Those ancestry kits make a tempting offer. Spit in a cup, learn where your family came from, maybe find a long-lost cousin. About 21 percent of Americans have done exactly that, according to a 2025 YouGov poll.
But before you order one, there are some things worth understanding. Two legal experts (one in the U.S., one in Canada) sat down to spell out the risks. What they shared with Reader’s Digest is worth reading before you send in that sample.
Your sample does not disappear after the test
Once you mail in your spit or cheek swab, the company typically holds onto that physical sample unless you specifically ask them to destroy it. That is what Natalie Ram, a law professor at the University of Maryland Francis King Carey School of Law, explains. Her research focuses on genetic privacy and the criminal legal system.
So the company has two things: your genetic data and the raw sample itself. That sample could be used for more extensive testing later, including something called whole-genome sequencing, which creates a far more detailed genetic profile than what these kits typically produce. Ram says the specifics are usually buried deep in the terms of service.
The rules can change after you sign up
These companies can update their terms of service at any time. And if you keep your account open (even if you never log in again), that counts as agreeing to the new terms. Ram says this is common across the internet, not just on genetics platforms.
The 2025 23andMe bankruptcy shows how this plays out in real life. The company had updated its terms to allow the sale of consumer data. But those new terms did not address what would happen to the actual physical samples. That created, as Ram puts it, a kind of gray zone.
Saying it is “your data” does not mean much
Many of these companies make a point of telling customers their genetic data belongs to them. Ram says not to be reassured by that language. Property rights are not absolute. You may own the data in name, but you have also granted the company rights to use it, rights that are spelled out in the fine print.
“The terms of service will say ‘this is your data,'” Ram says, “but you also grant us all of the rights to do thus and such with it.”
Breaches have already happened
There have been multiple hacking incidents at these companies. One breach at 23andMe specifically targeted customers of Asian and Ashkenazi Jewish heritage. Their data ended up for sale on the dark web.
California sued 23andMe over that breach in May 2026. California Attorney General Rob Bonta noted that the sale happened during a period of rising anti-Asian and antisemitic violence, and that the data was explicitly personal and identifying.
Ram points out something important about DNA that sets it apart from other stolen information: unlike a credit card number, you cannot get new DNA. Once it is out there, it is out there permanently.
How law enforcement operates
You may remember that investigators cracked the Golden State Killer case in 2018 by uploading a DNA sample to a free public database called GEDmatch, a site where users upload their genetic data so others can search it for family matches.
Ram says more than 1,000 cases have since been investigated using what is now called forensic investigative genetic genealogy, or FIGG.
GEDmatch did create a law enforcement portal and gave users an opt-out option after some scandals. But Ram says both investigators and genetic genealogists have found loopholes around those privacy protections.
Your data could be sold
When 23andMe filed for bankruptcy in 2025, the genetic data of its 15 million-plus users was sold to a new nonprofit set up by the company’s co-founder. But the first bidder had been Regeneron, a pharmaceutical company, which raised concerns about what a private company might do with millions of people’s genetic information and physical samples.
Ram notes that those samples contain genetic information that was never even sequenced. Whatever 23andMe did not test for is still sitting there, potentially available to whoever ends up holding it.
Insurance could become a problem
Ram says her bigger worry is not insurers hacking into these platforms. It is insurers using what you voluntarily learned about yourself (through one of these tests) to deny you coverage or set your rates.
Congress passed the Genetic Information Nondiscrimination Act, known as GINA, which protects against genetic discrimination in employment and health insurance in many situations. The Affordable Care Act has similar protections. But neither law covers life insurance, long-term-care insurance, or disability insurance. Those are left to individual states, and protections vary widely.
In Canada, by contrast, criminal defense lawyer Fadi Matthew Kazandji says it is actually a crime to require someone to take a genetic test (or hand over results from one) as a condition of selling them insurance or signing any contract. The maximum penalty is five years in prison and a $1 million fine. Canada’s Supreme Court upheld that law in 2020.
You might learn something you did not want to know
Family history research can uncover surprises that are harder to process than a pie chart of your ancestry. Ram says misattributed paternity (meaning a child’s biological father is not who the family believed) is far more common than most people realize. Tests can also reveal half-siblings, or adoptions that were never disclosed.
There is another layer to consider. When you submit your DNA, you are not just sharing your own genetic information. You are sharing data that connects to dozens, hundreds, or even thousands of biological relatives, whether they consented or not. And on the flip side, even if you have never taken one of these tests, a relative who has could mean your genetic data is already partially out there.
What you can do to protect yourself
Ram and Kazandji say the risks are real, but there are steps you can take if you decide to move forward.
- Think it through before you buy. Ram says to consider carefully whether the benefits are worth the exposure, for you and for your relatives, whose data you would also be sharing.
- Read the terms before you submit your sample. Some platforms openly cooperate with law enforcement. Others say they do not but still accept outside data uploads, which can let investigators in through a back door.
- Understand the privacy settings on GEDmatch. Kazandji warns that the options are confusing. Choosing opt-out does not remove you from police matching entirely; your DNA can still be used to identify human remains. Only opting in puts you in front of investigators looking for violent crime suspects. Choosing private takes you out of matching altogether.
- Know your rights if law enforcement contacts you. You are allowed to slow down. Kazandji says asking to speak with a lawyer first is a complete and acceptable answer.
As for the laws governing all of this? Ram says they are changing slowly, and not always toward stronger privacy. Maryland now requires that law enforcement cannot lie to an innocent third party when asking for cooperation in an investigation. Utah has a broader regulatory framework. Montana requires a warrant before police can access DNA databases.
But Ram does not expect the overall legal landscape to offer strong protection anytime soon. That puts the decision (and the caution) squarely in your hands.
