DNA Test Privacy: What Leaks, and How to Control It

Woolf Software
privacy genomics sequencing security data-ownership
A feathered reptilian creature stands in a locked smoked-glass display case under a single overhead light, with faint smaller reflections of itself in the glass.

Your genome is the one identifier you cannot rotate. When a password leaks, you change it. When your genotype leaks, it is public forever. It also partially discloses your siblings, parents, children and cousins. Wait — that sentence has too many commas. Let me put it plainly: a leaked genotype also discloses information about your siblings, parents, children and cousins, none of whom consented to anything. That is the whole privacy problem. Everything else is a question of which parties hold a copy, what constraints bind them, and what an adversary can do with a partial copy.

The practical answer is straightforward. If you want the data without the exposure, buy sequencing as a service and take delivery of the raw files. That means FASTQ or CRAM plus VCF. Do the interpretation yourself on hardware you control. Avoid products whose business model is a matching database, because the matching database is the exposure. Consumer ancestry products are built around relative-matching. That feature requires the company to hold your genotypes in a queryable index alongside millions of others, indefinitely.

What data exists after a test, and where it lives

Before you can reason about exposure, it helps to know exactly what a test produces and who ends up holding it. The answer differs substantially between array-based consumer tests and full sequencing. This section walks through both.

A consumer array test such as 23andMe or AncestryDNA genotypes roughly 600,000 to 700,000 SNPs on an Illumina microarray. SNPs are the single-letter variable positions in the genome. The company stores your genotype calls and the physical saliva sample unless you opt out of biobanking. It also stores your account identity and your self-reported survey answers. If you use the matching feature, it additionally holds a derived index of identity-by-descent segments shared with every other user.

A clinical or research-grade whole-genome sequence at 30x produces something different in kind. The 30x figure means each position in the genome is read about 30 times on average. Expect about 100 GB of FASTQ, the raw sequencing reads with their quality scores. The aligned data runs 40 to 60 GB as a CRAM mapped to the GRCh38 reference genome. The variant list is a VCF of 4 to 5 million variants, roughly 1 to 2 GB uncompressed. A VCF, or variant call format file, lists the positions where your genome differs from the reference. That file includes coding variants in ACMG secondary-findings genes, pharmacogenomic star alleles, HLA types and mitochondrial haplogroup. It also carries the same identity-by-descent information the array gives you, at higher resolution.

The exposure surface is not the file size. It is the number of copies in existence and the number of organizations holding a key. For any test you are considering, ask a short list of questions and insist on concrete answers:

  • Who holds the physical sample after sequencing, and for how long? Get the retention period in days.
  • Is raw data (FASTQ/CRAM) delivered to me, or only a report?
  • Is my genotype entered into a relative-matching index by default?
  • What happens to my data in a bankruptcy or acquisition? Read the assignment clause in the terms, not the privacy policy marketing page.
  • Is deletion deletion, or de-identification? Ask whether backups and derived datasets are purged, and on what schedule.

The 23andMe bankruptcy proceedings in 2025 made the fourth question the important one. Privacy policies are unilateral contracts that the company can amend, and customer data is an asset in a sale. A promise that “we never sell your data” is a promise made by an entity that may not exist next year.

A common assumption is that stripping names from genomic data makes it anonymous. The research literature is unambiguous that it does not. A few dozen common SNPs are sufficient to uniquely fingerprint an individual. Surname inference from Y-chromosome haplotypes combined with public genealogy databases has been demonstrated against supposedly anonymous research participants. Genomic data resists the standard de-identification toolkit because the data itself is the identifier and because it is correlated across a family 1.

Two consequences of this tend to be underestimated by engineers. The first is that familial search works at third-cousin distance. The GEDmatch-based identification in the Golden State Killer case relied on a distant relative’s upload. Coverage estimates at the time suggested that a database holding a few percent of a population can return a third-cousin-or-closer match for the large majority of that population. You have no control over whether your relatives upload.

