23andMe sells detailed genetic profiles, but many users wonder who really controls that information. Does 23andme own your dna, or do you retain personal data rights over your genetic material?
Understanding the legal and policy landscape around genetic ownership helps users make informed decisions. The following sections outline how DNA data is handled, stored, and shared, with clear comparisons and practical guidance.
| Ownership Aspect | What 23andMe Controls | What You Retain | Key Limitation |
|---|---|---|---|
| Raw Data File | Encrypted server storage and backup | Downloadable copy of your raw data | You can delete the account and request data removal |
| Health Reports | Algorithm-derived risk insights and research updates | Personalized results within your account | Reports may change as science evolves |
| Research Participation | Aggregated, de-identified datasets for studies | Your consent choices and profile data | You can opt out of specific studies at any time |
| Data Sharing with Third Parties | Anonymized or aggregated data for partnerships | Ability to review and limit certain sharing options | Re-identification risks increase with broad sharing |
| Legal Jurisdiction | Compliance with US and local regulations | Your rights under laws like GDPR and CCPA | Policy changes may affect data usage over time |
How Your DNA Is Stored and Secured
23andMe uses advanced encryption and strict access controls to protect your genetic data behind corporate systems. You retain a downloadable copy of your raw data file, and you can request account deletion or data removal at any time. However, research and aggregate datasets may still retain traces of your information after deletion requests, depending on legal and scientific safeguards.
Genetic Data Usage in Research
Participation Is Optional
When you opt in to research, your de-identified data supports studies on health, ancestry, and traits. You can later change your preference and withdraw specific data elements without closing your account.
Third-Party Collaboration Limits
Partners may receive aggregated trends, but identifiers are typically stripped. You can review data-sharing categories in settings and adjust preferences to limit broader commercial reuse of your profile.
Your Rights Under Privacy Laws
Regulations such as the GDPR in Europe and the CCPA in California give you rights to access, correct, and delete genetic information. 23andMe must respond to formal requests within defined timeframes, though certain research datasets may be exempt from complete erasure. Understanding jurisdiction-specific rules helps you assert ownership and control more effectively.
Protecting Your Genetic Privacy
- Download a copy of your raw data file on a regular basis.
- Review and limit data-sharing options in account settings.
- Opt out of specific research studies when you no longer wish to participate.
- Understand regional privacy laws and submit official requests for data control.
- Monitor policy updates from 23andMe to adjust your preferences accordingly.
FAQ
Reader questions
Can 23andMe sell my raw DNA data to advertisers?
23andMe states it does not sell raw DNA data to advertisers, though it may share de-identified or aggregated data for research and partnerships. You can adjust sharing preferences in account settings to limit certain uses.
Who legally owns the results generated from my DNA?
You own the right to access and control your results, while 23andMe retains ownership of the underlying analysis and reports. You can download your data and delete your account, but some research datasets may remain partially retained for scientific continuity.
What happens to my data if 23andMe is acquired or changes ownership?
A change in company ownership could affect data policies, so it is important to review updated terms and privacy notices. You can exercise your rights to export or delete data during such transitions, depending on applicable regulations.
How long does my genetic information remain on 23andMe servers after deletion?
Account deletion typically removes your direct profile, but backups and research datasets may persist for defined periods due to technical and legal constraints. Contacting support and following formal procedures helps ensure maximum data removal under their retention policies.