Genetic and Location Data Privacy

Two kinds of data that are hard to change

Most account data can be reset: you can change a password or delete a profile. Two kinds of data are different. A person's DNA cannot be changed, and US law defines genetic information to include information about the genetic tests of family members. [1] Location history can reveal where someone lives, works, worships or receives medical care. Both are named as sensitive in the laws below. This page is information only, not legal advice, and covers only the jurisdictions whose official sources we read: US federal agencies, California, Washington and the European Union.

Genetic data

What consumer tests are. Consumer genetic and wellness tests are covered in consumer genetic tests for wellness; this page is about the data, not the test quality.

What the law names.

• California (CCPA): the state Attorney General lists genetic data, precise geolocation and information concerning a consumer's health among sensitive personal information, and says consumers have the right to limit its use and disclosure. [2] The CCPA applies to for-profit businesses that do business in California and meet revenue or data-volume thresholds. [2]


• European Union (GDPR): the European Commission lists "genetic data" and "data concerning health" as sensitive, with specific processing conditions such as the individual's explicit consent. [3] The rules reach non-EU companies that offer goods or services to people in the EU. [4]


• United States, federal: the Genetic Information Nondiscrimination Act (GINA) makes it illegal for health insurers or employers to request or require genetic information and bars discriminatory use of it. [5] The EEOC, which enforces the employment part (Title II), says that part prohibits using genetic information in employment decisions and restricts employers from requesting, requiring or purchasing it. [1]

Where protection stops. The National Human Genome Research Institute notes that concerns remain about the use of genomic information to discriminate against applicants for life, long-term care and disability insurance. [5] GINA as described by these sources concerns health insurance and employment. Other uses were not verified here.

Company changes. When a genetic testing company is sold or fails, data can be affected. In March 2025 the FTC Chairman wrote about the 23andMe bankruptcy, saying consumers should be able to trust that companies will keep their promises, including when it comes to sensitive information. [6] This was a letter stating the FTC's position, not a court ruling.

Past enforcement. The FTC alleged that a genetic testing company, 1Health.io (Vitagene), stored sensitive data in publicly accessible cloud "buckets", failed to keep deletion promises, and retroactively expanded the third parties it could share with. [7] Those are the FTC's allegations from a 2023 announcement.

Location data

Phone location can come from GPS, wi-fi and cell signals. Apps ask for it for maps, weather or workouts, but the data may also be sold on.

• The FTC's Gravy Analytics order, announced January 2025, prohibits selling, disclosing or using sensitive location data except in limited circumstances; the complaint alleged lists of people who visited healthcare facilities and places of worship were sold. [8]
• On Mobilewalla, the FTC alleged that the raw location data it collected was not anonymized and that data from health clinics, religious organizations and other sensitive sites was involved. [9]
• X-Mode Social and Outlogic were prohibited from sharing or selling any sensitive location data under a January 2024 order. [10]
• A proposed May 2026 FTC order would bar Kochava from selling sensitive location data without a consumer's affirmative express consent; it is a proposal until a court approves it. [11]
• Under Washington's My Health My Data Act, consumer health data is regulated for businesses that operate in or target Washington. [12]

Practical, non-technical steps

• Treat DNA results and location history as long-lived. Read how the company says it shares and keeps them before you start.
• The FTC suggests going to your phone's privacy settings to see what an app can access, and choosing not to share location. [13]
• Ask the company how to delete data. See account deletion and exporting your data.
• Be cautious about uploading genetic or lab results to third-party apps or AI tools; see uploading lab results to apps and AI.
• For how companies explain genetic results, see consumer genetic interpretation claims.