Ancestry

Is Ancestry safe?

For a DNA test, Ancestry is one of the more careful choices. Its privacy statement keeps genetic data out of advertising unless you give separate consent, research use is opt-in, and police need a warrant or similar order. Its latest transparency report we could open, for July to December 2024, shows no valid US requests for DNA data. We found no breach of Ancestry's own systems. We score it 69/100, well above 23andMe at 48, whose 2023 breach exposed relatives' data on 6.9 million people.

The catch is everything around the DNA. Ancestry's websites share browsing data with ad partners, two-step login is optional, and a 2017 leak from RootsWeb, an older community site it hosted, showed how legacy services can expose passwords.

What Ancestry does with your DNA

Ancestry treats genetic data differently from the rest of your account. The privacy statement, effective 12 May 2026, says it does not share genetic information with third-party marketers, insurers or employers, and will not use it for marketing or personalised ads without your separate, explicit consent. De-identified genetic data goes to research partners only if you sign the Informed Consent to Research.

Your other data is handled more like any subscription site. Apple's label lists purchases, contact details, photos, search history, identifiers and "sensitive info" as linked to you, for analytics, personalisation and Ancestry's own marketing, but nothing used to track you across other companies' apps. On Android, Google Play lists no data shared with other companies. The privacy statement is broader: identifiers, purchase history, browsing activity and inferences go to marketing and advertising partners for targeted ads. Ancestry honours Global Privacy Control, so a browser that sends that signal opts you out. In the US you can also opt out on its "Do Not Sell or Share my Personal Information" page, and a separate US resident statement and Consumer Health Data Privacy Policy add rights in some states.

Police, courts and the transparency report

This matters more for DNA than for most data, because a match can point to your relatives. Ancestry's terms bar using the service for law enforcement investigations, and the privacy statement says it does not voluntarily give data to police or allow them to identify human remains through its tools. It will try to warn you before any compelled disclosure.

The report published in February 2025 shows:

Requests for non-DNA data involved credit card misuse, fraud or identity theft.

How secure is Ancestry?

We found no breach of Ancestry's main systems. The incident on record came from RootsWeb, a free genealogy community site Ancestry had hosted since 2000. In December 2017 a security researcher reported a file with about 300,000 email addresses, usernames and passwords from RootsWeb's surname list service, which had already been retired. According to Ancestry's notice, 55,000 of those logins were also used on an Ancestry site and about 7,000 matched active customers. Ancestry locked all 55,000 accounts, forced new passwords and took RootsWeb offline.

That is within our 10-year window, so it still counts, but lightly: it did not touch DNA data or Ancestry's main systems. The bigger gap is that multi-factor login is something you switch on, not a default. We found no public bug bounty on HackerOne or Bugcrowd. The policy says personal and genetic data are encrypted, without more detail.

Can you delete your data?

Yes, and it is easier than at most DNA companies. You can download your raw DNA data and family trees, delete only your DNA results or close the whole account. Ancestry says genetic data leaves its production, development, analytics and research systems within 30 days. Its lab partners may keep some records to meet US laboratory rules, and research already done with your data cannot be undone.

Your saliva sample is destroyed on request or when you delete your account, and is only stored in Ancestry's biobank if you agree. In family trees, living people are visible only to you and people you invite unless you change that.

How to use Ancestry more safely

1. Turn on multi-factor login, and use a password you use nowhere else.
2. Think before you join DNA matches. Matching can reveal unknown siblings, donors or a different biological father, and matches can message you.
3. Skip the research consent if you do not want your de-identified data in outside studies.
4. Use Global Privacy Control in your browser, or the "Do Not Sell or Share" link, to stop ad sharing on the website.
5. Remember that relatives who test can reveal facts about you even if you never take a test.

If you are comparing services, MyHeritage has similar DNA rules but a much larger 2018 password leak.

How we scored it

Regulatory record (88) is Ancestry's best factor: no fine or order, and the Illinois genetic privacy suit over the Blackstone takeover was dismissed. Transparency and control (74) is also strong, with self-service deletion of DNA and sample destruction. Privacy (62) is the weakest, because the website shares browsing data for targeted ads, while security (64) is held back by optional two-step login and the 2017 RootsWeb leak.