Millions of people have spit in a tube or signed up for a health study. Where does that DNA actually go, who controls it afterward, and is it still yours? Here is the plain version.
Genetic testing has gone from science fiction to a holiday gift, and huge research projects now hold the DNA of millions. Somewhere in that convenience is a question most people never stop to ask when they seal the little sample tube: once your DNA is in someone else’s freezer and database, what say do you still have over it? The honest answer surprises a lot of people.
Short answer
A biobank is a large, organized store of biological samples and the genetic and health data linked to them, used for research. Once you donate, you generally keep very little legal ownership of that DNA. You consent to its use, but the sample and data are largely controlled by the biobank or company, can be shared with other researchers and businesses, and, in the case of consumer testing firms, can even change hands if the company is sold.
What a biobank actually is
A biobank is a systematic collection of biological samples, such as blood, tissue, and DNA, stored alongside detailed health, genetic, and lifestyle data about the people they came from. Researchers draw on that combination to study how genes and environment shape disease and to develop new treatments.
Some are enormous public research resources. The UK Biobank holds data on around 500,000 volunteers and is one of the largest whole-genome datasets in the world, and the United States runs a similar effort, the All of Us Research Program, aiming for more than a million participants. Consumer genetics companies like 23andMe and Ancestry are effectively private biobanks too, holding millions of samples people paid to submit.
Who owns your DNA once you give it up?
This is the uncomfortable part: in most places, you do not own it in any strong legal sense. Handing your sample to a research or clinical repository is largely a one-way transaction, and once it is deposited, you give up most of your control over what happens next.
US courts have generally ruled that people do not hold property rights in their donated genetic material, so you cannot simply demand it back as your possession. A few states, including Alaska and Florida, are exceptions that treat your DNA as your property. What you sign is usually a broad consent, allowing the sample to be used for future research you will never hear the details of, and shared with academic and commercial partners. You permit the use; you rarely own the material.
The gaps in your legal protection
The laws that are supposed to protect genetic data have real holes. The main federal shield in the US, the Genetic Information Nondiscrimination Act, bars discrimination based on your DNA only in health insurance and employment. It does not cover life insurance, disability insurance, or long-term care insurance, where genetic results can still count against you.
There is a second gap. Genetic data counts as protected health information under HIPAA only when a HIPAA-covered entity, like a hospital, holds it. Direct-to-consumer testing companies generally are not covered, as the National Human Genome Research Institute notes, which leaves consumer DNA in a weaker legal zone than the results in your doctor’s file. For related coverage, browse SciExaminer’s Health section.
When a DNA company collapses
The risks stopped being hypothetical in 2025. In March, 23andMe filed for bankruptcy, putting the genetic data of more than 15 million customers on the table as a company asset. Its own privacy policy allowed customer information to be transferred in exactly that situation, and several state attorneys general urged people to delete their data before it was too late.
After months of controversy, a judge approved the sale of the company and its DNA trove to a nonprofit led by co-founder Anne Wojcicki for around 305 million dollars, to be used for medical research. However that particular story ends, the lesson is permanent: when you give your DNA to a private company, its future rides on the company’s fate, well beyond the consent you signed.
How to protect your genetic data
You cannot fully undo a DNA donation, but you can make smarter choices about it. A few steps help.
- Read the consent and privacy terms before testing, focusing on data sharing, research use, and whether you can delete your data.
- Use deletion or opt-out options where they exist, especially with consumer testing services.
- Remember that your DNA exposes your relatives too, since they share much of it and never consented.
- Treat genetic data as permanent. If it leaks, you cannot reissue it the way you would a password or a card.
- Weigh the purpose: contributing to a public research biobank advances medicine, while a novelty ancestry test is a larger privacy trade than it looks.
Joining a well-run research program is a reasonable, even generous, choice for many people. The point is to make it a choice you understand rather than a tube you sealed without reading the label. For more science explainers, the Science section digs into the details.
This article is general information, not legal or medical advice. Genetic-privacy laws vary by country and state and are changing, so check the rules where you live or consult a qualified professional about your situation.
What to know
- A biobank stores biological samples plus linked genetic and health data for research.
- Once you donate, you generally keep little legal ownership of the sample or its data.
- US law, through GINA, only blocks genetic discrimination in health insurance and employment.
- Consumer DNA can be sold or transferred if the company changes hands, as the 23andMe bankruptcy showed.
Frequently asked questions
What is a biobank?
A biobank is an organized collection of biological samples, such as blood, tissue, and DNA, stored with linked health and genetic data. Researchers use it to study disease and develop treatments. Examples include the UK Biobank and the US All of Us program.
Do you own your DNA after giving it to a biobank?
Usually not in a strong legal sense. Courts in the US have generally found that people do not have property rights in donated genetic material. You consent to its use, but the biobank or company largely controls it, with a few state exceptions like Alaska and Florida.
Is my genetic data protected by law?
Only partly. GINA prevents genetic discrimination in health insurance and employment, but not in life, disability, or long-term care insurance. HIPAA protects genetic data held by covered entities like hospitals, but generally not data held by consumer testing companies.
What happened to 23andMe customers’ DNA data?
23andMe filed for bankruptcy in 2025, and the genetic data of more than 15 million customers became a saleable asset. After controversy and warnings from state officials, a judge approved the sale of the company and its data to a nonprofit for medical research.
Can I delete my DNA data?
Often you can request deletion from consumer testing companies, though the process and what it actually erases vary. Research biobanks usually let you withdraw, but data already shared or used in past studies may not be fully retrievable.
What this means
Biobanks are a genuine engine of modern medicine, and donating to a serious research program can do real good. The catch is that the moment your DNA leaves your hands, most of the control leaves with it, and the legal safety net has wide gaps that few people notice until something goes wrong. Read the fine print, treat your genome as permanent and shared with your whole family, and decide with open eyes. Your DNA is the one password you can never change.