The second is that summary statistics leak membership. Homer-style attacks can recover whether a specific individual is present in a case cohort from allele-frequency summaries alone. That is why dbGaP moved aggregate data behind controlled access. The general framing in the privacy literature is that genomic data defeats the usual anonymization assumptions and needs cryptographic or policy controls instead 2. Proposed mitigations are real but not yet routine. They include homomorphic encryption for variant queries, secure multiparty computation for alignment, and differential privacy on released statistics. Each carries substantial performance costs 34.

There is also an information-disclosure problem that has nothing to do with attackers at all. Testing reveals misattributed parentage, undisclosed adoption and unknown half-siblings. It reveals them both to you and to relatives who never ordered a test. Interview work with adoptees using direct-to-consumer testing documents how such results reshape identity and family relationships in ways the purchase page does not anticipate 5. Genetic genealogy also surfaces documented ancestry tied to slavery. It produces contact between descendants of enslaved people and descendants of enslavers, a category of consequence that no consent checkbox covers 6.

The setup we would use

This section describes the working setup we would recommend once the data is in your hands, along with the reasoning behind each piece of it. We run everything after data delivery on local hardware. The threat model is simple. Minimize the number of parties holding a copy, and encrypt every copy at rest.

Start with storage and encryption. Put the CRAM and VCF on a LUKS2 volume or a ZFS dataset with native encryption (zfs create -o encryption=aes-256-gcm -o keyformat=passphrase). For an offsite copy, encrypt before upload with age:

age -r age1... -o wgs.cram.age wgs.cram

Do not rely on the cloud provider’s server-side encryption as your only layer. Keep a printed copy of the key material offline. A lost key here means unrecoverable data, and re-sequencing means another blood draw and another $1,000 or more.

Next, consider the working files themselves. A 30x CRAM against GRCh38 runs 40 to 60 GB. Keep the CRAM rather than the BAM, since it is roughly 40% smaller. Keep the reference FASTA that was used for compression as well, because CRAM decoding requires it. Check the file with samtools quickcheck -v on arrival and verify the md5 the lab provides.

Annotation is the step that attaches biological meaning to each variant, and it should happen offline. Run Ensembl VEP or SnpEff locally with cached databases rather than sending a VCF to a web annotator:

vep -i sample.vcf.gz --cache --offline --dir_cache /data/vep \
    --assembly GRCh38 --everything --fork 8 --vcf -o sample.vep.vcf

The --offline flag is the point of the exercise. Web-based annotation services receive your full variant list, which is a complete genetic identifier.

Filtering before sharing follows the same logic. If you need to hand a subset to a clinician or a collaborator, extract only the regions of interest:

bcftools view -R panel.bed -Oz -o panel.vcf.gz sample.vcf.gz

A 30-gene panel VCF is still identifying. It is nonetheless a far smaller disclosure than 4.5 million variants.

AI agents deserve their own caution. Feeding a VCF to a hosted model means sending your genotypes to a third party with its own retention policy. If you want an agent to reason over your data, run a local model. The alternative is to send derived summaries such as a named star allele or a polygenic score value rather than raw genotypes. The general principle from the privacy-preserving personalized-medicine work applies here: release the minimum derived value required for the decision, not the underlying variants 7.

What the law does and does not cover

Legal protection exists, but its coverage is narrower than most people expect. It is worth knowing where the gaps fall. In the US, GINA prohibits health insurers and employers with 15 or more employees from using genetic information in coverage or employment decisions. It does not cover life insurance, disability insurance or long-term care insurance. It also does not restrict what a direct-to-consumer company does with data you gave it voluntarily.

HIPAA applies to covered entities such as providers, health plans and clearinghouses, along with their business associates. A consumer genomics company selling directly to you is generally not a covered entity. For that reason, “HIPAA-compliant” in marketing copy often describes a voluntary posture rather than a legal obligation. Several states, including Florida and California, have added specific genetic-privacy statutes. The regulatory patchwork consistently lags the technical capability, which is the standing observation in the next-generation sequencing ethics literature 8. Law enforcement access depends on the company’s stance and on whether a warrant is served. Companies publish transparency reports, and those are worth reading.

