How to Delete Your DNA Data From a Testing Company

Deleting genetic data from direct-to-consumer DNA testing companies: Rights, realities, and practical paths

Direct-to-consumer genetic testing makes exploring ancestry and health traits easy, but deleting your DNA data is far harder than sending back the kit.

Evidence from company policies and legal frameworks shows that while users can usually delete their accounts and request sample destruction, genetic data often persists in research datasets and laboratory records. This means that deletion is often partial rather than absolute.

At the same time, privacy laws like California's Genetic Information Privacy Act and the European Union's data protection rules recognize genetic information as uniquely sensitive. These frameworks grant individuals stronger rights to request erasure and control how their DNA contributes to research.

Navigating this landscape requires a technical understanding of how companies handle data and a broader appreciation of how genetic information interacts with family history. Privacy-first platforms like MyHeirloom offer an alternative, allowing people to preserve their stories without surrendering control over raw DNA files.

Introduction: The promise and problem of direct-to-consumer genetic testing

Direct-to-consumer genetic testing has become a mainstream commercial phenomenon, inviting millions of people to explore ancestry breakdowns and receive health reports. Companies such as 23andMe, AncestryDNA, MyHeritage, Living DNA, and Nebula Genomics built business models on direct interaction with the human genome.

Ancestry platforms positioned genetic testing as an extension of traditional genealogy, promising richer family trees and the ability to find genetic matches. Health-oriented services framed their offerings as informational tools rather than diagnostic instruments, creating a hybrid domain between personal curiosity and family research.

However, the same features that make this ecosystem attractive create significant privacy and autonomy challenges when users decide they no longer want their DNA stored in corporate databases. Journalistic investigations have highlighted how difficult it can be to truly erase genetic information once it has been processed and stored.

Detailed analyses show that despite front-end deletion options, underlying genetic data often remains in labs or research datasets as a matter of regulatory compliance. This leads to the observation that deletion often hides genetic information from the user rather than removing it completely from institutional memory.

Regulators have begun to recognize genetic data as a category of personal information that demands elevated protection. Under the European Union's General Data Protection Regulation (GDPR), genetic data is designated as special category data requiring strict safeguards.

California’s Consumer Privacy Act and Genetic Information Privacy Act go further by imposing specific obligations on testing companies. These laws require companies to provide clear mechanisms for account deletion, data erasure, and sample destruction, giving users enforceable statutory rights.

Understanding how to delete DNA data involves recognizing the different layers of information, including raw genotyping files, interpreted reports, biological samples, and research datasets. It also requires a realistic expectation of what deletion can achieve given legal and scientific constraints.

For individuals concerned with long-term privacy, this landscape highlights the value of alternative patterns for preserving family history. Privacy-first platforms like MyHeirloom offer a secure Legacy Room where users can preserve memories through Keepsakes and build a Family Tree without surrendering raw DNA files.

The nature of genetic data and why deletion is intrinsically difficult

Genetic data occupies a unique position among forms of personal information. From a technical standpoint, a typical test generates a raw genotype file representing hundreds of thousands of genetic markers, which can be stored indefinitely in digital form and reinterpreted over time.

Because DNA encodes stable hereditary information, the raw data not only describes the individual who provided the sample but also reveals details about biological relatives. This highlights the inherently relational nature of genetic privacy, where one person's decision affects their entire family.

Legally, genetic data is recognized as especially sensitive and requires elevated protections. The UK’s Information Commissioner’s Office and the GDPR treat genetic traits as special category data due to the significant risk of harm if the information is misused.

California’s privacy laws similarly treat genetic data as sensitive biometric information used to establish individual identity. This classification grants consumers explicit deletion rights and requires businesses to handle genetic profiles with increased care.

The difficulty of deletion arises from how these data are processed and shared. Once a raw genotype file is created, companies generate derivative datasets, including ancestry compositions, DNA match tables, and pseudonymized research datasets.

Removing one person's genetic contribution from a massive database may require recalculating match lists or reindexing complex networks. This is why privacy laws often carve out exceptions allowing companies to retain data used in active, peer-reviewed scientific research.

Company privacy policies reflect these regulatory and scientific realities. For instance, 23andMe notes that while it initiates account deletion within thirty days, it must retain genetic information, date of birth, and sex to comply with laboratory regulations and legal audit requirements.

