Whether to delete your 23andMe data depends on your privacy concerns and how you feel about law enforcement access

23andMe stores your DNA profile and genetic health information on their servers. You can request deletion at any time through your account settings, and the company says they will remove your data within 30 days. However, deletion is not automatic — you have to initiate it yourself. The main reason people delete is concern about police access to their DNA through the database, which has happened in real criminal investigations. Other reasons include worry about data breaches, insurance discrimination, or simply not wanting a private company to hold genetic information indefinitely.

The decision is personal and depends on what matters most to you. If you have already received your results and do not plan to use the service again, deletion removes your data from their system. If you think you might want to revisit your results or share them with relatives later, keeping your account open preserves that option. There is no single right answer — it comes down to your comfort level with privacy trade-offs.

Key Takeaways

  • 23andMe will delete your DNA profile and genetic health data if you request it through your account, though the process takes up to 30 days.
  • Law enforcement can obtain your DNA information if a relative's profile matches a crime scene sample, even if your own profile is not directly connected to a case.
  • Deleting your data removes it from 23andMe's servers but does not affect any DNA information you may have already shared with relatives or uploaded elsewhere.
  • If you delete and later want your results back, you would need to order a new kit and pay for testing again.
  • 23andMe's privacy policy allows them to keep some data for business purposes even after deletion, so complete removal is not may provide.

How law enforcement can access your DNA through 23andMe

Police can search 23andMe's database through a legal process, but not by directly accessing customer accounts. Instead, they upload a DNA profile from a crime scene to genealogy databases like GEDmatch, which is a separate free service that many people use to find relatives. If your 23andMe DNA matches someone in GEDmatch, law enforcement can see that match and potentially identify you or your relatives as suspects or witnesses.

This has led to real arrests. The Golden State Killer case in 2018 was solved partly through this method — investigators found a match to a relative of the suspect through a genealogy database. Since then, police have used the same technique in hundreds of other cases. You do not have to upload your 23andMe data to GEDmatch yourself for this to happen; if a close relative has uploaded their DNA and you share enough genetic material, you can still be matched.

23andMe itself has a law enforcement request process, but the company says they require a court order or search warrant before releasing customer information. They have received requests from police and have complied with some of them. However, the GEDmatch route is often easier for law enforcement because GEDmatch's terms of service allow police searches by default.

What happens to your data if you delete your account

When you request deletion through 23andMe, the company removes your DNA profile, genetic health reports, and ancestry results from their active systems. They say the deletion is permanent and takes up to 30 days to complete. You will lose access to your results, your relative matches, and any health insights you had stored in your account.

However, 23andMe's privacy policy states that they may retain some data for legal, business, or operational reasons even after you request deletion. This means some information tied to your account — such as transaction records or anonymized data used for research — might remain in their systems. The company also notes that if you have already shared your raw DNA data with third-party services or relatives, deletion from 23andMe does not remove it from those other places.

If you change your mind after deletion, you cannot recover your original results. You would need to order a new DNA kit, provide a new saliva sample, and pay for testing again. 23andMe does not offer a way to restore deleted data.

Privacy risks of keeping your data on 23andMe

The main privacy risk is law enforcement access through genealogy databases, as described above. Even if you never upload your data to GEDmatch, a relative who does can create a match that leads back to you. This is especially true for close relatives like siblings, parents, or cousins — the closer the relation, the more likely a match will reveal your identity.

A secondary risk is data breach. 23andMe has experienced security incidents in the past. In 2023, hackers accessed some customer accounts through credential stuffing — using passwords leaked from other websites. While 23andMe says they use encryption and security measures, no company can may provide that a breach will never happen. If your genetic data were exposed in a breach, it could be sold or misused.

There is also the question of insurance and employment discrimination. Genetic information could theoretically be used against you if an insurer or employer learned about disease risk or other traits. The Genetic Information Nondiscrimination Act (GINA) prohibits health insurers and employers from using genetic information to deny coverage or employment, but the law has limits and does not cover life insurance, disability insurance, or long-term care insurance.

Reasons to keep your 23andMe data

If you found the ancestry results useful or interesting, keeping your account lets you revisit them anytime without paying again. You can also update your results if 23andMe improves their ancestry algorithms, which they do periodically. Some people use their 23andMe account to stay connected with relatives they discovered through the service.

23andMe also uses customer data for genetic research. If you care about advancing medical science, your data contributes to studies on disease, drug response, and other health topics. You can control which research projects your data is used for through your privacy settings, and you can opt out of research entirely if you prefer.

From a practical standpoint, if you have not yet received your results or are still exploring your ancestry, deletion means losing access to information you paid for. Deletion is permanent, so it is worth being certain before you request it.

How to delete your 23andMe account and data

Log into your 23andMe account on their website or app. Go to Settings, then select "Delete Account and Data" or a similar option (the exact wording may vary). 23andMe will ask you to confirm your identity, usually by entering your password or verifying through email. You will also see a warning that deletion is permanent and cannot be undone.

After you confirm, 23andMe begins the deletion process. The company says it takes up to 30 days for your data to be fully removed from their servers. During this time, you will not be able to access your account or results. You should receive a confirmation email when the deletion is complete, though some users report not receiving this confirmation.

If you have shared your raw DNA data with third-party services like Ancestry, MyHeritage, or GEDmatch, deleting your 23andMe account does not remove it from those services. You would need to delete your data from each service separately if you want it removed everywhere.

Alternatives to full deletion

If you want to reduce your privacy risk without deleting everything, you can adjust your privacy settings instead. In your 23andMe account, you can opt out of law enforcement requests, which tells 23andMe not to comply with police searches of your data. This does not prevent matches through GEDmatch if a relative has uploaded there, but it does add a layer of protection for your direct 23andMe profile.

You can also opt out of genetic research, which prevents your data from being used in studies. You can control which relatives see your profile — for example, you can hide from distant cousins while staying visible to close family. These settings give you more control without requiring you to lose access to your results entirely.

Another option is to download your raw DNA data and delete your 23andMe account, then upload the data only to services you trust more. Some people prefer smaller genealogy databases or services with stricter privacy policies. However, this still carries the risk that the new service could be breached or could change its policies.

Frequently Asked Questions

Can police access my 23andMe data without my knowledge?

23andMe requires a court order or search warrant before they release your data directly to law enforcement. However, police can access your DNA indirectly through genealogy databases like GEDmatch if a relative has uploaded their DNA there. You may not know this has happened until police contact you.

If I delete my data, will it be removed from law enforcement databases?

Deleting your 23andMe account removes your profile from 23andMe's servers, but it does not remove your DNA from genealogy databases like GEDmatch if someone else has already uploaded a match. If you want to remove your data from GEDmatch, you would need to contact that service separately.

What if a relative uploaded my DNA without my permission?

If a close relative uploaded their DNA to a genealogy database, your genetic information can still be matched even if you never created an account. Deleting your own 23andMe data would not prevent this. Your only option would be to ask the relative to delete their data or to contact the genealogy service and explain the situation.

Can I delete just my health data and keep my ancestry results?

23andMe does not offer a way to delete only part of your data. When you request deletion, the entire account — including ancestry results, health reports, and DNA profile — is removed. You cannot keep one type of information and delete another.

How long does it actually take for 23andMe to delete my data?

23andMe says deletion takes up to 30 days, but the actual timeline varies. Some users report their accounts being deleted within a few days, while others have waited the full 30 days or longer. There is no way to track the deletion process or get a specific date.