Before that cheek swab hits the mailbox, I need you to stop and hear this. The moment the envelope leaves your hand, a private company owns a copy of the one piece of personal data you will never change, never replace, and never get back, and no federal privacy law stands guard over it from that second forward. Read that twice.
What Rides Along in That Envelope
Think of your DNA as the instruction manual for building you. Any mail-in test sends roughly three billion base pairs of that manual to a lab you have never seen. Most labs read between 600,000 and 700,000 markers, and then computer models use a process called imputation to fill in millions of extra data points, the same way autocomplete finishes your sentences on your phone, until the company holds a detailed picture of your biology that no single test ever measured directly. Scientists have shown as few as 30 markers single out one person from the entire human population. That person is you.
Your Family Got Signed Up Too
Your DNA works like a group photo, so when you share it, everyone standing next to you shows up in the picture. Researchers found in 2018 that a genetic database covering only 2 percent of a population finds a third cousin match for almost anyone in it. The day you mail your kit, you enroll your grandmother and your nephew, your second cousins and your kids, in a database none of them ever agreed to join, and not one of them will see a consent form carrying their own name.
15 Million People Learned This the Hard Way
In 2023, hackers accessed about 14,000 23andMe accounts using passwords stolen from other websites. Using the company’s relative matching feature, they scraped data on roughly 6.9 million people, nearly half of its customers.
A hacker calling himself Golem posted one million profiles of people with Ashkenazi Jewish ancestry on a dark web forum. The price, per person, was one dollar. The company took five months to detect the intrusion and then blamed its own customers for reusing passwords.
On March 23, 2025, 23andMe filed for bankruptcy. Twenty-eight attorneys general and the Federal Trade Commission stood up to block the sale of genetic data belonging to 15 million customers who never agreed to any of it, and the bankruptcy court approved the sale anyway, turning those customers’ DNA into an item on an auction block. That is the law today.
Delete Means Something Different Here
Close a 23andMe account, and the company still keeps your genetic information and your date of birth for what it calls regulatory compliance. Data already shared with research partners stays out of your reach for good. Gone is gone. Direct-to-consumer tests sit completely outside HIPAA, the federal health privacy law covering your doctor, and GINA, the closest thing this country has to a genetic privacy law, leaves your life insurance and your long-term care insurance wide open.
Your Move Before the Mailbox
Treat the research consent form like a lease you will live under for the rest of your life, and read it line by line, because 80 percent of 23andMe customers opted into research, many of them without grasping how much they handed over to strangers.
Check your state. California, Montana, Indiana, Texas, Illinois, and Maryland have dedicated genetic privacy laws, and Illinois lets you sue for up to $15,000 per violation. If your state has none, call your legislators and ask for one by name. If you already tested, download a copy of your data, delete your account, destroy your stored sample, and revoke your research consent today in writing. A company’s promise to protect your DNA lasts exactly as long as the company does.
Your ancestry report fits on one page, and the surveillance risk you hand a stranger inside that envelope follows your family for generations, so share this with the people who share your DNA and make the call together before anyone licks the seal.
Mitch Jackson, Esq. [recommendations]
Free subscribers get my new five-page special report, Take Back Your Data Privacy in 30 Minutes. Upgrade to a paid subscription and not only are you helping support this Substack, you also get full access to the PDF version of my 21-chapter, 251-page book, Privacy in America: What Every American Needs to Know.
No comments:
Post a Comment