Similarly, Nebula Genomics destroys personal account data upon request but may maintain backup copies for disaster recovery or regulatory compliance. These caveats demonstrate that while front-end deletion is honored, backend archives often persist.

Furthermore, genetic data often travels beyond the original testing company when users download raw files and upload them to third-party interpretation services. Each upload creates a new copy of the data governed by a different, and sometimes less transparent, privacy policy.

To minimize their genetic footprint, users must track and manage all subsequent uploads, which requires meticulous record-keeping. Ultimately, total deletion remains difficult to achieve, making secure alternatives for family legacy highly practical.

CCPA and CPRA deletion rights and exceptions

California’s Consumer Privacy Act (CCPA) established a baseline right for consumers to request the deletion of personal information collected by businesses. However, the law lists several circumstances where a business need not comply, such as complying with legal obligations or conducting public research.

The California Privacy Rights Act (CPRA) expanded these protections, requiring businesses to notify service providers and third parties to delete the information as well. The law's definition of biometric information explicitly includes DNA, treating genetic data as highly sensitive.

Academic analysis highlights that consumer erasure requests remain subject to the law's research exception. When deletion would seriously impair public or peer-reviewed scientific studies, companies can retain the data if the user previously provided informed consent.

California's Genetic Information Privacy Act

Recognizing that generic privacy laws do not fully address genetic risks, California enacted the Genetic Information Privacy Act (GIPA). This law imposes targeted obligations on testing companies, requiring separate express consent for the collection, use, and disclosure of genetic data.

Under GIPA, companies must offer clear and prominent mechanisms for consumers to delete accounts, erase data, and request the destruction of biological samples. The law also requires companies to destroy biological samples within thirty days of consent revocation.

The California Attorney General’s office has emphasized these rights in public consumer alerts. Regulators outline step-by-step instructions for users to permanently delete their data and destroy physical samples, signaling strict regulatory expectations for compliance.

EU and UK GDPR special category data and erasure

In the European Union and the United Kingdom, the General Data Protection Regulation (GDPR) treats genetic data as special category data. Processing this information requires both a lawful basis under Article 6 and a specific condition under Article 9, such as explicit consent.

The GDPR grants individuals the right to erasure, allowing them to request the deletion of personal data when consent is withdrawn. However, similar to California law, exceptions exist for scientific or historical research where erasure would seriously impair the study's objectives.

Company privacy policies and contractual structures

Beyond statutory frameworks, the practical implementation of deletion rights depends on company privacy policies. For example, MyHeritage states that users can permanently delete their data, including family trees and DNA results, and request the destruction of submitted physical samples.

Similarly, Nebula Genomics' automatic processes destroy personal information upon account closure, though court orders or backup cycles may delay total elimination. Ancestry also emphasizes user control, allowing customers to delete DNA results permanently while preserving non-genetic genealogical data.

These private contracts shape the practical boundaries of user control. They grant direct authority over visible data while reserving backend retention for legal and scientific compliance, making it essential for users to understand these limits.

23andMe: Account deletion, sample destruction, and research consent

Deleting data from 23andMe involves several components: downloading personal records, deleting account-level data, destroying stored samples, and managing research consent. Users can initiate this process through the account settings panel under the data section.

Before requesting deletion, it is highly recommended to download raw genotype files and report summaries, as this information cannot be recovered once deleted. Once the user confirms the deletion request via email, account access is immediately revoked.

While the deletion process begins immediately, 23andMe retains limited genetic information, sex, and date of birth in its backend systems to comply with federal laboratory regulations. Biological samples can be destroyed by adjusting preferences in the biobanking section of the account settings.

Withdrawing research consent prevents your data from being used in future studies, but it does not remove information already integrated into ongoing projects. This forward-looking restriction is standard across the direct-to-consumer genetic testing industry.

AncestryDNA: Removing results, destroying samples, and closing accounts

AncestryDNA allows users to delete genetic test results while preserving traditional family trees and historical records. To do this, users can navigate to DNA settings and select the option to delete results and revoke consent.

This action permanently removes ethnicity estimates and takes the user off all DNA match lists, preventing other matches from seeing their profile. However, destroying the physical saliva sample stored at the laboratory requires contacting customer service directly.

For complete removal, users can delete their entire Ancestry account, which triggers sample destruction and deletes all family trees. Full database propagation and system-level deletion can take up to thirty days to complete across all backup networks.

