Swabbed and Sold: The Quiet Monetization of Your Most Intimate Data
For roughly $79 and a small plastic tube, millions of Americans have handed over something far more consequential than a credit card number or a home address. They have surrendered the biological blueprint that defines them at a molecular level — and in doing so, they have entered one of the least regulated data markets in the country.
The consumer DNA testing industry has grown into a multibillion-dollar enterprise built on a deceptively simple promise: send us your saliva, and we will tell you who you are. What the marketing does not emphasize is the second half of that transaction. Once your sample is processed, your genetic information enters a data ecosystem governed by privacy policies that most users never read, legal frameworks riddled with gaps, and commercial relationships that extend well beyond the company that mailed you your ancestry report.
What Your DNA Actually Reveals
Genetic data is categorically different from any other form of personal information. A compromised password can be reset. A leaked email address can be abandoned. Your genome cannot be changed, revoked, or reissued.
Beyond ancestry percentages and ethnicity estimates, a DNA profile can reveal predispositions to dozens of medical conditions, including Alzheimer's disease, certain cancers, and cardiovascular disorders. It can expose behavioral tendencies, fertility characteristics, and drug metabolism patterns that have direct implications for insurance eligibility and employment decisions. Critically, because DNA is inherited, a single person's decision to submit a sample does not affect only that individual. It effectively enrolls every biological relative — including people who never consented to any test — into the same data pool.
This is not a hypothetical concern. It is the operational reality of how genetic databases function.
The Legal Architecture That Permits It
The United States has no comprehensive federal law governing how private companies collect, store, share, or sell genetic data. The Genetic Information Nondiscrimination Act of 2008, commonly known as GINA, prohibits health insurers and employers from discriminating based on genetic information in specific contexts. However, GINA contains significant exclusions. It does not apply to life insurance, disability insurance, or long-term care insurance — three categories where genetic predispositions carry enormous financial weight.
Beyond GINA's narrow scope, consumer DNA companies operate primarily under the terms of their own privacy policies, which are legally binding contracts that users agree to, often without reading them. These policies frequently include provisions that authorize the sharing of de-identified genetic data with third-party research partners, pharmaceutical companies, and biotech firms. The term "de-identified" is doing considerable work in that sentence. Multiple academic studies have demonstrated that genetic data can be re-identified with surprising reliability, particularly when cross-referenced with other commercially available datasets.
In 2023, the bankruptcy proceedings of one major consumer DNA company illustrated exactly how vulnerable these arrangements are. When 23andMe filed for bankruptcy protection, consumer advocates raised urgent questions about the fate of the genetic profiles belonging to more than fourteen million customers. Bankruptcy law does not guarantee that data assets — including biological samples and associated records — will be treated with the same protections that existed under the original company's privacy policy. A successor entity, or a buyer of those assets, operates under different legal obligations.
Law Enforcement and the Genealogical Back Door
Perhaps the most consequential use of consumer genetic databases has occurred in the context of criminal investigations. Law enforcement agencies have used a technique called investigative genetic genealogy, which involves uploading crime scene DNA to public genealogy databases and tracing family connections to identify suspects. This approach has been credited with solving cold cases, including the identification of the Golden State Killer in 2018.
The civil liberties implications, however, are substantial. When investigators search a genealogy database, they are not merely checking whether a specific individual is present. They are effectively searching the genetic profiles of every person related to anyone in that database. Estimates suggest that a database containing as few as three million profiles of European ancestry can identify roughly sixty percent of Americans of that background through third-degree relatives or closer.
Several states have enacted regulations requiring law enforcement to obtain judicial authorization before conducting such searches, but there is no uniform federal standard. The result is a patchwork of protections that vary dramatically depending on where an investigation originates and which database is searched.
Health Apps and the Biotech Pipeline
Consumer DNA companies are not the only entities collecting genetic and health-adjacent information. A growing category of health and wellness applications requests access to data that, while not technically genetic, serves as a close proxy. Menstrual cycle trackers, fitness monitors, glucose management platforms, and mental health applications gather physiological data that can be combined with other information to construct profiles with significant predictive value.
Several of these applications have been found to share data with advertising networks, analytics firms, and in some cases, data brokers who aggregate and resell information to clients whose identities are not disclosed to consumers. The Federal Trade Commission has taken enforcement action against specific companies in this space, but the regulatory apparatus remains reactive rather than preventive.
Practical Steps for Protecting Your Genetic Privacy
For individuals who have already submitted DNA samples to consumer testing services, the options are limited but not negligible.
Opt out of research sharing. Most major DNA testing companies provide account settings that allow users to withdraw consent for their data to be included in third-party research programs. These settings are rarely prominent, but they exist and should be reviewed.
Request deletion of your biological sample. Distinct from deleting an online account, many companies retain physical saliva samples for extended periods unless a specific deletion request is submitted. Users should contact customer service directly to confirm that both the sample and the associated genetic profile have been removed from storage.
Review your consent history. Privacy policies change, and consent granted under one version of a policy may not reflect the terms of a subsequent revision. Periodic review of these documents, tedious as it is, remains one of the few mechanisms available to informed consumers.
Exercise caution with health applications. Before granting a wellness app access to sensitive health data, examine its privacy policy for language regarding third-party data sharing. If the policy is vague or absent, that absence is itself informative.
Use a VPN when accessing genetic or health platforms. While a VPN does not protect the data you voluntarily submit to a service, it does prevent your internet service provider and network-level observers from associating your browsing behavior — including visits to genetic testing sites and health platforms — with your identity. Reducing the metadata trail around sensitive activities is a meaningful layer of protection.
The Biological Frontier of Privacy
The data economy has always expanded toward whatever information carries the most predictive and commercial value. Genetic data represents the logical terminus of that expansion — information that is permanent, inherited, deeply personal, and extraordinarily revealing. The regulatory frameworks that govern it have not kept pace with the industry's growth, and the consequences of that gap are being absorbed, largely invisibly, by the millions of Americans who believed they were simply learning about their heritage.
Privacy in the digital age has always required active participation. In the biological dimension, that requirement is no less urgent, and the stakes are considerably higher. What exists in your genome cannot be un-leaked, un-sold, or un-shared. The time to consider those implications is before the sample is mailed, not after the results arrive.
