Why and How to Remove Your Data From DNA Testing Sites (2026)
Updated for 2026: what changed after the 23andMe bankruptcy, and how to still take back control of your genetic data.
DNA testing has become increasingly popular in recent years, with many people opting to take at-home DNA tests to learn more about their ancestry and health. Popular sites are 23andMe, Ancestry.com, and MyHeritage. Those companies have sold over 40 million kits combined, though new sales have slowed since 2018. The analysis and information provided by these sites can be entertaining, and could even be useful in filling in some ancestral gaps.
However, there are obvious privacy concerns with entrusting this type of data to a third party. And because of the sensitive and valuable information collected, these companies have big targets on their back.
We first wrote this guide in November 2023 after the 23andMe data theft. Since then, 23andMe filed for bankruptcy (March 2025) and its entire genetic database (data on more than 15 million people) went up for sale as a company asset. That’s the clearest illustration yet of the core risk:
once your DNA data lives on someone else’s server, its fate is no longer fully in your hands.
We’ve updated this guide to reflect what’s changed and to walk through why and how to delete your data in 2026.
Why Remove Your Data?
There are several privacy and security concerns associated with at-home DNA testing on sites like 23andMe. So much so that the Pentagon felt obligated to issue a memo back in 2020 warning service members about the “personal and operational” risks with these tests. Most of the risks and concerns are self-evident, but we’ll touch on some for the sake of completeness.
The most obvious is having a third party store your DNA data in the cloud. Entrusting sensitive data with a third party is always risky, particularly when it’s hosted in the cloud and accessible via the internet. No company will guarantee there won’t be a breach of their system (they can’t). So it’s not a matter of if, but when and how bad.
In the case of 23andMe’s 2023 incident, their systems were not technically “breached.” The theft of data occurred when hackers used stolen passwords and usernames from other, unrelated accounts. Users had reused the same login info across multiple sites, including 23andMe. That’s a major privacy fail, to say the least, and a reminder that unique passwords and two-factor authentication matter as much as anything the company does on its end.
What happened next is the bigger story.
In March 2025, 23andMe filed for Chapter 11 bankruptcy, putting its genetic database (one of the largest in the world) on the table as a company asset to be sold to the highest bidder.
After a contested bankruptcy auction, a bankruptcy court approved the sale to TTAM Research Institute, a nonprofit formed by 23andMe co-founder and former CEO Anne Wojcicki, for $305 million, with the deal closing in mid-2025.
Several state attorneys general (including California, Kentucky, Tennessee, Texas, and Utah) opposed the sale outright, arguing that genetic data shouldn’t change hands through a bankruptcy process at all. TTAM has publicly committed to honor 23andMe’s existing privacy policy, including letting customers delete their data and opt out of research “in perpetuity”, and says it will require any future buyer to do the same. Those are legit, legally binding commitments, but they’re also commitments made by a new owner you didn’t originally choose. That’s exactly the scenario the original 2023 version of this piece warned about.
A bipartisan federal bill, the Don’t Sell My DNA Act, was introduced in 2025 to require notice and affirmative consumer consent before genetic data can be sold off in a bankruptcy. As of this update it has not passed. In the meantime, states have been moving faster:
South Dakota and Montana both enacted new consumer genetic-privacy laws in the past year, and several more states introduced similar bills in early 2026.
It’s a patchwork, and coverage still depends heavily on where you live.
To illustrate the risks of having your genetic information stolen or sold, here are some of the ways bad actors can use that type of data against you:
Identity theft. Possession of your DNA data can make a bad actor seem more credible. Bad actors could then potentially use stolen DNA data in conjunction with other personal information to commit identity theft.
Phishing and social engineering schemes. A bad actor might use the stolen DNA data to craft convincing phishing emails or messages, posing as legitimate organizations or institutions. A recipient may be more likely to trust and engage with these communications since they contain or reference the recipient’s sensitive genetic information.
Extortion and blackmail. A bad actor may threaten to release sensitive genetic information to the public or to an employer, family, or friends unless a ransom is paid. This could lead to significant emotional distress and financial consequences for the victim.
Pharming attacks. A bad actor might use stolen genetic data to target individuals with specific medical conditions, attempting to sell them fraudulent medical products or services, or spreading false information about treatments.