MyHeritage DNA: Deleting kits, matches, accounts, and samples

MyHeritage users can manage their genetic footprint by deleting individual DNA kits through the manage kits page. This action permanently deletes raw DNA files, ethnicity estimates, and matches, and the process is completely irreversible.

Users who want to stop matching without deleting their underlying data can simply disable DNA matching in their privacy settings. To request physical sample destruction, users must contact the privacy team directly via email.

Account-level deletion is also available, which removes all family sites, trees, and health data along with DNA records. For users who wish to keep their genealogical research, deleting only the DNA kits is the recommended approach.

Living DNA, Nebula Genomics, and other providers

Living DNA supports profile-level deletion, allowing users to remove a single set of DNA results, match lists, and residual physical samples while keeping their main account active. This profile-level control prevents accidental loss of other managed profiles.

Nebula Genomics links account closure to the automatic destruction of all associated genetic records, subject to standard regulatory backups. Smaller third-party interpretation services vary widely, and users should exercise caution before uploading raw files to these platforms.

Third-party upload services and raw DNA data reuse

Third-party analysis tools have grown in popularity, accepting raw genotype files from major testing companies to provide additional health or ancestry insights. However, these services often store files indefinitely and may have less transparent privacy policies.

Privacy guides recommend maintaining an informal custody log to track where raw DNA files have been uploaded. Users should verify deletion and model-training terms before committing genetic files to any secondary platform.

The limits of deletion: Persistence in research, regulation, and backups

Despite front-end deletion options, genetic data often persists beyond the point of pressing delete. Once information is integrated into active research projects or shared with third-party scientific partners, it generally cannot be recalled.

Federal and state regulations on laboratory quality control require companies to retain specific records and validation materials for audit purposes. This means that deletion often hides genetic data from the consumer while it remains in institutional archives.

Furthermore, backup and disaster recovery systems keep copies of databases to ensure operational security. While these systems do not use the data for active processing, the records remain in cold storage for a fixed period before being overwritten.

Preparing for deletion: Inventory, backup, and reflection

Before initiating a deletion request, users should take inventory of all services they have used. It is highly beneficial to download raw DNA files and export family trees using official export tools first, storing them on encrypted devices.

Preserving original filenames and metadata helps keep the source data organized for future reference or health interpretation. A simple custody log can record the provider, download date, and any third-party services that received copies.

Reflection is also key to determining your long-term goals. Users can choose to minimize their digital genetic footprint while preserving the narrative and historical aspects of their family tree.

Privacy-first platforms like MyHeirloom provide a secure space to organize family stories, build trees, and store records without needing raw DNA files. Using Weaver, MyHeirloom's storytelling guide, users can capture the personal meaning of their heritage safely.

Submitting deletion requests and confirming outcomes

Once users have secured desired copies and clarified their goals, they can proceed to deletion. For 23andMe, this involves confirming the permanent deletion option via email and adjusting sample preferences to destroy physical biobanked saliva.

At Ancestry, users can delete DNA test results through settings and contact member services to verify that their physical sample is destroyed. For MyHeritage, users can delete individual kits or close the entire account, following up via email to confirm sample destruction.

Living DNA and Nebula Genomics offer structured portal options or legal support pathways for deletion. For third-party platforms, users should contact support directly and invoke privacy regulations like CCPA or GDPR where applicable.

Managing raw DNA and third-party uploads after deletion

After deleting data from corporate servers, users must manage their personal copies. Keeping an encrypted backup on a personal device allows future access to genetic traits or health markers without relying on corporate cloud databases.

MyHeirloom’s DocuVault provides a highly secure space for storing sensitive files, such as physician letters or summaries of genetic findings, under user-controlled access. This allows users to preserve critical health history without storing raw, massive genotyping files.

Users can also translate key ancestry discoveries into narrative Keepsakes within MyHeirloom's Legacy Room. This preserves the meaningful outcomes of genetic testing for future generations while successfully minimizing digital genetic exposure.

Ethical and social dimensions: Autonomy, family, and legacy

Deleting DNA data raises deeper questions about consumer autonomy and family privacy. Because DNA is inherently shared, one person's decision to test or delete their data directly impacts their biological relatives.

This relational quality complicates individual control, as genetic discoveries can reveal unexpected connections that affect the entire family. Deleting a profile can restore personal privacy but may also close pathways for family reconciliation.

