Is DNA Testing Safe? What Happens to Your Sample and Data

Physically, yes. A consumer DNA test asks you to spit into a tube or swab your cheek. There's no needle, no blood draw, and no meaningful physical risk. The harder question, and the one most people actually mean when they ask if DNA testing is "safe," is what happens to that spit after you mail it in: who can see the results, whether they can be used against you, and what happens if the company gets breached or subpoenaed.

That question doesn't have a one-word answer. It splits into three separate risks, and they're not equally likely or equally serious.

Is giving a saliva or cheek swab sample physically safe?

Yes. Consumer DNA tests use non-invasive collection, either a saliva sample spit into a tube or a cheek swab, and neither carries the risks associated with drawing blood or a clinical biopsy. There's no needle involved and no meaningful chance of infection or injury. This part of the process is about as physically low-risk as at-home testing gets.

The real safety conversation starts after the sample leaves your hands.

What actually happens to your genetic data after testing

Your raw DNA gets extracted, sequenced or genotyped, and turned into a digital file that a testing company stores on its servers, typically alongside an account tied to your name and email. From there, three things can happen to it: it sits in storage under the company's own security controls, it gets used or shared for research (usually only if you separately opt in), or, in rarer cases, someone outside the company, a hacker, an insurer, or law enforcement, tries to get access to it.

Reputable DNA testing companies generally use encryption and access controls to protect stored genetic data, and treat research sharing as something you opt into rather than something bundled by default. But practices vary by company, and "reputable" isn't a legal guarantee. Before testing with any provider, read that specific company's privacy policy for how long they retain your sample, whether they sell or license data to third parties, and what their process is if law enforcement comes asking. Don't assume; check.

Genomic data sharing does serve a real purpose beyond any one company's business. As researchers Luca Bonomi, Yingxiang Huang, and Lucila Ohno-Machado wrote in a 2020 review, "the sharing of genomic data holds great promise for advancing precision medicine, providing personalized treatments and other types of interventions," but they also devote the paper to cataloguing the privacy challenges that come with pooling genetic data across large databases, since genetic information is uniquely identifying and can't be reset like a password if it leaks (Bonomi et al., 2020).

Can law enforcement get access to your DNA test results?

Yes, and this has already happened at scale, most famously through genetic genealogy databases used to identify suspects in cold cases. Law enforcement has used consumer genetic genealogy data to solve serial murder cases by matching crime-scene DNA against relatives who had tested with consumer services, according to a 2019 legal review by University of Utah law professor Teneille Brown in the Columbia Science and Technology Law Review (Brown, 2019). You don't have to be a suspect, or even have tested yourself, to be identifiable this way: a distant cousin's test can put you in a genetic family tree that investigators can search.

Brown's paper is specifically about why this practice unsettles people even when it catches killers, arguing that the same database structure that solves cold cases also builds a surveillance tool nobody explicitly consented to. Whether a given testing company allows law enforcement searches of its database, and under what legal process, varies by company and by country. This is a policy question worth reading closely in a provider's terms before you test, not something to assume one way or the other.

Can a DNA test be used against you for insurance or employment?

Partially, and the coverage gaps matter. In the United States, the Genetic Information Nondiscrimination Act (GINA) restricts health insurers and employers from using genetic test results in coverage or hiring decisions. But GINA has real limits: it doesn't cover life insurance, disability insurance, or long-term care insurance, all of which can legally ask about or factor in genetic test results in many states.

A 2022 RAND Corporation analysis for the UK's Human Genetics Commission examined this from the insurer's side, noting that "if genetic test results stimulate actions to reduce health risks, they may reduce costs to insurers," while also flagging that broader access to genetic testing changes insurers' risk exposure in ways regulators are still working through (Rodriguez-Rincon et al., 2022). The practical takeaway: if you're shopping for life or disability insurance, a DNA test result sitting in a lab's database or your own file is not automatically protected the way a health insurance decision would be.

Should you worry about what a DNA testing company does with your results even if you're not a criminal suspect?

It's worth understanding rather than dismissing. A 2022 bioethics paper in the Journal of Bioethical Inquiry mapped out the ethical issues around companies paying for or acquiring consumer DNA, and one of its central points is that once genomic databases exist at scale, they create value and risk for people who never directly consented, including relatives of people who tested (Koplin, Skeggs, and Gyngell, 2022). Your decision to test can carry consequences for family members who never made that choice themselves.

Separately, Brown's 2019 review makes a point about health interpretation that goes beyond forensic use: consumer genetic results "often reflect small increases in overall lifetime risk," and using them to make health care decisions on their own is often premature (Brown, 2019). That's a caution about over-reading what a result means, separate from the question of who else can see it, but the two risks compound: the same modest, probabilistic result that shouldn't drive a medical decision on its own is the same data sitting in a database that a hacker, insurer, or investigator could eventually query.

How does this compare across risk types

Risk	How likely	What limits it
Physical harm from sample collection	Essentially none	Saliva/cheek swab only, no needles
Data breach of stored genetic data	Depends on the company's security practices	Varies by provider; check their security disclosures
Law enforcement access via genetic genealogy	Established, ongoing practice in criminal investigations	Company policy and jurisdiction-specific legal process
Health insurance or employment discrimination (US)	Restricted by law	GINA, though it excludes life, disability, and long-term care insurance
Life/disability insurance use of results	Possible in many US states	No federal law equivalent to GINA covers this

FAQ

Is it physically safe to give a DNA sample for testing? Yes. Consumer tests use a saliva sample or cheek swab, not a blood draw, so there's no needle and no meaningful physical risk.

Can police access consumer DNA test results? Genetic genealogy databases have been used by law enforcement to identify suspects in criminal cases by matching relatives, as documented in a 2019 legal review of the practice (Brown, 2019). Whether a specific company permits this, and how, depends on that company's own policy and applicable law.

Does GINA protect all uses of my genetic data? No. GINA restricts US health insurers and employers from using genetic results, but it does not cover life insurance, disability insurance, or long-term care insurance.

Can a relative's DNA test expose my genetic information? Yes, in principle. Because genetic genealogy works by matching shared DNA segments across relatives, a family member's decision to test can make you identifiable in a database even if you never tested yourself, a concern raised directly in the bioethics literature on consumer genomics (Koplin et al., 2022).

Should I read a DNA testing company's privacy policy before ordering a test? Yes. Practices on data retention, research sharing, encryption, and law enforcement requests vary by company and are not standardized across the industry, so the specific provider's policy is the only reliable source for how your particular sample and data will be handled.