In addition, there are concerns that your genetic data could be used against you by legitimate businesses. There are current laws on the books like the Genetic Information Nondiscrimination Act (GINA) that prohibit employers or health insurance companies from discriminating against a person based on their genes. This of course doesn’t mean it still can’t happen. But it’s important to note who GINA does not apply to:
providers of life insurance, disability insurance, or long-term-care insurance.
State laws may fill in the gap there (and more of them now do than in 2023) but coverage still varies significantly by state.
There are also concerns that law enforcement agencies could use this data to identify suspects in criminal investigations. All of these DNA testing companies will turn over your genetic information to law enforcement upon a lawful request. Some have historically done so even with a simple, non-legally-binding request. But deleting your own DNA data is probably not enough to fully avoid this risk. If a close relative used a DNA service, that’s likely sufficient for law enforcement to narrow their pool of suspects, regardless of what you personally choose to delete.
But it’s not just DNA data you need to worry about. These companies collect a wide variety of other personal data, including information you voluntarily share with them such as your name, address, and email address, and, in some cases, facts about your family and your health. This is not unique to DNA companies, but given the sensitivity of the data they collect, it is more concerning.
Before Deleting Your Data
If you’re ready to delete your data, there are a few things to keep in mind. While not an exhaustive list, this will help you make a more informed decision.
You can delete your digital data — the analysis of your DNA specimen. This is the file you can download.
You can also request destruction of your physical DNA sample — the specimen you mailed back to the company, if the lab still has it. (Many labs destroy the physical sample automatically once testing is complete; ask if you’re unsure.)
Consider keeping a local backup of your data first. For example, you can take a screenshot or save a PDF of your lineage data and infographics (e.g., the maps showing where your ancestors came from). You can also download your actual raw DNA sequence file (more on that below).
If you keep a copy of your DNA sequence, store it securely. Ideally you’d encrypt it locally, offline. Ror example, keeping the file on an external drive in a safe or firebox. Storing it unencrypted in general cloud storage defeats much of the purpose. A hard copy printout is an option too, but it’s not useful if you’d ever want the data in digital form again (for medical research, say, or importing into a different tool).
If you opted your DNA into a clinical research or study, that data will typically not be deleted when you delete your account, though it is usually de-identified (i.e., purportedly can’t be traced back to you). De-identification isn’t perfect and can sometimes be reverse-engineered with the right auxiliary data sets.
How to Download Your Raw Data First
If you want a copy of your raw DNA file — to keep offline, to move into an on-device tool like the one mentioned below, or just to have before you delete anything — download it before you start the deletion process. Here’s how, site by site:
23andMe: Log in, click your username, then “Settings.” Scroll to “23andMe Data” and click “View.” From here you can download several files individually: “Reports Summary” (your Wellness, Ancestry, and Traits reports), “Ancestry Composition Raw Data,” “Family Tree Data” (your DNA Relatives matches, if you used that feature), and — the one most third-party tools want — the plain “Raw Data” file, which is your uninterpreted genotype data.
Ancestry: Go to the DNA tab, then “Your DNA Results Summary,” then “Settings.” Scroll to the “Download or Delete” section and click “Download DNA Data.” You’ll be asked to re-enter your password or confirm a code emailed to you. Check your email for a one-time download link (it typically expires after about a week and can only be used once), click it, and save the resulting .zip file — inside is a text file with your raw genetic markers.
MyHeritage: Go to the DNA tab, “Manage DNA Kits,” click the three dots next to your kit, and choose “Download.” Accept the terms, then check your email for a download link. You’ll need to re-enter your password on the download page. Note: only the kit manager can download the file, downloads only work from a computer or Android device (not iPhone/iPad), and this only works for a kit you tested directly with MyHeritage, not one transferred in from another company.
As noted above, store the downloaded file somewhere secure (ideally encrypted and offline) until you decide what, if anything, to do with it next.
How to Remove Your Data
Please note the process can change, and this information may be outdated by the time you read it. My underlying advice is to check the company’s current help center before you start. As of this update, here’s how to delete your data from each site:
23andMe (now operated by TTAM Research Institute): Log into your account, click your username, then “Settings.” Scroll to the bottom to “23andMe Data” and click “View.” Scroll down and click “Permanently Delete Data.” You’ll get a confirmation email and you’ll want to click the link inside it to finalize the deletion.