Furthermore, the ethical dimension of scientific research remains important. While contributing to medical discoveries is altruistic, users must balance this with their personal privacy concerns, knowing that research data is difficult to recall.

Many aspects of a family's legacy—traditions, values, recipes, and life stories—are narrative rather than genetic. Platforms like MyHeirloom focus on preserving these meaningful narratives in a secure, private space.

In MyHeirloom's Family Tree and My Tribe, users can represent both genetic and non-genetic relationships, including adoptive and step-families. This emphasizes that family identity and shared history are much deeper than DNA codes alone.

Implications for digital legacy and personal archiving

The challenges of genetic privacy highlight broader issues in digital legacy and personal archiving. Uncurated digital collections, including raw genomic files and ancestry screenshots, are easily lost or misinterpreted over generations.

Meaningful personal archiving requires structure, context, and intentionality rather than simple cloud storage. MyHeirloom addresses this need by providing a secure Legacy Room to organize life stories, media, and records.

Keepsakes function as interactive scrapbook entries that allow users to connect photos, text, and videos with explanations. This contextual storytelling helps future generations understand the true significance behind family records.

DocuVault can securely hold sensitive information like medical summaries, remaining private during your lifetime and passing to a designated Trustee later. This ensures secure, timed transition of vital family insights without relying on commercial DNA databases.

MyHeirloom also supports Patron Accounts and multi-generational legacy planning, enabling users to manage separate rooms for children or deceased relatives. This architecture ensures that legacy remains organized and highly private.

Case studies and scenarios: Deletion in practice

Consider a California resident who used 23andMe and now feels uncomfortable with ongoing storage. She downloads her raw data, encrypts it on a personal hard drive, and logs the details in a private custody log.

She then permanently deletes her 23andMe account, revokes sample storage, and asserts her GIPA rights to ensure physical destruction. Finally, she preserves her key ancestry findings in a MyHeirloom Keepsake, carrying the story forward safely.

In another scenario, a genealogy researcher wants to keep his Ancestry family trees but delete his DNA results. He exports his tree as a GEDCOM file, deletes his DNA results online, and contacts member services to destroy his saliva sample.

He then recreates his family tree inside MyHeirloom, focusing on verified relationships and adding rich biographical context. This creates a secure, privacy-first genealogy environment completely independent of corporate DNA tracking.

A third user has uploaded her raw DNA to MyHeritage and several third-party sites. She systematically deletes her kits on MyHeritage, emails customer support to confirm sample destruction, and requests account erasure from the third-party platforms.

She documents her rediscovered cultural traditions in MyHeirloom's Family Cookbook and Keepsakes, choosing to delete her raw genotype files entirely. These scenarios show how technical deletion steps combine with narrative archiving to protect privacy.

Future directions: Regulation, technology, and best practices

The future of genetic data deletion will likely be shaped by tighter regulatory frameworks and increased enforcement of laws like GIPA and GDPR. As public awareness grows, regulators will continue to scrutinize how testing companies implement deletion.

Technological innovations, such as advanced anonymization and cryptographic erasure, may make it easier to delete data without compromising scientific studies. User dashboards might also become clearer, offering better transparency over backend systems.

For individuals, best practices will focus on restraint in uploading raw files and a conscious pivot toward narrative legacy plans. Over time, norms will treat genetic data as a temporary inquiry tool rather than a permanent digital identity.

Conclusion

Deleting DNA data from commercial platforms is a multi-layered process. While major providers offer tools to delete accounts and destroy samples, backend persistence in research and backup systems remains a reality.

Because deletion functions as significant mitigation rather than total erasure, users must plan their digital footprint carefully. Successful management requires methodical preparation, downloading original data, and systematically submitting erasure requests.

From a legacy perspective, deleting genetic data invites a healthy reorientation from raw DNA codes to contextualized family narratives. The enduring value of family history lies in shared stories, recipes, and milestones.

MyHeirloom provides a secure, privacy-first platform to turn these discoveries into beautiful Keepsakes, family trees, and timeless cookbooks. This allows you to build an organized digital inheritance that fully respects your family's privacy.

If you want to protect your digital footprint while honoring your family's heritage, you can start today. Explore how MyHeirloom’s secure Legacy Room, keepsakes, and DocuVault can help you preserve what matters most under your terms.

Your Legacy Room, Secured for Generations

MyHeirloom gives you a dedicated Legacy Room—a private, secure space to collect photos, videos, documents, and stories.

Start now for free