Is It Safe to Upload Your DNA? Local vs Cloud Genome Analysis

Plenty of services invite you to upload your 23andMe or AncestryDNA file for "deeper analysis." It's convenient. It's also a decision you can't take back: once a copy of your genome sits on someone else's server, you no longer control where it goes. Before you click upload, it's worth knowing exactly what you'd be trusting — and what the alternative looks like.

What the law actually protects

In the United States, the Genetic Information Nondiscrimination Act (GINA) of 2008 is the headline protection. It does two things: it stops health insurers from using your genetic information to set eligibility or premiums, and it stops employers from using it in hiring, firing, or promotion.

Here's the part most people miss. The National Human Genome Research Institute states plainly that GINA's protections do not extend to life insurance, disability insurance, or long-term care insurance. Some states have added their own protections for these types of insurance, but federal law doesn't cover them. GINA also doesn't apply to employers with fewer than 15 employees. So the legal safety net has real, specific holes — and uploading your data widens your exposure to them.

What has already gone wrong

This isn't hypothetical. Three episodes are worth knowing:

• The 2023 23andMe breach. Attackers used credential stuffing — reusing passwords leaked from other sites — to log in to about 14,000 accounts, roughly 0.1% of customers. Through the DNA Relatives feature, those accounts exposed profile data on about 6.9 million people, around half of 23andMe's customers, as the company confirmed in December 2023 (TechCrunch). The attackers didn't break into the company's servers in the classic sense, which is precisely the point: a large pool of aggregated genetic data is a target no matter how the door is opened.
• The 2025 bankruptcy. On March 23, 2025, 23andMe filed for Chapter 11 bankruptcy and put the business up for sale through a court-supervised process (23andMe), customers' genetic data included. Regeneron first agreed to buy it for $256 million; after the auction reopened, TTAM Research Institute, a nonprofit founded by co-founder Anne Wojcicki, won with $305 million (STAT) and completed the purchase on July 14, 2025. Whatever the buyer's intentions, the lesson stands: data you hand to a company can change owners through a process you have no vote in.
• FTC enforcement. In June 2023 the Federal Trade Commission announced what it called its first case focused on both the privacy and security of genetic information, against 1Health.io (formerly Vitagene). It alleged the company left health reports and raw genetic data in publicly accessible cloud storage and retroactively expanded who it could share customers' data with. The FTC's advice to consumers afterwards: before you buy, find out who will have access to your data and how the company will protect it.

None of this means every service is reckless. It means that "upload and trust" is a standing bet on a company's security, solvency, and future ownership — three things you can't control.

Why local analysis sidesteps the whole question

There's a simpler model: don't upload at all. If your DNA file is analyzed entirely on your own computer, the failure modes above don't apply to you. Data that never leaves your device can't be scraped from a server you don't own, can't be sold in someone else's bankruptcy, and can't be quietly shared under a revised privacy policy. The safest data is the data you never hand over.

That's the model BioDecode is built on. It runs on your Windows or Mac machine, matches your file against a local copy of ClinVar, and shows you results without sending your genome anywhere — there's no account and no upload. If avoiding the upload is the whole reason you're hesitating, you can download BioDecode and keep your file on your own hardware.

To be clear about the trade-off: cloud services can offer collaboration, frequently updated annotations, and convenience. If you choose one, read its privacy policy, check whether you can delete your data and samples, and use a unique password. But if your goal is simply to understand your own genome, there's rarely a good reason to upload it to do so.

Once you've decided where your file will live, the practical guides for 23andMe and AncestryDNA cover the analysis itself.

Frequently asked questions

Does GINA protect me if I upload my DNA?

Only partly. GINA covers health insurance and employment discrimination. It does not cover life, disability, or long-term care insurance, and it exempts small employers. Uploading doesn't change the law, but it does put more copies of your data in more places.

What's the actual risk of uploading a DNA file?

The main risks are a breach of the company holding your data, a change of ownership (such as a sale or bankruptcy), and shifting privacy terms. The 2023 23andMe breach and the company's 2025 sale in bankruptcy are concrete examples.

How is local analysis different?

Local tools process your file on your own computer and never transmit it. There's no server-side copy to breach, subpoena, or sell. BioDecode works this way.

Can I delete my data from a service after uploading?

Sometimes, but not always completely, and not retroactively if it has already been copied or shared. The most reliable way to keep data private is to not upload it in the first place.

This article is educational and is not medical advice.