Is 23andMe Still Legit? Accuracy, Privacy, and Risks

23andMe remains a real, FDA-authorized genetic testing service that can tell you certain things about your DNA with reasonable accuracy, but “legit” depends on what you mean. The company’s core genotyping chip works well for the specific variants it tests, and several of its health reports have gone through FDA review. What has changed in the past couple of years is the landscape around the company: a massive data breach in 2023 exposed millions of users’ information, the company filed for bankruptcy protection in early 2025, and ongoing questions about who might end up owning your genetic data have made “Is this still a good idea?” a much more complicated question than it was in 2018.

How Accurate Is the Genotyping Itself?

23andMe uses a genotyping chip that reads specific locations in your DNA, looking for known variants rather than sequencing your entire genome. For the variants the chip is designed to detect, the raw accuracy is quite high. The technology behind SNP arrays is well established and generally reliable for the positions it covers. Where things get shaky is in what happens after the chip does its job.

A study that compared raw data from direct-to-consumer tests against clinical-grade laboratory confirmation found that about 40% of variants flagged in DTC raw data turned out to be false positives. Some variants labeled as “increased risk” by DTC platforms or third-party interpretation tools were actually common, benign variants when checked against clinical databases.¹ That number sounds alarming, and it is, but context matters. The 40% figure applies to the raw data variants, many of which are rare mutations the chip was not specifically optimized to detect. For the FDA-cleared health reports 23andMe offers (like the BRCA1/BRCA2 reports for breast cancer risk or the carrier status reports), the accuracy is considerably better because those specific variants were validated through the FDA review process.

The practical takeaway: if 23andMe’s official health report says you carry a specific variant, that finding is more trustworthy than if you download your raw data file and run it through a third-party interpretation tool. Those third-party analyses are where the false-positive problem is most severe, and any concerning result from raw data should be confirmed through a clinical lab before you make medical decisions.

Risk Scores Can Vary Between Platforms

Even when the genotyping itself is accurate, different consumer genomics companies can give you different risk estimates for the same condition. A study that compared genotype data across multiple consumer platforms found discrepancies that resulted in different APOE genotypes and different genetic risk scores for Alzheimer’s disease from the same individual’s DNA.² APOE status is one of the most significant genetic risk factors for Alzheimer’s, so getting different answers from different services is not a trivial problem.

This happens because each company uses a slightly different chip, covers slightly different variant positions, and fills in gaps using statistical imputation, which is essentially educated guessing about the variants the chip did not directly read. The downstream risk calculations then compound those differences. None of the platforms is necessarily “wrong” in a binary sense; they are each working with incomplete snapshots of your genome and making different statistical assumptions to fill in what they cannot see. But the result is that a polygenic risk score from one service should not be treated as a precise medical measurement. It is more like a rough directional indicator, and different services may point in slightly different directions.

The 2023 Data Breach and What It Revealed

In October 2023, a hacker known as “Golem” breached 23andMe through a credential stuffing attack, which means they used username-and-password combinations leaked from other websites to log into 23andMe accounts where people had reused those same credentials. The initial compromise hit about 14,000 accounts directly. But because 23andMe’s DNA Relatives feature connects users to biological relatives on the platform, the breach cascaded: the attacker was able to scrape personal and genetic data from roughly 5.5 million DNA Relatives profiles and an additional 1.4 million Family Tree profiles.³

The breach exposed a vulnerability that is somewhat unique to genetic databases. Unlike a stolen credit card number, which you can cancel, your DNA does not change. Once genetic information is out, it is out permanently. And the cascade effect means that even users who practiced good password hygiene had their data exposed because a relative on the platform did not. After the breach, 23andMe made two-factor authentication mandatory for all accounts, but the incident raised fundamental questions about whether centralized genetic databases can ever be adequately secured. At the time of the breach, 23andMe had not enforced multi-factor authentication or implemented rate limiting that would have slowed down the automated login attempts.

