Reading a DNA Company's Privacy Policy: Red Flags

A genetic privacy policy is not thrilling reading, but it is the one document that tells you what a company may actually do with the most personal data you own. Here is how to read one quickly and spot the parts that matter.

Who your data is shared with

Start with sharing, because it is where the biggest surprises hide. Look for language about third parties, partners, academic collaborators, and commercial research. The key question is not only whether sharing happens, but how you are enrolled in it.

• Opt-in means nothing is shared until you actively agree. This is the friendlier default.
• Opt-out means you are enrolled by default and have to find the setting to leave.

Watch for soft phrases like “we may share aggregated or de-identified data with partners.” That sentence can cover a lot of ground, and de-identified genetic data is not as anonymous as it sounds, a point worth keeping in mind whenever you read it.

Retention and sample storage

There are two separate things being retained: your digital data and your physical sample. A tube of saliva can sit in a lab freezer for years unless you say otherwise. Look for whether the company stores your biological sample by default, whether you can decline storage, and how to request its destruction later.

For the digital side, a good policy states clear retention periods in plain language. Vague wording such as “as long as necessary for our business purposes” gives the company wide discretion and gives you little to hold onto.

What happens if the company changes hands

This clause is easy to skim past and important to read. Most policies include a line about mergers, acquisitions, and bankruptcy, typically noting that your data may transfer to a new owner as a business asset. That means the company you carefully vetted today may not be the company holding your genome next year, and the new owner may operate under different terms. A policy that promises to notify you and honor your existing choices after a sale is meaningfully better than one that stays silent.

How deletion actually works

Every reputable service offers deletion, but the details vary. Read for specifics: does deleting your account also destroy your stored sample, or is that a separate request? Does data already shared for research get pulled back, or is it beyond recall once distributed? Do backups and logs persist for a while after you click the button?

None of these caveats are automatically sinister, but a policy that spells them out is being honest with you. Our guide on how to delete DNA data and stay in control covers how to make those requests count.

Whether de-identified data is sold

Selling stripped genetic and health data to pharmaceutical or research buyers is a real business model, not a hypothetical. Search the document for words like “sell,” “license,” “monetize,” and “commercial research.” A company can be entirely upfront about this while still doing it, so the presence of a research program is not a scandal on its own. What matters is whether you can see it clearly and choose to stay out.

A quick reading checklist

When you open a policy, look for direct answers to these:

• Is research and third-party sharing opt-in or opt-out?
• Is my physical sample stored by default, and can I have it destroyed?
• What are the stated retention periods, in plain words?
• What happens to my data if the company is sold or goes bankrupt?
• Does deletion cover my sample, backups, and already-shared data?
• Is de-identified data ever sold or licensed?

If a policy is evasive on several of these, treat that as the red flag, not just any single clause.

The quieter alternative

The surest way to avoid policy fine print is to not hand your genome over in the first place. When your goal is simply to explore your own raw file, on-device analysis that runs in your browser keeps the data with you and leaves no policy to negotiate.

This article is educational and is not legal advice.