Is It Safe to Upload Your Raw DNA Data? A Checklist for Third-Party Sites

It depends on three things: how long the site keeps your file, which law applies where the server sits, and whether the site needs the upload at all. A raw DNA file cannot be rotated like a password, and your relatives share most of it. Upload only when no on-device tool does the job, and only after the seven checks below.

What can go wrong#

Eight years of incidents show what can happen to an uploaded file. Every link in this section was checked on 14 October 2026.

Law enforcement: GEDmatch, 2018

In April 2018, police identified the Golden State Killer suspect by uploading crime-scene DNA to GEDmatch, a genealogy matching site, and working through the relatives it returned. In May 2019 the site made law-enforcement matching opt-in; in December 2019 it was sold to Verogen, a forensic sequencing company, which Qiagen acquired in 2023 (Wikipedia, GEDmatch). Rules and owners change after you upload.

Extraction by other users: the GEDmatch study, 2020

University of Washington researchers showed that uploading a few specially built files to GEDmatch and running ordinary relative-matching queries could extract 92% of another user's markers with 98% accuracy, including hundreds of health-related ones (Ney, Ceze and Kohno, NDSS 2020).

The 23andMe breach, 2023

23andMe's servers were not broken into. Attackers reused passwords leaked from other sites to log into about 14,000 accounts, then used the DNA Relatives and Family Tree features to read the profiles of about 6.9 million people (TechCrunch, 4 December 2023). On 17 June 2025 the UK Information Commissioner fined the company £2.31 million, citing no mandatory multi-factor authentication and a theft report dismissed as a hoax in August 2023; 155,592 UK residents were affected (ICO).

The bankruptcy sale, 2025

23andMe filed for Chapter 11 on 23 March 2025. Regeneron bid $256 million; TTAM Research Institute, a nonprofit founded by Anne Wojcicki, outbid it at $305 million. The court approved the sale on 27 June 2025 and it closed on 14 July 2025 (AP via ClickOnDetroit, 1 July 2025; Wikipedia, 23andMe). By mid-June, 1.9 million customers, around 15% of the base, had asked for their data to be deleted (TechCrunch, 14 June 2025). Our review of the 23andMe bankruptcy covers what the buyer promised.

Policies that change after you upload

In September 2023 the FTC finalised an order against 1Health.io, formerly Vitagene, alleging unencrypted genetic data in publicly accessible cloud buckets and a 2020 privacy-policy change that widened third-party sharing and was applied retroactively, without notice or consent. The company paid $75,000 (FTC, 7 September 2023). In the United States, HIPAA does not typically govern direct-to-consumer genetic testing companies, so the privacy policy is often the only contract you have (Epstein Becker Green, 2019).

Re-identification

Genotypes without a name are not anonymous. In 2013, Gymrek and colleagues recovered research participants' surnames from Y-chromosome markers and public genealogy sites (Science, 2013). In 2018, Erlich and colleagues used 1.28 million consumer genomes to project that about 60% of searches for a person of European descent would return a third cousin or closer, enough to identify them with a few demographic details (Science, 9 November 2018).

The seven-point checklist#

Ask these before you pick a file in any upload dialog. If the site's own pages cannot answer one, treat the answer as no.

1. Does it need the upload at all? A few rsIDs can be looked up by hand on SNPedia or dbSNP. Several tools parse the whole file inside the browser tab (table below). If an on-device option exists for the job, the upload is a cost with no benefit.

2. How long is the file kept? Promethease states that files and reports are deleted immediately after delivery and that all previously stored files were permanently deleted on 8 April 2025 when it stopped offering storage (Promethease privacy policy, checked 14 October 2026). Genetic Genie states that genetic data is deleted immediately after processing and generated files within 24 hours; its policy was last modified on 27 November 2019 (Genetic Genie privacy policy, checked 14 October 2026). Look for a number, not an adjective, and ask why a policy has not been touched in years.

3. Can you delete it, and what does deletion cover? Deletion should include backups, logs and any research dataset the file was copied into, and the policy should say so. 23andMe handled 1.9 million deletion requests in under three months.

4. Which jurisdiction? Where the server sits decides which law protects you. In the EU, genetic data is a special category under Article 9 GDPR, processed only under an exception such as explicit consent. Switzerland's revised data protection act, in force since 1 September 2023, lists genetic data as sensitive personal data (DLA Piper, checked 14 October 2026). In the United States, HIPAA does not typically apply and the FTC acts case by case. None of this is legal advice; check how the rules apply to you.

5. How does the site make money? A one-time fee is easy to understand. No visible funding, a subscription built around keeping your file, or a database as the main asset all create reasons to hold on to data. Read the sharing, research and change-of-ownership clauses; 1Health.io shows they can be rewritten after you upload.

6. Breach history and basic security. Search the company name together with "breach", "ICO" and "FTC". Check whether multi-factor authentication is mandatory rather than optional; its absence was one of the ICO's findings against 23andMe.

7. Can you verify any of it? Policies are promises. Three things can be checked: what your browser actually sends, whether the tool keeps working with the network off, and whether the source code is public.

Tools that never upload#

These read your file on your device. We build one of them, so treat our row as a description, not a verdict, and run the DevTools check on all five.

Prices and quotes were checked on each site on 14 October 2026 (Allelix on PyPI, analyze.allelix.io). Genetic Lifehacks explains what to do with a result better than our tables do, GenomeInsight covers drug-gene interactions, and Allelix and snp-browser publish their source. What we add is price and scope: 23,220 genome-wide significant associations across 1,114 conditions and traits in one $5 PDF, with a method you can read.

How to verify with DevTools#

Every row in that table can be checked in thirty seconds, following our security page:

1. Open the tool and select your raw DNA file; do not start yet.
2. Open your browser's developer tools (F12, or Cmd-Option-I on a Mac) and switch to the Network tab.
3. Start the analysis and watch the list of requests.
4. Look for any request the size of your file, tens of megabytes, leaving the page. On our account page you will see the generator module download once and two small requests that reserve and complete a credit; their bodies contain the report type only.

An upload the size of your file means your DNA has left your device, whatever the home page says. For tools without an account, a second test is to load the page, go offline and run the analysis again; a local parser keeps working. For what our servers do and do not see, read how we protect your DNA.

FAQ#

Is it safe to upload raw DNA data to a third-party site?

Only after checking retention, deletion, jurisdiction, business model and breach history, and only if no on-device tool does the job. The file identifies you and your relatives for life, and the GEDmatch searches, the 23andMe breach and the 2025 sale all surprised the people they affected.

Can a raw DNA file be traced back to me without my name?

Often, yes. A 2018 study using 1.28 million consumer genomes projected that about 60% of searches for a person of European descent would find a third cousin or closer; a few demographic details then narrow the match to one person. Earlier work recovered surnames from Y-chromosome markers alone.

If I delete my data at the testing company, is it gone everywhere?

Deletion at your provider removes its copy, subject to its policy on backups and research datasets. It does nothing for copies you uploaded elsewhere; each site needs its own request. Our guide to downloading, then deleting, your 23andMe data covers the provider side.

Is it safe to upload to Promethease?

Promethease states that uploaded files and reports are deleted immediately after delivery, that it no longer offers storage, and that data is processed in the United States under MyHeritage ownership (checked 14 October 2026). It is still an upload, so the checklist applies in full; our Promethease review has the details.

What should I do with my raw DNA file if I decide not to upload it?

Store it encrypted in two places, then use tools that read it on your device: a health or nutrition report generated in your browser, a gene-by-gene lookup, or an open-source pipeline. Our article on what to do with raw DNA data sorts the options by goal, and the download guide covers getting the file.