Your DNA as a Business Asset

Privacy with 23andMe is not only about hackers. The company has built a significant part of its business model around using customer genetic data for drug discovery and pharmaceutical partnerships. More than 80% of its customers have consented to their deidentified genetic and phenotypic data being used for research, and each consenting individual’s data has been used in an average of 200 studies.⁴ The company developed its own antibody compound for inflammatory skin conditions and licensed it to a pharmaceutical firm, and it has signed partnerships with major drug companies to study conditions like depression and bipolar disorder using its genomic and survey data.⁵

Whether this bothers you is partly a values question. The research consent is opt-in, and the data used in partnerships is supposed to be deidentified. Many customers see contributing to drug discovery as a genuine positive. But the consent framework was designed when 23andMe was a going concern with a clear leadership structure and privacy commitments. With the company now in bankruptcy and its data assets potentially on the auction block, the question of who will control that genetic database in the future is genuinely unsettled. A new owner could, in theory, be bound by the existing terms of service, but terms of service can be amended, and enforcement of privacy commitments through corporate transitions is historically messy. If you are a current 23andMe customer and this worries you, you can revoke your research consent and request data deletion through your account settings, though the company’s ability and willingness to fully honor those requests during bankruptcy proceedings is itself an open question.

Law Enforcement and Genetic Genealogy

Consumer DNA databases have become a tool for law enforcement through a practice called investigative genetic genealogy. The most famous example was the capture of the Golden State Killer through a different database (GEDmatch), but the broader issue applies to any company that holds genetic data. Law enforcement agencies can use database matching to identify biological relatives of unknown suspects, essentially converting your family tree into an investigative lead.⁶

23andMe has historically been more resistant to law enforcement requests than some competitors, and its terms of service require a valid court order. But the practice raises a concern that applies regardless of any single company’s policy: you can decide not to upload your DNA, but if a third cousin does, your genetic information is effectively in the system anyway. The pool of data in consumer databases has grown large enough that a substantial portion of people with European ancestry can already be identified through distant relatives, even if they have never personally taken a test. This is a genie that cannot go back in the bottle, and it is worth understanding before you decide to add more data to any consumer platform.

Insurance Discrimination Is Not Fully Prevented

In the United States, the Genetic Information Nondiscrimination Act (GINA) prevents health insurers and employers from using your genetic information against you. That protection is real and meaningful, but it has significant gaps. GINA does not apply to life insurance, long-term care insurance, or disability insurance.⁷ If a life insurer asks whether you have undergone genetic testing and what the results were, you may be legally required to disclose that information depending on your state. Some states have enacted their own genetic privacy laws that go further than GINA, but coverage is inconsistent.

This means that discovering through 23andMe that you carry a variant associated with, say, Parkinson’s disease or certain cancers could theoretically affect your ability to get life insurance at standard rates. Genetic counselors sometimes advise people to secure life and long-term care insurance before pursuing genetic testing for this reason. If you have already tested and found concerning results, the situation varies by state, and speaking with a genetic counselor or insurance attorney who understands your jurisdiction is worth the effort.

The Psychological Surprise Factor

One risk that rarely makes the marketing materials is the psychological impact of unexpected discoveries, particularly finding out that a parent is not biologically related to you. These “not parent expected” (NPE) events are not rare. Population genetics research suggests that somewhere between 1% and 10% of people may have a biological father different from the man they call dad, and consumer DNA testing has made these discoveries suddenly visible to millions of families.

Research on people who discovered non-paternity through direct-to-consumer DNA testing found increased levels of depression, anxiety, and panic symptoms compared to controls. Whether the discovery worsened someone’s mental health depended on several factors, including how family members reacted. A worsening relationship with the mother was identified as a risk factor for worse mental health outcomes, while being able to openly discuss the discovery and reach some acceptance of it were protective.⁸

A separate qualitative study found that participants described the experience as an extraordinary shock with negative mental health effects, a severe disruption to their sense of identity, and frequently ruptured relationships with existing family members, especially mothers. People sought support from spouses, siblings, and online peer groups, which were generally helpful. Many also consulted mental health professionals, though some found their therapists were not well equipped to help with this specific kind of crisis.⁹ Themes of grief, loss, and trauma ran through many of the accounts. This is not a reason to avoid testing if you want the information, but it is worth thinking about before you spit in a tube: are you prepared for the possibility that your family story might not be what you think it is?

