The 2 Best DNA Testing Kits of 2025

Few of the choices you’ll ever make as a shopper are as fraught with unknowns regarding data security and privacy as submitting a saliva sample to a for-profit company for DNA analysis. Not only is the information inherently personal, but recent history (including a series of high-profile data breaches at major companies) has shown as well that it’s impossible to guarantee who will and won’t be able to see and use that information, now or in the future.

Even if you’re paying only for an ancestry test, many consumer-oriented genetic testing companies can analyze biomedical markers in your DNA, as well. And it’s becoming more and more evident that your choices about what information to share may not only affect you but may also have implications for your relatives, no matter how distant.

When we first reviewed DNA testing services in 2017, we commissioned a legal analysis of the terms of service and privacy policies of AncestryDNA and FamilyTreeDNA by Brian J. McGinnis, a partner with Barnes & Thornburg LLP and a founder of the firm’s data security and privacy practice group. McGinnis found the policies to be in line with common industry practices, though he saw room for improvement, noting that AncestryDNA’s DNA-specific terms of service and privacy policies were not as clear as the company’s general privacy statement. Ancestry has since streamlined these documents with more user-friendly language, and the company’s DNA-related policies are now incorporated into an updated terms of service document and a revised general privacy statement.

But ultimately, people interested in testing kits have to decide whether they trust these companies with their genetic information. “We’re in an environment in which we don’t have rules about big databases, who accesses them and under what circumstances,” said Arthur L. Caplan, director of the Division of Medical Ethics at New York University’s School of Medicine, in 2018. There are no comprehensive federal laws or guidelines stipulating what a direct-to-consumer genetic-testing company can or cannot do with your DNA data. Unlike a doctor or HMO, the vast majority of these companies are not subject to the HIPAA laws governing the privacy of your health and medical records.

That means your protections extend only as far as a company’s privacy policy and any consent form you agree to. These policies vary wildly in length and readability, and they are subject to change at any time. “We see everything from a comprehensive 100-page policy from a big company … to a mom-and-pop shop whose privacy policy might be a sentence long,” said James Hazel, a Vanderbilt University Medical Center fellow who co-authored a survey of privacy policies at 90 US genetic-testing companies.

Worse, the legal recourse you would have should a company (or another customer) violate those policies is unclear. It’s not only individuals who are concerned about the implications of this unregulated market: In late 2019, the Department of Defense advised all military personnel to avoid direct-to-consumer genetic testing on security and privacy grounds.

We strongly encourage you to read the privacy statement of any DNA testing service before purchasing a kit. This is one product category where you definitely shouldn’t click blindly on a consent box, as you might with app updates or when you’re setting up a smart thermostat.

You can find the privacy policies for our picks at the time of this reporting at the following links:

We haven’t evaluated GEDmatch, a popular service that allows users to upload results from DNA testing companies like our picks and compare them with other users’ results. However, given the close involvement of the GEDmatch platform and DNA test data privacy concerns, you may also want to take a look at its terms of service and privacy policy.

A changing landscape

Since the publication of our original guide, a series of news stories surrounding DNA testing companies has brought increased scrutiny of their privacy and security practices. In particular, these articles have highlighted the ways in which companies like 23andMe (a former runner-up pick in this guide) and FamilyTreeDNA monetize biomedical data and/or collaborate with law enforcement.

In August 2020, Blackstone Group, the largest private equity firm in the world, announced a deal to acquire a roughly 75% ownership stake in AncestryDNA from a trio of other private equity firms. Thus far, the acquisition has not had any substantial impact on AncestryDNA’s operations or its privacy and security policies, but the fact that private equity has control of their genetic information may be a point of concern for some users.

In 2023, DNA testing companies were the target of several high-profile hacking attempts, and 23andMe experienced a significant data breach, which it failed to detect for months. (It resulted in a $30 million settlement following a class-action lawsuit.) As a result, many DNA testing firms have upgraded their log-in process to require 2-factor authentication.

Despite these eyebrow-raising developments, there has been some movement toward standardizing security and privacy practices in the DNA testing industry.

In 2018, many of the largest DNA testing services, including AncestryDNA and 23andMe, agreed to adopt a voluntary “best practices” standard of consumer privacy developed by the Future of Privacy Forum (FPF), a nonprofit think tank that receives corporate support from a who’s who of tech companies. James Hazel called the standards “a positive development … that starts the conversation and highlights some of the privacy issues.”

There are no substantive penalties for violating these voluntary standards, though the FPF removed FamilyTreeDNA as a supporter of the initiative in 2019 after the company was caught sharing database access with federal law enforcement.

