Is It Safe to Do a DNA Test in 2026?
A balanced look at the real risks and real reasons people still do DNA tests in 2026, with a decision framework for when to think twice before testing.
The honest answer is that it depends on who you are, what test you are buying, and what you want from it. We are not going to tell you it is totally safe and there is nothing to worry about, because that is not true. We are also not going to tell you to never test, because the millions of people who have already done so without incident make that advice obviously wrong. The useful answer is more specific.
What has actually changed
A few things make 2026 different from 2018, when most of the existing “is DNA testing safe” advice was written.
23andMe filed for bankruptcy in March 2025. Its genetic data and core assets were sold to TTAM Research Institute later that year. The 2023 breach affected roughly 6.9 million users. Nebula Genomics shut down its consumer service in February 2025. MyHeritage had a credential-stuffing incident in 2018 affecting around 92 million accounts (email addresses and hashed passwords, not raw DNA data). Forensic genetic genealogy went from a novelty in 2018 to a routinely used investigative technique by the mid-2020s.
None of this means DNA testing is suddenly catastrophic. It means the assumption from 2018 that you are handing data to a stable company under stable policies is no longer reliable.
The real risks, named honestly
Corporate change of hands. Companies get acquired, go bankrupt, or pivot. When that happens, your data goes with them, subject to whatever the terms of service say (usually quite a lot). The 23andMe situation is the live case.
Breach. Genetic data is unusually attractive to attackers because it cannot be changed. The 23andMe 2023 incident is the cautionary example.
Family implications. Your DNA is also partial information about your siblings, parents, children, and cousins. They did not consent to your test. This is most consequential for adoption discoveries, undisclosed paternity, and the use of relative matches by law enforcement.
Sample retention. Most companies store the physical saliva sample after analysis by default. Many people do not realize this until they try to delete their account.
Research consent breadth. The “share my data with research partners” consent screen is usually one click during signup. The downstream use can include sharing de-identified data with pharmaceutical companies.
Law enforcement access. Genealogy databases (GEDmatch, FamilyTreeDNA) allow law enforcement matching on an opt-in or opt-out basis. The major consumer-testing companies (AncestryDNA, 23andMe) require legal process (subpoena or warrant) and publish transparency reports.
The real reasons people still test
We are obligated to also state, plainly, why this is still a useful product for many people. Reconnection with biological family is meaningful, including for adoptees and donor-conceived people. Genealogy research is genuinely better with DNA evidence than without. Ancestry curiosity is a reasonable thing to be curious about. Health-aware testers can flag conditions worth discussing with a doctor or genetic counselor.
These are real benefits, and they are why over 40 million people have tested with the major consumer companies.
A decision framework
We suggest you think twice about testing if any of the following apply to you.
You have a sensitive family situation where unexpected relatives or unexpected biological parentage could cause harm. Examples include closed adoptions where parties have not chosen to be searchable, family secrets that affect living people, or relationships where genetic information could be weaponized.
You have an active immigration concern. Genetic data tied to your real identity is information you generally cannot retract once shared.
You work in a sensitive employment context where genetic information could be used against you in ways GINA does not protect (life insurance, disability insurance, long-term care insurance). See genetic data and insurance, GINA explained.
You are unwilling to read the privacy policy of the company you are buying from. The variation between companies is large enough to matter.
You would not be comfortable with the worst-case outcome (a future breach exposing the fact that you tested, plus your basic genealogy data) becoming public knowledge.
For most people without those concerns, the marginal risk of testing is manageable, especially if you take a few sensible steps.
If you decide to test
Two pieces complete this thought. Our DNA testing privacy checklist walks through the concrete settings to choose at signup and the steps to take after results arrive. Our questions to ask before DNA testing is a more reflective tool for thinking through whether testing fits your situation.
For specifics on the post-2025 landscape, see who owns your DNA after a test and can DNA test data be sold. For deletion steps if you change your mind, see how to delete your 23andMe data and how to delete your AncestryDNA data.
For questions about what test results would mean for your health, the National Society of Genetic Counselors maintains a directory at findageneticcounselor.nsgc.org.
This piece is part of our Genetic Data Privacy guide.