Genetic Counseling After DTC Testing

When people receive health-related results from 23andMe that confuse or concern them, many seek out genetic counseling. Research on what these consumers expect from counseling sessions found that expectations were high. People generally viewed their DTC results as valid and potentially important for their medical care. They wanted thorough explanations in plain language, someone to connect their genetic results with their personal and family health history, and a clear plan of action.¹⁰ Many had already done extensive online research before the appointment, sometimes using resources typically reserved for genetics professionals.

This creates a complicated dynamic. Consumers arrive believing their results are definitive, but as the false-positive data shows, results from raw DTC data often need clinical confirmation before they can guide real medical decisions. Genetic counselors fill an important gap here, but access is uneven: there are not enough genetic counselors to meet demand, wait times can be long, and insurance coverage for post-DTC counseling varies. If you get a worrying result from 23andMe, the most productive path is usually to bring it to your primary care provider and ask for a referral to a genetic counselor or a clinical-grade confirmatory test, rather than acting on the DTC result directly.

How Regulation Differs Around the World

If you live outside the United States, your experience with DTC genetic testing may look very different. The regulatory landscape across Europe is fragmented. Some countries, like France and Germany, have essentially banned direct-to-consumer genetic testing altogether. Others, like Luxembourg and Poland, have only general healthcare laws that may indirectly restrict DTC testing without explicitly addressing it.¹¹ In many countries, genetic testing is legally required to be ordered or supervised by a physician, which rules out the direct-to-consumer model entirely.

In the U.S., 23andMe has several FDA-authorized reports, but the FDA’s authorization applies to specific tests for specific conditions, not to the platform as a whole. The ancestry estimates, the wellness reports, and the raw data download are not FDA-authorized products. This matters because consumers often assume that if one part of the service has FDA backing, the entire experience carries the same level of validation. It does not. The FDA-cleared health risk reports for conditions like late-onset Alzheimer’s or Parkinson’s have been through analytical and clinical validation. The rest of what 23andMe offers operates in a much lighter regulatory environment.

What Happens to Your Data if 23andMe Disappears

23andMe filed for Chapter 11 bankruptcy protection in March 2025, and the company’s entire board of directors outside of CEO Anne Wojcicki resigned in the months before. The genetic database, covering roughly 15 million customers, is one of the company’s most valuable assets and would likely be of interest to potential acquirers, whether they are healthcare companies, pharmaceutical firms, or private equity investors.

State attorneys general from multiple U.S. states and officials in other countries have publicly urged 23andMe customers to consider deleting their data and revoking research consent. The concern is straightforward: a new owner might not share the privacy values of the original company, and genetic data has almost unlimited potential uses, from drug development to insurance underwriting to surveillance. California’s genetic privacy laws and the terms of 23andMe’s existing privacy policy provide some protection, but legal experts have noted that bankruptcy courts can sometimes approve the sale of assets under modified terms.

If you want to act, the steps are relatively simple: log into your account, revoke research consent in your settings, and submit a data deletion request. 23andMe has stated it will continue to honor deletion requests during bankruptcy proceedings. Whether a future owner of the database would be able to reconstruct deleted data from backups or research datasets that were already shared with partners is a murkier question. For anyone who tested years ago and has not thought about their account since, this is probably a good time to log back in and review what you have opted into.

Who DTC Genetic Testing Works Best For

Despite the risks, 23andMe and similar services offer genuine value for certain use cases. If you are adopted and looking for biological relatives, the DNA Relatives feature has helped tens of thousands of people find family members. If you are a carrier of a known familial condition and want a low-cost screening before pursuing more expensive clinical testing, a DTC test can serve as a reasonable first pass. For ancestry curiosity and general exploration, the test is entertaining and broadly informative, even if the precise percentage breakdowns should be taken with a grain of salt.

Where DTC testing works worst is as a substitute for medical-grade genetic testing. If you have a strong family history of cancer, a hereditary condition, or a specific medical concern, going directly to a clinical genetics service will give you results that are more comprehensive, more accurate, and legally defensible for medical decision-making. The DTC route is cheaper and faster, but the downstream costs of acting on a false positive, or being falsely reassured by a negative result that did not test the relevant variants, can be significant. The strongest version of the argument for 23andMe has always been that it meets people where they are and gets them curious about their genetics. The weakest version is when people treat it as a medical test without the clinical infrastructure that real medical testing comes with.