You Can Take It Back: A Case for Genetic Data Rights in the Consumer Testing Era

Tens of millions of Americans have swabbed their cheeks, sealed a tube, and dropped it in the mail. In exchange, they received an ancestry breakdown, a set of health predictions, or a list of DNA relatives. What most of them did not receive was a clear understanding of what they had just given away — or how difficult it would be to take it back.

Genetic data occupies a strange category in American law. It is permanent, unchangeable, and inherently shared: your genome implicates your parents, your siblings, your children, none of whom consented to its collection. Yet it is largely governed by the same consumer terms of service that regulate a streaming subscription. That mismatch deserves scrutiny, and it deserves a remedy.

The Protections That Exist — and Where They End

The Genetic Information Nondiscrimination Act of 2008, or GINA, was a genuine milestone. It prohibits employers from using genetic information in hiring decisions and bars health insurers from denying coverage based on genetic risk. But GINA's gaps are significant. It says nothing about life insurance, disability insurance, or long-term care insurance — products where a genetic predisposition to Huntington's disease or early-onset Alzheimer's is precisely the kind of information an actuary would want. Americans routinely decline clinically valuable testing because they fear these consequences, a phenomenon genetic counselors encounter regularly.

GINA also does not govern privacy in any comprehensive sense. It does not control what a consumer genomics company may do with your data, whom it may sell to, or how long it may keep it.

The Record So Far

The concerns are not hypothetical. The sector's privacy record includes documented breaches: Ancestry disclosed a data breach affecting thousands of users in 2020, and security researchers have repeatedly raised questions about how genetic databases could be exploited. More sobering still is law enforcement access. The Golden State Killer case in 2018 demonstrated that investigators can identify suspects by uploading crime-scene DNA to public genealogy databases and matching against distant relatives. The technique is powerful and has solved cold cases — but it also means that a consumer who uploaded their DNA for genealogical curiosity effectively volunteered their extended family to genetic surveillance without anyone's knowledge.

In 2025, the 23andMe bankruptcy filing prompted a wave of concern from regulators and privacy advocates about what would happen to the genetic data of 15 million customers in a corporate sale. Few consumers had read the terms that governed that possibility.

A Genetic Bill of Rights

What would a reasonable framework look like? Several principles seem minimal:

• Portability. Consumers should be able to download their raw genetic data in standard formats and move it between providers freely — the data belongs to the person it came from.
• Deletion. A clear, enforceable right to have genetic samples and derived data destroyed, with the burden of proof on the company, not the consumer.
• Layered consent. Separate, explicit opt-ins for research use, data sharing with third parties, and law enforcement matching — never bundled into a single terms-of-service checkbox.
• Family notice. Because genetic data implicates relatives, companies should be required to disclose in plain language that a single test can expose information about people who never consented.
• Extension of GINA. Federal protection against genetic discrimination should cover life, disability, and long-term care insurance.

Some of these principles already appear in state laws and in the EU's General Data Protection Regulation, which classifies genetic data as a special category requiring heightened protection. The United States has no federal equivalent.

A Public Trust, Not Just a Private Choice

The instinct to frame this as a consumer-protection issue is understandable but incomplete. Your genome is not yours alone, and the choices of a few million early adopters now shape the privacy landscape for everyone related to them. Genetic data, once in circulation, cannot be recalled the way a credit card number can. That permanence makes it closer to a public trust than a commercial asset.

A well-informed public can still choose to share their DNA — for research, for genealogy, for medical breakthroughs that genomics genuinely enables. The point is not to stop the science. It is to ensure that the choice is informed, revocable, and respected. Americans would not accept a bank that could not guarantee the return of a deposit. They should not accept less for the one form of data that can never be reissued.