A DNA test signup is protected by one permanent email alias, used for that DNA service only and kept live for as long as the account exists. The alias keeps the real address out of breach files and other services, while results, relative matching, recovery and deletion requests continue to arrive at it. The alias does not hide identity from the DNA company, which still holds the sample, the name and the genetic data. Genetic data cannot be changed after a breach as a password can be changed or a payment card cancelled, so the address attached to it carries more weight than the address on most accounts.
The 23andMe record#
In early October 2023, 23andMe disclosed a breach that the company first described as limited and attributed to credential stuffing, and confirmed the full scope that December. About 14,000 accounts were directly compromised through credential stuffing, and attackers used the DNA Relatives feature to reach profile information for about 5.5 million people, plus Family Tree information for about 1.4 million more. The total was 6.9 million affected people, roughly half of the company's then 14 million customers, according to TechCrunch. The exposed data included names, birth years, relationship labels, the share of DNA held with relatives, ancestry reports and self-reported locations.
On 23 March 2025, 23andMe filed for Chapter 11 bankruptcy protection, putting its assets, including the genetic database and the laboratory biobank, up for sale. TTAM Research Institute, a nonprofit founded by co-founder Anne Wojcicki, acquired substantially all of the assets for $305 million and completed the purchase on 14 July 2025, as recorded on Wikipedia. At a House hearing on 10 June 2025, the interim chief executive said about 1.9 million of roughly 15 million customers had asked for their data to be deleted since the filing, as reported by Test Your Genome. That figure is not confirmed from a primary transcript.
On 19 October 2026, California Attorney General Rob Bonta announced a $6 million settlement with Chrome Holding Co., formerly 23andMe, pending court approval. The settlement resolves allegations over the 2023 breach and the state's objection to the sale of Californians' genetic information and samples in bankruptcy without affirmative consent. The breach affected nearly 7 million customers in the United States, including more than 855,000 Californians, according to the California Department of Justice.
The signup address#
The address on a DNA test account carries more functions than the address on most accounts: results, relative-matching alerts, password resets and deletion confirmations all arrive there. The California Attorney General's deletion instructions end with a confirmation email that the customer must follow, so a customer who cannot receive mail at the signup address cannot complete the deletion request.
The same address carries account recovery: an alias deleted while the account is live strands it, because mail sent to it bounces and never arrives. The AliasFleet article on using an email alias for account recovery states the rule plainly: a recovery address works only while it stays live and forwards to a controlled inbox. The rule applies to any account, and with more force to a DNA test account, because the data cannot be re-created by signing up again.
Two-factor codes sent to the alias arrive like any other message but expire within minutes, so an authenticator app or a passkey serves as the main second factor, with codes by email as a fallback, as the AliasFleet article on two-factor codes at an email alias explains.
Genetic information and the law#
The Genetic Information Nondiscrimination Act of 2008, usually called GINA, is the main federal law governing the use of genetic information in the United States. Title I bars health insurers from using genetic information in underwriting. Title II bars employers with 15 or more employees from using it in employment decisions. The EEOC summary states the rule plainly: an employer may never use genetic information to make an employment decision.
GINA does not apply to life insurance, disability insurance or long-term care insurance. A result showing a known pathogenic variant in BRCA1 or an APOE risk variant could legally factor into a life, disability or long-term care insurance application in most US states, according to the Guide to Genetics.
Law enforcement is a separate matter. 23andMe states that it does not voluntarily share DNA with police and releases data only under valid legal process. Its Transparency Report, last updated 30 April 2026, records 13 data requests received in the United States since 2015, covering 17 user accounts, with data produced for 0 accounts. The company states it will not voluntarily release data to law enforcement, insurance companies or public databases, as shown on the 23andMe Trust Center. Its support pages add that the company does not sell genetic information without explicit consent and shares with law enforcement only under a valid court order, subpoena or search warrant, as set out in 23andMe Support.
MyHeritage states it has never sold or licensed genetic data or health data and will never do so without explicit consent. It will never provide personal data to insurance companies or employers under any circumstances, and it prohibits law enforcement use of its DNA services, according to its privacy policy. FamilyTreeDNA and GEDmatch have allowed law-enforcement matching under opt-in settings. The 2018 identification of the Golden State Killer suspect came after investigators uploaded a crime-scene DNA profile to GEDmatch, where a relative of the suspect had uploaded their own DNA, as set out by GenomeTesting.org.
