DNA Test Consent: What You Actually Agree To at Signup
A walkthrough of the three layers of consent in a typical consumer DNA test: basic terms, research consent, and match opt-ins. What each one actually grants.
The consent flow at a consumer DNA company is more layered than the single “I agree” button suggests. We think of it as three layers, each toggled separately, each granting the company a different set of rights. Understanding which is which is the difference between an informed signup and an unintentional one.
Layer 1: the basic Terms of Service
The first layer is the standard contract you accept to use the service at all. You cannot opt out of this layer and still use the product. It typically includes the following:
A license for the company to process your sample, generate genotype data, and return reports.
A license for the company to retain that genotype data and biological sample (the latter usually for a defined storage period that you can later request to have ended through a separate sample-destruction request).
A grant of certain limited use rights to the company for the operation of its service, including using your genotype data internally to improve matching algorithms and reports.
Dispute resolution, governing law, and limitation-of-liability terms that typically include a binding arbitration clause in US-facing companies.
23andMe’s Terms of Service, AncestryDNA’s Terms and Conditions, and MyHeritage’s Terms of Service are the canonical examples. Each company publishes the current version on its site.
Critically, agreeing to the basic TOS does not, by itself, consent you to research participation or to matching with relatives. Those are separate.
Layer 2: research consent
The second layer is the research-sharing consent. This is a separately toggled consent that asks whether the company can use your de-identified genotype data, sometimes combined with self-reported survey data, for internal research and for sharing with academic or commercial research partners. We covered the limits of “de-identified” in de-identified genetic data explained.
23andMe’s Informed Consent Document is the most-cited example. Agreeing to it lets 23andMe include your data in studies it conducts internally and in collaborations with academic institutions and pharmaceutical companies. Anne Wojcicki’s company famously had research partnerships with GlaxoSmithKline and others under prior corporate ownership.
AncestryDNA’s Informed Consent to Research grants similar rights for research collaborations.
You can decline this layer at signup. You can also withdraw it later through account settings, though withdrawal applies prospectively: data already used in a published study cannot be retroactively pulled.
The research consent in DNA testing explained article covers what each company’s research opt-in actually includes.
Layer 3: match opt-ins
The third layer is the matching feature. 23andMe calls it DNA Relatives. AncestryDNA calls it DNA Matches. FamilyTreeDNA calls it Family Finder matching. MyHeritage just calls it matches.
Opting in to matching makes your account visible to other testers in the same database whose DNA segments overlap with yours. The match list typically shows display name (which you control), predicted relationship, and amount of shared DNA. Detail levels vary by company and by the display-name choices each user has made.
Matching is the feature that drives most of the consumer-facing magic of these products. It is also the feature most directly relevant to privacy in two distinct ways. It can surface relatives you did not know existed, including biological-parent surprises in donor-conception and adoption cases. And it was the surface through which the 2023 23andMe breach amplified from 14,000 directly-accessed accounts to about 6.9 million match-exposed users.
You can opt out at signup, or opt out later. Opting out removes your visibility to other testers and removes their visibility to you. Our family implications of DNA testing covers the relational side, and the dna-test-data-breach-history covers what the matching surface meant in the 2023 incident.
What we recommend doing at signup
We do not tell anyone which boxes to check, because the right answer depends on what you want from the test. We do recommend reading each consent screen rather than clicking through. Three quick rules of thumb.
The basic TOS is required. Read it once and keep a copy.
Research consent is optional. Take a moment to decide whether you want your data used for studies you do not see published. You can change this later.
Match opt-in is optional and reversible. If you are taking the test for ancestry interest and want relatives to find you, opt in. If you took the test for ethnicity composition only, you can leave matching off.
This article sits inside our genetic data privacy pillar. The DNA testing privacy checklist covers the full pre-purchase routine, and DNA test privacy policies compared puts each company’s policy side by side.