DNA kits read a sliver of your genes, and the data can be sold

Key takeaways

• The FDA’s 2018 authorization of 23andMe’s BRCA report covered three gene variants out of more than 1,000 known, so a clean result doesn’t rule out inherited cancer risk.
• In a 2018 study of 49 patients, 40% of the variants flagged in consumer raw data could not be confirmed by a clinical lab.
• The federal genetic nondiscrimination law, GINA, covers health insurance and most jobs, but not life, disability or long-term care insurance.
• After 28 attorneys general sued, 23andMe’s 2025 sale to a founder-led nonprofit came with promises, including deletion rights and no sharing with insurers without express permission.
• Before acting on any health finding, get it confirmed by a test your clinician orders, and consider a genetic counselor from the national directory.

Between March 2025, when news of 23andMe’s bankruptcy broke, and that June, about 1.9 million people asked the company to delete their data. That was roughly 15% of its customers, the company’s interim chief executive told a House committee on June 10¹.

Those people had mailed in saliva, and with it a code they share with parents, children and cousins. Now the company holding that code was for sale.

A federal bankruptcy judge approved the sale in late June. The buyer, for $305 million, was a nonprofit created by 23andMe’s own co-founder¹². Even the judge called the sale of genetic data “a scary proposition,” though he noted that lawmakers hadn’t banned it¹².

The bankruptcy is one lesson from consumer DNA tests. The others are about the results themselves: what a spit kit can reliably tell you, what it can miss, and why an alarming finding from a third-party website may not be real.

What the FDA has reviewed, and what it hasn’t

The FDA generally reviews home tests meant for moderate- or high-risk medical purposes. It generally doesn’t review tests sold for wellness or ancestry². Your family-origins map almost certainly skipped FDA review.

Health reports are different. 23andMe got the FDA’s permission for a Bloom syndrome carrier test in February 2015, then for the first consumer genetic health risk reports in April 2017³. The FDA’s list of authorized reports includes late-onset Alzheimer’s disease, Parkinson’s disease, celiac disease and hereditary hemochromatosis, an iron-overload condition².

The review rules vary by report type, and they may be looser than you’d expect. Carrier screening, which tells you whether you could pass a condition to a child, is exempt from FDA premarket review. For genetic health risk reports, a company’s first test gets reviewed, but later reports can generally go on sale without a new premarket review unless they’re meant for certain higher-risk uses².

The company also has authorized pharmacogenetic reports. These look at genes such as CYP2C19, CYP2D6 and DPYD, which help the body process certain medicines².

Each report looks for variants, small spots where your DNA spelling differs from the most common version. The FDA attaches warnings to all of them. A positive result doesn’t mean you will develop a condition, and a negative result doesn’t mean you won’t².

The drug reports carry the sharpest caution. The FDA says they don’t predict how you’ll respond to a specific drug, and you shouldn’t rely on them to begin, end or adjust a treatment².

Three variants out of more than a thousand

In March 2018, the FDA authorized 23andMe to report three variants in the BRCA1 and BRCA2 genes, which are tied to higher risk of breast and ovarian cancer. The agency stressed that more than 1,000 BRCA variants are known³.

The three tested variants are most common in people of Ashkenazi Jewish descent, about 1 in 40 of whom carry one³. In the general population, the FDA said, these aren’t the most common BRCA variants. A negative result doesn’t rule out other variants that raise cancer risk³.

How much does that miss? The best-known estimates come from Invitae, a clinical genetic testing company that competes with 23andMe. In 2019 it looked at about 119,000 patients referred to it for BRCA testing⁴.

Among people without Ashkenazi ancestry who carried a BRCA variant, the three-variant approach would have missed 94%. It would have missed 19% of Ashkenazi carriers⁴. That study was a conference presentation and hadn’t been peer reviewed⁴.

Invitae researchers returned to the question in a 2023 study in JCO Precision Oncology. They reported that the approach missed more than 90% of disease-causing variants in people without Ashkenazi ancestry⁵. 23andMe answered both times that it is more than 99% accurate for the variants it does test⁴⁵.

In 2023, 23andMe announced that the FDA had cleared an expanded report covering 44 variants. By the company’s own estimate, those cover only about 30% to 40% of cancer-linked BRCA variants in African American, non-Ashkenazi European and Hispanic or Latino people. Its release said they still aren’t the majority for people of most ethnic backgrounds⁶.

Raw data and third-party sites: where false alarms start

Some kit buyers download their raw data, the long list of DNA spots the company’s chip read. Then they upload it to third-party services that promise to find more health risks.

A 2018 study in Genetics in Medicine shows the danger. Researchers at Ambry Genetics, a clinical lab, looked at 49 patients referred from 2014 to 2016 to confirm findings from consumer raw data⁷⁸. About 40% of the variants in the raw data couldn’t be confirmed by clinical testing⁷.

