23andMe and the Privacy Risks of Consumer Genetic Tests

Buying a genetic test often feels like purchasing an ordinary consumer product. A kit arrives, a saliva sample is posted back, and a report reveals ancestry estimates or information about inherited traits. The commercial interface suggests convenience and personal insight. The process also creates one of the most sensitive digital records a person can generate, linking their identity to relatives, health and biometric characteristics.

Australian consumers face particular complications. Many purchase directly from United States-based laboratories, meaning their DNA and family-tree information is stored overseas. A sample posted from a house in Brisbane, Perth or Adelaide may enter a database used by relatives and law-enforcement agencies in several countries. Consumer tests are generally paid for privately, so a Medicare rebate does not ordinarily cover them.

The privacy risks of 23andMe and other direct-to-consumer genetic tests therefore extend well beyond the individual who submitted a sample. Relatives can become exposed through matching, old records can resurface after years, and a seemingly harmless hobby can intersect with medical research, advertising, policing and identity theft. Understanding those relationships is essential before treating the resulting report as ordinary personal data.

Why DNA differs from ordinary consumer data

A password can be changed after a breach. A credit-card number can usually be replaced. Biological information cannot be reset in the same way. A DNA profile may reveal parts of a person’s identity that remain useful for a lifetime, particularly when combined with an uploaded family tree, date of birth and other records available online.

The exposure can also spread through families. A person may learn that a parent, sibling or distant relative took the same test, even if that relative never intended their information to appear in a matching system. In families spread across Australia, New Zealand and the United Kingdom, a single upload can connect relatives whose privacy expectations differ. Ancestry estimates may be especially sensitive for people adopted through closed or historical care arrangements, or for those uncertain about their parentage.

Companies may describe uploaded trees and genetic matches as tools controlled by the customer, with privacy settings presented as a solution. Yet these settings are difficult to translate into a clear picture of retention, research use and third-party access. The person making a decision is often operating with less information than the laboratory, while relatives who may be affected have no vote at all.

What happens after the sample arrives

The visible part of the process is simple, but the data journey is not. A laboratory receives the sample, extracts DNA, analyses selected markers and may store raw information for later research. Depending on the service and the permissions given, results can also enter a matching network or be processed under separate research and business policies.

Law-enforcement requests form one route to disclosure. A valid legal order may require a company to reveal customer information, sometimes including uploaded trees and profile details. Genetic matching can make an otherwise unknown person identifiable, while family-tree records may provide the context needed to interpret a match. Requests from one country can also become part of an investigation elsewhere because the relevant database has no national borders.

Researchers, contractors and commercial partners create another pathway. The precise arrangements vary between providers, and customers need to distinguish between aggregate research, identifiable data transfers and marketing uses. Work on privacy specialists reinforces why understandable consent, limited retention and meaningful deletion are central to handling information that can affect a person’s health and family relationships.

Australian privacy law has real but limited reach

Australia’s Privacy Act 1988 and the Australian Privacy Principles provide important protections for covered organisations. Genetic information is treated as sensitive information, which raises the expectations placed on consent, notice, security and the purposes for which data may be used. Individuals covered by the scheme can seek access, correction and complaint pathways, including through the Office of the Australian Information Commissioner.

Coverage is not universal. Government agencies and many private organisations are covered, often depending on turnover, activities or exemptions. Some small businesses fall outside the general regime, while the reach of the law against a foreign company with few Australian operations can be complicated. The principles do not automatically travel with a saliva tube, and enforcing an Australian decision against a laboratory or partner operating elsewhere may be difficult. Relevant state and territory privacy regimes can also apply to health services within their jurisdiction.

This uncertainty should not be confused with a lack of enforceable rights. A consumer can ask a provider whether Australian privacy law covers its operations, what information is shared, which partners receive it and what happens after account closure. Those questions are particularly important when data is stored in the United States and where public security requests operate under domestic law rather than the Privacy Act.

Breaches can expose relatives as well as customers

The 2023 breach involving 23andMe demonstrated the difference between compromising an account and compromising a family network. Attackers used reused credentials to access accounts, and the information they obtained included millions of profiles and family-tree records. A customer whose own DNA was not exposed directly could still be affected through relatives whose matching data was taken.

Breach notices often focus on the number of customer accounts involved, which can obscure the wider human impact. A leaked tree can contain names, birth dates, locations and photographs of people who never bought a kit. Partial genetic data may also support fraud or targeted harassment when joined with records from data brokers, genealogy services or social media.

Digital exposure is reinforced by ordinary household technology. The same vulnerabilities described in material on router log exposure can connect a home internet connection to the person using it. Research into smart bulb tracking similarly shows that devices people consider harmless can record patterns of presence and movement. Genetic information becomes more dangerous when placed inside a wider network of devices and databases that quietly collect behavioural data.

Health claims widen the data economy

Ancestry reports attract attention because they promise answers about family history, but health-related results carry additional consequences. A report may cover inherited disease variants, carrier status or estimated susceptibility to conditions. These findings are not always diagnoses, yet they can influence medical appointments, family decisions and attitudes toward a person’s future.

Consumers can mistake a polished risk score for clinical certainty. Polygenic estimates depend on the populations and reference data used to construct them, and their usefulness may vary across ancestry groups. General consumer health information can help readers distinguish education from diagnosis, while genetic reports themselves often state that a health result is not a substitute for professional advice. Privacy and interpretation are separate problems: accurate understanding does not remove the consequences of storing the underlying data.

A prominent Australian safeguard is the life-insurance industry’s moratorium on relying on results from voluntary genetic testing for many new policies, with exceptions and timing rules that matter. That arrangement addresses one use of health data rather than the entire market. Employers, lenders, commercial researchers and service providers may still encounter the information. Australia’s medical-device regulator also considers whether a product’s claims place it within medical-device regulation, so the regulatory treatment of a test depends partly on what its developer promises.

Keeping genetic privacy in perspective

A consumer evaluating a consumer genetic test is dealing with a service and a long-lived database, not merely a one-off report. The relevant questions include where raw DNA is stored, whether family matching is enabled, which research and marketing permissions apply, how long records survive deletion and what legal requests the company receives. Reviewing account controls before uploading a tree can reduce exposure, while checking the provider’s deletion process can prevent the false assumption that closing an account erases every derived record immediately.

Relatives deserve consideration as well. Telling family members that a test has been uploaded may be socially awkward, but the alternative can leave them unaware that their information is participating in matching systems. Families can establish shared expectations before testing, particularly when children, adoption histories or deceased relatives are involved. Records should also be stored and shared cautiously, since a genealogy profile can become more revealing when combined with public records.

The lasting point is that genetic testing can offer genuine value without requiring blind trust. Its privacy depends on who receives the information, how long they keep it and whether controls remain understandable after the report is delivered. The most private genetic test is not the one with the most attractive findings, but the one whose collection, sharing and retention the customer genuinely understands.