The data lifecycle matters as much as any single control. Collection, transmission and storage each have distinct failure modes. The same is true of analysis, sharing and destruction. Most consumer products are opaque about the last two 9.

Questions people also ask

Do DNA tests sell your data? The major consumer companies say they do not sell individual-level data without consent. They typically monetize through aggregate research partnerships you opt into at signup. The sharper risk is transfer rather than sale, whether through acquisition, bankruptcy or a change in terms. Assume that any database that exists can change hands.

Are there confidential DNA tests? Yes, in the sense that you can buy sequencing as a service and receive the FASTQ/CRAM. You can also require sample destruction and data deletion after delivery. That reduces the exposure to one vendor for a bounded period rather than a permanent database entry. Nothing, however, removes the familial-inference risk created by relatives who test elsewhere.

Which DNA test is the most privacy-friendly? The one that delivers raw files and does not operate a relative-matching index. It should also destroy the sample on a stated schedule and give you a written deletion confirmation. Prefer CLIA/CAP-accredited labs for analytical quality, and read the data-assignment clause before ordering.

Why shouldn’t you do AncestryDNA? The matching database is the product. That means your genotypes stay indexed and queryable, and matches expose relatives. You also receive no raw sequence, only array genotypes, which limits what you can do with the data afterward.

Is DNA testing an invasion of privacy? Testing yourself is your choice. It also discloses probabilistic information about relatives who did not choose, which is the part that standard consent frameworks handle poorly 1.

One final point on interpretation. Results that suggest a clinically actionable finding need confirmation in a clinical lab and interpretation by a genetic counselor or physician. That includes ACMG secondary findings and pharmacogenomic variants. Do not act on a research-grade VCF alone.

Woolf Software builds longitudinal molecular profiles of individuals: whole-genome sequencing, RNA sequencing, proteomics, blood biomarkers, and continuous glucose data, integrated into one model of you. Build your profile.

Footnotes

  1. Luca Bonomi, Yingxiang Huang, Lucila Ohno-Machado. Privacy challenges and research opportunities for genomic data sharing. Nature Genetics, 2020. https://doi.org/10.1038/s41588-020-0651-0 ↩ ↩2

  2. Hong Shen, Jian Ma. Privacy Challenges of Genomic Big Data. Advances in Experimental Medicine and Biology, 2017. https://doi.org/10.1007/978-981-10-6041-0_8 ↩

  3. Abukari Mohammed Yakubu, Yi-Ping Phoebe Chen. Ensuring privacy and security of genomic data and functionalities. Briefings in Bioinformatics, 2019. https://doi.org/10.1093/bib/bbz013 ↩

  4. Dandan Lu, Yue Zhang, Ling Zhang, et al. Methods of privacy-preserving genomic sequencing data alignments. Briefings in Bioinformatics, 2021. https://doi.org/10.1093/bib/bbab151 ↩

  5. Alison C. Kay, Nicola V. Taverner. Adoptees’ views and experiences of direct-to-consumer (DTC) genomic testing: an exploratory interview study from the UK. Journal of Community Genetics, 2022. https://doi.org/10.1007/s12687-022-00622-y ↩

  6. Sarah Abel. Linked Descendants: Genetic-genealogical Practices and the Refusal of Ignorance around Slavery. Science, Technology, & Human Values, 2021. https://doi.org/10.1177/01622439211021656 ↩

  7. Erman Ayday, Jean Louis Raisaro, Jean-Pierre Hubaux, et al. Protecting and evaluating genomic privacy in medical tests and personalized medicine. Proceedings of the 12th ACM workshop on Workshop on privacy in the electronic society, 2013. https://doi.org/10.1145/2517840.2517843 ↩

  8. Nicole Martinez-Martin, David Magnus. Privacy and ethical challenges in next-generation sequencing. Expert Review of Precision Medicine and Drug Development, 2019. https://doi.org/10.1080/23808993.2019.1599685 ↩

  9. Muhalb M Alsaffar, Mohammad Hasan, Gavin P McStay, et al. Digital DNA lifecycle security and privacy: an overview. Briefings in Bioinformatics, 2022. https://doi.org/10.1093/bib/bbab607 ↩