Interpretation added a second kind of error. Some variants really were there but got the wrong meaning. In eight such cases, spread across five genes that include BRCA1, BRCA2 and ATM, the consumer data or a third-party site called a variant “increased risk.” Ambry and several other clinical labs consider those same variants harmless⁷⁸.

The authors warned that false alarms can bring needless stress, unnecessary procedures and testing of relatives⁸. They suggested that technical differences between testing methods may explain some errors⁷.

Keep two limits in mind. The sample was small⁷, and Ambry sells the kind of confirmation testing the study recommends. Still, MedlinePlus, the National Library of Medicine’s consumer site, says consumer results usually need confirming with a clinician-ordered test, and that oversight of third-party interpretation services is limited¹⁰.

What GINA protects, and where it stops

The Genetic Information Nondiscrimination Act of 2008, known as GINA, is the main federal shield for genetic test results. According to the National Human Genome Research Institute (NHGRI), it has two parts⁹.

Situation	Does GINA protect you?
Health insurance eligibility, coverage and premiums	Yes; insurers can’t use or require genetic information9
Hiring, firing, pay and job assignments	Yes, at employers with 15 or more workers9
Life insurance	No9
Disability insurance	No9
Long-term care insurance	No9
Decisions by the U.S. military as an employer	No9

The Affordable Care Act adds another layer. Health insurers in the group and individual markets can’t refuse coverage over a pre-existing condition, including a genetic one⁹.

Some states go further and protect people in life, disability or long-term care insurance, NHGRI says⁹. California’s own version of GINA also covers housing, mortgage lending and education⁹.

MedlinePlus warns that results may affect your eligibility for life, disability or long-term care coverage¹⁰. If you plan to apply for one of those policies, factor that into when you test, and check your state’s law.

How 23andMe’s bankruptcy played out

23andMe was already wounded. In 2023, hackers reached genetic information on millions of customers, and roughly 7 million people were affected¹²¹⁴¹⁵. Here is what followed.

When	What happened
March 2025	23andMe files for Chapter 11 bankruptcy in Missouri15
May 2025	Regeneron Pharmaceuticals wins the first auction at $256 million; co-founder Anne Wojcicki forms the nonprofit TTAM Research Institute12
June 2025	28 attorneys general sue to stop a sale without customers’ consent; the company tells Congress of 1.9 million deletion requests115
Late June 2025	After bidding reopens, Judge Brian Walsh approves TTAM’s $305 million bid12
July 2025	North Carolina announces privacy safeguards; Utah says it won’t appeal1314

The company had more than 15 million customers, and about 80% had agreed to let their data be used for research, the company said¹².

North Carolina’s attorney general described the commitments TTAM made¹³. In plain terms:

• It won’t sell or hand customers’ genetic data to any for-profit company.
• Insurers get nothing unless you expressly say yes.
• You hear before the transfer happens, along with a reminder that deleting is an option.
• You can still erase your data after the sale.
• A new privacy chief and consumer advisory board are added, and independent reviewers check data security every year.
• Customers get free identity-theft monitoring for two years.

Utah said regulators would have a way to verify deletions of accounts, data and samples¹⁴. TTAM’s bid would also pay claims from people affected by the 2023 breach, Utah’s office said¹⁴.

Not every state was satisfied. California’s attorney general said the sale didn’t meet his state’s genetic privacy law, which requires opt-in consent before genetic data is sold¹⁵.

Notice what protected customers here. It wasn’t a federal genetic privacy law. It was a patchwork of state laws, lawsuits and promises a buyer made to settle them.

Your DNA isn’t only yours

Your genetic results can affect relatives who share your DNA, MedlinePlus notes¹⁰. A finding about you is partly a finding about your parents, siblings and children.

MedlinePlus lists other risks too. A company can be compelled to share what it holds with law enforcement. And a sale, shutdown or bankruptcy can send your data to a new owner, as 23andMe customers learned¹⁰. You can’t reset your genome the way you reset a password.

For a broader routine on app permissions, ad tracking and deletion requests, see our guide to locking down health apps.

Knowing your genes without handing them your future

Many people who value natural health care about prevention and self-knowledge. A genetic report can feel like the ultimate inside view. It is one input, not a verdict.

Consumer tests capture only the genetic part of conditions that lifestyle and environment also shape¹⁰. The FDA says even a positive result doesn’t mean you’ll develop the condition². Food, movement, sleep and screening still matter.

Autonomy matters too. Deciding who holds your genetic code, and for how long, is a health choice in its own right. It’s also a choice your relatives live with.

A before-and-after routine for DNA tests

Before you spit

1. Name your goal. Ancestry, fun traits and health risks are different products. For a serious health question or a family history of cancer, start with a clinician or genetic counselor³¹¹.
2. Check which reports the FDA has authorized. Ancestry and wellness results haven’t been reviewed².
3. Read the fine print on a sale or shutdown. Find out what happens to your data and sample if the company changes hands¹⁰.
4. Choose research consent on purpose. It’s a separate decision from buying the test¹².
5. Plan for your sample. Know how to have it destroyed and your account deleted¹⁴.
6. Think about your family. Your results describe them too¹⁰.
7. Time it around insurance. GINA doesn’t cover life, disability or long-term care coverage⁹.