This also revokes consent for any research use and can trigger destruction of your physical sample if you haven’t already requested that separately. Note that TTAM’s privacy policy states it will retain limited data (like date of birth and sex) as required for legal compliance, even after deletion.
Ancestry: You now have two options. To delete just your DNA results while keeping the rest of your account, go to DNA Settings, and use “Delete DNA Test Results and Revoke Consent” (you’ll need to re-enter your password). To delete everything (i.e. your DNA data, family tree, and account), go to ancestry.com/secure/account/delete, confirm the items you want removed, and complete the emailed confirmation code. Full deletion takes up to 30 days to process, and any saliva sample on file is destroyed as part of it.
MyHeritage: For your digital DNA data, go to the “DNA” tab, select “Manage DNA Kits,” click the three dots next to the kit, and choose “Delete.” This also removes your DNA Matches. To request destruction of a physical sample still on file, email privacy@myheritage.com directly because this is handled separately from the digital deletion.
A Newer Option: Managing Your DNA Data Locally
Since we first published this guide, a small but growing category of tools has emerged that sidesteps this entire problem: apps that read your existing raw DNA export file (the one you download from 23andMe, Ancestry, or MyHeritage) locally, on your own phone or in your browser, and never upload it anywhere at all. If there’s no copy on a company’s server, there’s no database for a future bankruptcy, breach, or acquisition to put up for sale.
This doesn’t undo the fact that your raw data already sits with whichever testing company you originally used, which is a separate decision covered above. But if you’re DNA-curious and haven’t tested yet, or you want to keep exploring a file you’ve already downloaded without handing it to another cloud service, on-device tools are worth knowing about as this space matures.
Quanome is an app created to parse your 23andMe/Ancestry/MyHeritage file entirely on your device. The developer claims there’s no upload and no central database to eventually sell in a bankruptcy. They even have a free browser tool where you can watch your Network tab and confirm nothing leaves your machine while it reads your raw file (link here).
Caveats: I learned about Quanome via a reader reaching out to me. I wasn’t paid, and I have no financial relationship with them, just flagging privacy-friendly tech when I see it. It’s an early iOS beta from a small team (here), so limited track record so far, and their in-app AI coach feature does send small data slices to a backend for processing (only the raw genome/files stay fully local). Worth a look if you’re wary of centralizing your genetic data, but do your own diligence before importing anything.
Update: Quanome is now available on Android here.
Conclusion
At-home DNA testing is a classic risk-reward decision, and the last three years have only sharpened the “risk” side of that equation. It can be an interesting and fun way to learn more about your ancestry and health, but the 23andMe bankruptcy proved that your genetic data’s fate can outlive the company you originally trusted it to, and even the best-behaved acquirer is still someone you didn’t choose.
It’s worth being aware of the reputation, privacy policies, and practices of any site offering these tests, checking what your state’s genetic privacy law does and doesn’t cover, and exercising your right to delete your DNA data if you no longer want it stored on their servers. Deleting your data may be a prudent, proactive move to future-proof your privacy and keep control of your genetic information, and increasingly, so is thinking twice about uploading it anywhere in the first place.
This post was originally published in November 2023 and has been updated in July 2026 to reflect the 23andMe bankruptcy and sale, current deletion steps, and new state privacy laws.
Looking for help with a privacy issue or privacy concern? Chances are we’ve covered it already or will soon. Follow us on X and LinkedIn for updates on this topic and other internet privacy related topics.
Disclaimer: None of the above is to be deemed legal advice of any kind. These are *opinions* written by a privacy and tech attorney with years of working for, with and against Big Tech and Big Data. And this post is for informational purposes only and is not intended for use in furtherance of any unlawful activity. This post may also contain affiliate links, which means that at no additional cost to you, we earn a commission if you click through and make a purchase.
Know your doxxing risk. DoxxScore gives you a personalized exposure assessment and action plan in under 5 minutes. Get Your Risk Score →
Check out our new, free username generator to help you create unique usernames for different accounts. Reusing usernames is convenient, but terrible for your privacy. This tool makes it easy to create unique usernames on the fly.