23andMe might be one of the more popular direct-to-consumer genetic testing companies on the internet, but it’s by no means the only one.
In the last few years, more online genetic testing companies have popped up for various purposes, from discovering ancestry information to figuring out potential health risks and even identifying whether you and your partner are “genetically compatible.” The uses may differ, but one thing remains a big concern: your privacy.
While at-home genetic tests can provide exciting and helpful information, consumer privacy may be compromised along the way.
The reason why is that these tests often ask for more personal information than necessary, including health information and data about family members. In reality, all they need is a way to contact you and connect you to the test you send them.
As a result, reading these companies’ privacy policies and using online safety procedures when registering for an online genetic test to protect your identity, location, and personal information is the best way to take the test safely.
Genetic Testing Privacy Policies
Still, we know that privacy policies can be tricky to navigate and sometimes hide information.
In fact, some of the policies we read seemed a bit vague in areas–claiming that they collect or use the genetic information for what they deem “necessary for legitimate business purposes.” One company even wrote that they could use a customer’s genetic data for research purposes or for a third party without the customer’s consent. Now, do you see why it’s imperative to read those privacy policies carefully?
If you don’t give the service your real personal information in the first place, it would be extremely difficult to link the genetic information back to you.
Some companies caution that “there can be no guarantee of privacy,” even given their encrypted information and secure systems–another reason not to share data with them.
Privacy Concerns and Privacy Laws Around Personal and DNA Data
When it comes to the use of genetic information, there are few privacy protections available.
For example, the Health Insurance Portability and Accountability Act (HIPAA) and the Genetic Information Nondiscrimination Act of 2008 (GINA) are two federal laws that deal with genetic information privacy.
However, even though HIPAA applies to the results of genetic tests administered by your healthcare provider, it does not extend to direct-to-consumer (DTC) genetic testing companies. Similarly, while GINA safeguards individuals from being discriminated against by health insurance companies and employers, it doesn’t cover other third parties or other kinds of insurance companies.
Just a handful of state laws provide better DNA data privacy. For example, in 2021, California passed the Genetic Information Privacy Act (GIPA), a genetic privacy bill. The bill establishes requirements for collecting, using, and disclosing consumer DNA data from direct-to-consumer genetic testing services.
This lack of legal protection creates a potential for a multitude of privacy risks, particularly because DNA data can’t be de-identified.
Keep Your Personal Information to Yourself
Most genetic testing companies’ privacy practices are risky to consumer privacy.
As a result, the best thing you can do when using one of these services is to provide as little real information about yourself as possible during the entire process.
The only reasons that genetic testing companies need your personal information (i.e., name, phone number, home address, email address, etc.) are to:
- Send you the testing kit
- Link your genetic test to your profile so that you can receive your test results.
As long as you provide a way for the company to contact you–through email and telephone number forwarding–you can choose not to provide your real personal information.
The only caveat here is that if you want a 100% safe experience that cannot be linked to you, you’ll have to choose a shipping address that you have access to but isn’t your actual home address. You could try a friend’s home address or even a more distant connection if they are willing to receive your package.
After you handle the shipping situation, you are all set to sign up and order the test. You’ll want to turn on a VPN or Virtual Private Network to reroute your IP address. This will make it appear that you are browsing from somewhere other than your current location–whether that is somewhere else in the United States or halfway across the world.
Next, you should make sure that you have a tracker blocker or private browsing mode on in your browser. Note that Private Browsing, Incognito, and similar modes do not guarantee your private browsing experience and do not always block ad trackers.
When asked for your personal information, you can make up a fake name to keep yourself protected. Then, use a fake email (an email that isn’t linked to you) or set up email and mobile phone number forwarding using masked email services to provide a way to contact you without giving out your real information.
At this point, you’ll be asked to enter a billing and shipping address as well as payment information. By using either a prepaid debit card or a masked credit card, you can pay for the genetic test without giving out your real credit card information. For a prepaid debit card, you should use a made-up billing address.
So far, these companies have not been able to collect any of your actual private information. Some companies may ask you to complete additional questionnaires, which they claim will give you a better report because they will have more background information. But is this necessary, or is it just another link back to your identity? Based on our experience, you can still get a lot out of the genetic test and do not need to answer these additional and often invasive personal questions.
When your test arrives, you can use the same masked personal information to link your test to your previously created profile. Don’t forget your VPN and tracker blockers! Since the postage is prepaid to send back your test, you have officially completed your portion of the procedure without giving up any of your real personal information.
By spending a few more minutes setting up privacy parameters when purchasing a DNA testing kit, you can protect your private information and prevent it from being linked to you in case of a data breach or another sticky situation.
Don’t Forget to Opt-Out of Genetic Testing Sites
Even if you don’t give a genetic testing company your personal information or take a test, they may still have personal data about you.
For example, besides DNA testing, Ancestry.com genealogy service also provides sensitive information based on public records. Therefore, personal information that can be used to impersonate you can be easily accessed through genealogy databases online. There have also been instances of DNA databases being hacked.
Luckily, you can opt out of these kinds of databases. We have a whole series of guides that walk you through opting out from genealogy sites, including:
Or, we can do it for you if you subscribe to our data broker removal service.