrant. Ancestry, 23andMe and MyHeritage all require legal process. GEDmatch lets police compare DNA only against users who opted in, and FamilyTreeDNA has its own setting to check. Your relatives’ tests can still lead investigators toward you.

Does Medicare Pay for DNA Tests?

Medicare pays for genetic tests only when they’re medically necessary and ordered by your own doctor. It doesn’t pay for ancestry tests. Anyone offering a free, Medicare-covered cheek swab at a health fair, on the phone or at your door is running a scam. Report it to 1-800-HHS-TIPS or 1-800-MEDICARE.

Does HIPAA Protect My DNA Test Results?

HIPAA generally doesn’t protect DNA results from consumer companies like 23andMe or Ancestry, because it covers doctors, health plans and their business partners, not companies selling kits online. A genetic test your doctor orders is covered. For consumer kits, the company’s privacy policy and your state’s laws are what protect you.

What Happened to 23andMe Customers’ Data After the Bankruptcy?

23andMe customers’ data went with the company when it was sold in July 2025 to TTAM Research Institute, a nonprofit led by co-founder Anne Wojcicki. The buyer agreed to keep 23andMe’s privacy promises and customers’ right to delete. If you’re a customer, you can still delete your data from your account settings.

Next Steps: Taking Control of Your Genetic Blueprint

DNA testing lets us connect with our past in ways Uncle Larry could only dream of. You don’t have to be afraid of it, but you should absolutely be the one holding the steering wheel.

Take a few minutes today to sign in to any ancestry accounts you’ve created. Poke around the privacy settings, see what you’ve agreed to, and decide whether you really need to leave your data sitting there. Your DNA isn’t the only health information companies collect, either. Here’s how to keep health data from wearables private, and how to remove your information from data brokers.

For the rest of the checklist, see our online safety guide for seniors. After all, protecting your family’s future is the best kind of legacy you can leave behind.