After a worrying result

1. Don’t change medicines or plan surgery based on it. The FDA says these decisions need confirmatory testing and genetic counseling²³.
2. Ask your clinician for a clinical-grade confirmation test¹⁰.
3. Find a genetic counselor. The National Society of Genetic Counselors runs a directory you can search by ZIP code or specialty. Your insurer can also list counselors in your plan¹¹.
4. Keep up recommended screenings, even after a clean result².
5. Confirm before you tell relatives, so a false alarm doesn’t spread through the family⁸.

What the evidence says about common beliefs

Belief	What the record shows	Evidence level
“FDA-authorized reports correctly find the variants they test.”	FDA reviewed them; 23andMe reports more than 99% accuracy for tested variants24	Strong evidence, for those variants only
“A clean BRCA kit result means no inherited cancer risk.”	FDA: covers 3 of 1,000+ variants. Data from a competitor, Invitae: misses most carriers without Ashkenazi ancestry345	Evidence says no
“Raw-data uploads give reliable health warnings.”	40% of flagged variants unconfirmed in a small study78	Evidence says no
“A drug-gene report tells me which medicine to take.”	FDA says it doesn’t predict response to a specific drug2	Not enough evidence for changing treatment on your own
“GINA keeps my DNA away from all insurers.”	Life, disability and long-term care insurance aren’t covered9	Evidence says no
“My genes decide my health.”	Many conditions tested are also shaped by lifestyle and environment10	Evidence says no

Questions readers ask

The bottom line

A consumer DNA kit can accurately read the specific variants it targets, and a few of its health reports have passed FDA review. But a clean result can miss most dangerous BRCA variants, raw-data interpretations raise false alarms, and federal law leaves big insurance gaps.

The 23andMe sale showed that a genetic database is a company asset that can change hands. Test with a clear goal, confirm anything serious through a clinician and a genetic counselor, and decide in advance where your DNA should end up.

Keep exploring: gut microbiome test, biological age test accuracy, AI health information and red light therapy evidence.

Related reading

• Health apps share more than you think, and you can lock yours down
• What protects your data when HIPAA doesn’t cover most health apps
• What a medical test can and cannot tell you
• When the company reading your labs also sells the fix
• Same stool, different verdicts: what home gut microbiome tests can tell you

Sources

1. Bank Info Security. “Sale of 23andMe: On the Hot Seat of Congress, States.” Information Security Media Group, 2025. bankinfosecurity.net
2. U.S. Food and Drug Administration. “Direct-to-Consumer Tests.” FDA, 2019. fda.gov
3. Bio-IT World. “FDA Authorizes 23andMe BRCA Consumer Test.” Bio-IT World, 2018. bio-itworld.com
4. Fierce Healthcare. “23andMe competitor claims direct-to-consumer cancer risk screening produces ‘false negatives’.” Fierce Healthcare, 2019. fiercehealthcare.com
5. MedTech Dive. “23andMe rival warns consumer test approach misses 90% of cancer variants.” MedTech Dive, 2023. medtechdive.com
6. 23andMe. “23andMe Granted New FDA Clearance to Report Additional BRCA Variants.” Company press release via TipRanks, 2023. tipranks.com
7. Technology Networks. “Up to 40% of At-Home Gene Tests are Inaccurate,” reporting Tandy-Connor S, et al., Genetics in Medicine, 2018. technologynetworks.com
8. Clinical OMICs. “Ambry Genetics Researchers Find False Positives in 40% of DTC Raw Data.” Clinical OMICs, 2018. clinicalomics.com
9. National Human Genome Research Institute. “Genetic Discrimination.” NIH, 2022. genome.gov
10. MedlinePlus Genetics. “What are the benefits and risks of direct-to-consumer genetic testing?” National Library of Medicine, 2026. medlineplus.gov
11. MedlinePlus Genetics. “How can I find a genetics professional in my area?” National Library of Medicine, 2021. medlineplus.gov
12. NPR, via KPBS. “Judge OKs sale of 23andMe — and its trove of DNA data — to a nonprofit led by its founder.” KPBS, 2025. kpbs.org
13. WECT. “Attorney General Jeff Jackson secures genetic data of North Carolinians following 23andMe lawsuit.” WECT, 2025. wect.com
14. Utah News Dispatch. “Utah AG issues consumer advisory for 23andMe customers.” News in Brief, Utah News Dispatch, 2025. utahnewsdispatch.com
15. Hagen J. “Judge approves 23andMe sale amid privacy dispute.” MobiHealthNews, 2025. mobihealthnews.com