Three of the biggest names in home DNA tests are 23andMe, Ancestry.com and MyHeritage. You can find their privacy policies and specific instructions on how to delete data from each of them below. Wirecutter, the product review website owned by The New York Times Company, evaluated 15 DNA testing kits and recommended AncestryDNA or 23andMe.
What to watch for before you sign up
When you first set up a new smartphone, you might be asked to give a company permission to track your location or share data about how you use your phone. In the same way, once you’ve picked a DNA test to try, there are a few things to watch out for. DNA testing companies tend to ask a lot of questions that may strike you as boring, but if you want to protect your data, you’ll want to read them all carefully.
Consumers “want to look at what choices they have, in terms of the activities that they can opt into, or opt out of,” Dr. Hazel said. Some companies like 23andMe have a separate agreement asking permission to use your DNA data in research studies. This data is stripped of identifying labels like your name or address that tie it to you specifically, but that’s not always guaranteed to protect your privacy.
In some cases, Dr. Hazel said, companies use what’s called “de-identified aggregate data,” which is relatively safe. This kind of data might include summaries that don’t specifically call out individuals, like what percentage of people have a certain ancestry.
“But these companies also use what’s called de-identified individual-level data, where there is, you know, always a risk that a person can be re-identified from that data,” Dr. Hazel said. This kind of data might describe your unique genetic makeup without using your name. While it may be unlikely that this information could be linked back to you, researchers have shown it is possible. Law enforcement famously used crime-scene DNA that was shared with a genealogical research site to track down a suspect in the Golden State killer case, even though he never used a DNA test himself, demonstrating that even anonymized data can be used to identify people.
If you give a company permission to share your data with another research organization, you can revoke that permission later. However, it will be difficult or impossible to delete your data from third parties that have already received it. It’s also hard to guarantee that those third parties won’t also share your data with yet another company or research organization down the road. “Once that data has been shared with a third party, it’s really difficult to control further sharing,” Dr. Hazel said. That doesn’t mean you shouldn’t share data with researchers, but you should know the risks going in.
You may also be asked for permission to allow the DNA testing company to store your sample, meaning that it can go back and test it again if more advanced techniques are developed in the future. Some sites also offer a family finder feature that lets potential relatives contact you if your DNA matches. All of these can be very personal permissions to give. Reputable companies will make sure to inform you as much as possible, but be sure to read everything you’re presented with before you click “Agree.”