Privacy policies across services#
Nine topics decide what happens to the data: sample storage, deletion exceptions, research consent, partner sharing, law enforcement, de-identification, mergers and bankruptcy, data location and breach notification, according to Test Your Genome.
Research consent should be a separate, optional consent, not a condition of receiving results, as Test Your Genome advises. Withdrawal usually works going forward only. Ancestry states it will not be able to remove de-identified genetic information from active or completed research projects, and 23andMe states research already performed or published before withdrawal will not be reversed or withdrawn.
Deletion has exceptions. Clinical laboratories can have legal retention duties, and Ancestry states it will delete genetic information from its systems within 30 days, with backup copies taking longer to clear.
The merger and bankruptcy clause differs between services. Ancestry's statement says data may be shared with an acquirer and the promises in the privacy statement will continue to apply. 23andMe's current statement goes further for genetic data: it will not sell or transfer genetic data in connection with any merger, acquisition or bankruptcy unless the buyer meets set conditions and agrees to adopt the statement. The sale completed on 14 July 2025 despite the clause, after the court approved the transfer over the state's objection. A buyer that inherits a policy can change it later, and a bankruptcy court can approve a transfer over a state's objection, as the California settlement record shows. An alias does not protect genetic data held by the testing company itself: the 23andMe record shows a breach and a sale happening to the same company within two years.
An email alias does not hide identity from the DNA company. The company still holds the sample, the name, the payment details and the genetic data. The alias limits exposure across services and after breaches. It does not limit what the provider itself knows. A genome remains distinctive even without a name attached: a 2013 study in Science showed surnames could be inferred from some research participants' genomes using public genealogy databases, as reported by Test Your Genome.
The alias setup#
One permanent alias per service. The alias is created before signup and used only for that DNA service. One alias per site contains a breach to that site, names the leaker when spam arrives on it, and keeps the real address out of breach files entirely. The AliasFleet article on a different email address for every website sets out the arithmetic: Have I Been Pwned now tracks 1,051 breached sites and more than 17.8 billion exposed addresses, and a reused address stitches accounts together across every future leak.
The alias stays live permanently. A DNA test account differs from a free trial or a newsletter signup. The alias is the account address, and the account needs it for years: results, relative matches, recovery and deletion confirmations. The full address is recorded in a password manager next to the password, so it is at hand when a recovery form asks for it.
Ordinary account protection surrounds the signup. A unique password from a password manager matters here more than usual, because the 23andMe breach began with credential stuffing: attackers fed username and password combinations stolen from other breaches into 23andMe's login page. Checking the old address on Have I Been Pwned before signup shows whether it is already circulating, and the AliasFleet guide to checking whether an email was leaked explains how to read each result.
The alias domain is checked against rejection. Some websites can tell an address is an alias, usually from its domain, and a small number reject alias domains. Detection is not rejection, and plain aliases on clean domains pass more often than random strings on shared domains, as the AliasFleet article on whether websites can tell an alias is in use explains. No DNA service publishes a policy on alias-domain acceptance, and no public test of alias signups at 23andMe, Ancestry or MyHeritage was found, so no claim is made here about any specific service blocking or accepting aliases. If a DNA service rejects an alias domain, an alias on a custom domain or a dedicated real address for that one service is the fallback. No live signup test was run for this piece: that would require creating an account with a real DNA service.
AliasFleet and DNA test signups#
AliasFleet is an email alias service that supplies one forwarding address per site, with mail forwarded to a destination inbox and replies sent from the alias. The mechanism is set out in the AliasFleet article on how email aliases actually work: a forwarding rule, a reply mechanism and a kill switch. The free tier covers 10 active aliases. AliasFleet does not hold genetic data, does not run DNA tests, and cannot change a testing company's privacy policy or its law-enforcement record.
Summary of the setup#
A DNA test signup uses one permanent alias per service, created before signup and kept live for as long as the account exists, because results, relative matching, recovery and deletion confirmations all depend on it. The account uses a unique password with an authenticator app or passkey as the main second factor. The alias limits exposure across services and after breaches. It does not hide identity from the DNA company or change the service's privacy policy.