What the major test makers told us about biomedical data and collaboration with law enforcement

“Ancestry is not currently providing any individual-level genetic data to third-party researchers,” a company spokesperson told us in 2018, and is instead providing “summary-level data” in its current collaboration with the University of Utah. In addition, the spokesperson said, “We commit to not sell DNA data to insurers, employers, or third-party marketers without our customers’ explicit consent.” Eric Heath, chief privacy officer at Ancestry, similarly affirmed in 2020 a commitment to fighting law enforcement requests for genetic information: “Ancestry’s commitment to privacy includes not sharing customer personal information with law enforcement unless compelled to by valid legal process, such as a court order or search warrant, and we will always seek to narrow the scope of any compelled disclosure,” he told us via email.

Though 23andMe, a former pick, does share genetic data with pharmaceutical companies, it says it does so only when customers opt in. “We have not wavered from our policy of not sharing information with third parties without separate, explicit consent from our customers,” said Jacquie Haggarty, 23andMe’s VP deputy counsel and data privacy officer, in a 2020 email. “Customers have always been in control of how their data is used and shared, and customers choose whether their sample is stored at our lab, or destroyed.” Regarding law enforcement requests, Haggarty affirmed that “23andMe has never given customer information to law enforcement.”

Meanwhile, FamilyTreeDNA CEO Bennett Greenspan confirmed to us in 2017 that the company’s Y-DNA and mtDNA tests did not return any biomedically relevant data. However, the company’s open collaboration with law enforcement sets it apart from its rivals. In 2020, we asked about privacy and the sharing of customer data with law enforcement. A FamilyTreeDNA spokesperson told us by email that the company “will allow the upload of law enforcement samples to the database if they meet a very specific set of criteria.” The spokesperson also said, “Customers have the option to opt-out of participating in our genetic witness program in their account settings in their matching preferences.”

Two approaches to data sharing

“I often, in my own head, kind of lump Ancestry and 23andMe into one bucket and put FamilyTreeDNA in a totally separate bucket,” said Natalie Ram, professor of law at the University of Maryland’s Carey School of Law and lead author of an article titled “Genealogy databases and the future of criminal investigation.” Ram continued: “Ancestry and 23andMe … have a whole law enforcement guide that says, you must bring a warrant and we will fight you. They don’t say it quite so bluntly, but that is effectively their policy.”

Despite the many legitimate concerns about providing law enforcement with access to citizens’ genetic information, CeCe Moore—a genealogist who has worked as a consultant and producer on the PBS series Finding Your Roots with Henry Louis Gates, Jr. and is the featured investigative genetic genealogist for the ABC series The Genetic Detective—has a more optimistic view of such collaborations.

“My team alone has helped law enforcement achieve 110 successful identifications over the last two years, averaging one per week, thanks to investigative genetic genealogy,” she told us, referring to her work as chief genetic genealogist at Parabon NanoLabs. “With so much focus on the identification and arrest of suspects, the power of genetic genealogy to exonerate often gets overlooked.” In other words, although genetic information can be used to identify and convict suspects, it can also be used to free those who have been wrongly arrested or convicted.

Moore also emphasized that investigators must abide by policies protecting the individual’s choice concerning whether their DNA data can be used. “The policies of the largest commercial DNA companies, AncestryDNA and 23andMe, prohibit the use of their databases by law enforcement, so they are not being used to solve these crimes,” she said. The primary difference between companies like AncestryDNA and 23andMe (which do not work with law enforcement) and companies like FamilyTreeDNA (which does) is that the former group requires its customers to opt in to participate in any kind of sharing, while the latter requires them to opt out to avoid it.

As a result, it’s important to familiarize yourself with the privacy settings and matching preferences that are active on your account. For instance, if you don’t want your FamilyTreeDNA test results used for law enforcement matching (and you’re not a resident of the EU), you need to go into your account settings and opt out of the Law Enforcement Matching (LEM) feature.

But it bears repeating that even when DNA testing companies provide toggles and promise to safeguard your privacy, you’re still relying on their word—as well as a hodgepodge of regulations and laws that differ from state to state and even county to county. Ram cautioned that since the courts have yet to resolve the question of whether customers have a Fourth Amendment right to privacy regarding the use of their DNA testing results for investigative genetic genealogy, they still have to trust that the testing companies will adhere to their own policies. And, she added, they also have to trust in the “goodwill of every law enforcement officer or investigator.”

Other factors to consider

Here are some questions you should make sure to find the answers to before using a DNA testing service, including one of the picks in this guide:

• Who is doing the testing? If a company is using an outside lab to sequence your DNA (most do), you should read the testing facility’s privacy statement as well.
• How long are my physical samples (saliva and DNA) stored? Some companies destroy samples once they complete their analysis. Others may store them for a year or even indefinitely.
• Can I delete my genetic information and analysis from a company’s website? Some—but not all—companies offer this option via an email request. Again, if they use an outside lab to perform sequencing, you need to make a separate request to the testing company.
• Can I adjust my privacy settings? Some companies offer a family-matching service, which is usually an opt-in program. Most services allow you to opt out of the program if you later change your mind.