Who Owns Your DNA Data? Inside The Legal Grey Zone Of Genetic Data Rights

For years, our personal data has been traded, tracked and monetised by tech companies – basic things like clicks, locations, heart rates and even our sleeping patterns. But now, we’re entering a far more intimate frontier: the commoditisation of biology itself.

But, in 2025, the lines between health, data and commerce are blurring faster than ever. DNA testing kits, biometric wearables and AI-driven wellness platforms are unlocking unprecedented insights about our bodies. However, beneath the promise of personalised health lies a bit of a disconcerting question – who actually owns your genetic data? You, or the company that analyses it?

And moreover, if we don’t yet have a confident answer to that question (or simply if the answer isn’t “you”), perhaps we should take a beat before diving into DNA testing head first.

The Rise of the Genetic Data Economy

Once the domain of research labs and ancestry enthusiasts, DNA analysis is now a consumer product. Companies like 23andMe and AncestryDNA, for instance, popularised at-home testing kits that can trace family heritage or reveal predispositions to disease. Millions have eagerly shared their genetic material, lured by curiosity and convenience. After all, the idea of being able to find out so much about yourself, your ancestry and your family is an incredible thought.

But, few realise that this information is often stored, analysed and sometimes licensed for profit. 23andMe, for instance, entered a $300 million partnership with GlaxoSmithKline in 2018, giving the pharmaceutical giant access to anonymised genetic data to aid in drug development. While this collaboration is framed as a win for medical innovation, it also highlights the commercial potential of DNA as a data source. It also raises questions about exactly what “anonymous” really means in this context – how anonymous is anonymous?

Indeed, genetic information has become a kind of biological currency – highly valuable to researchers, insurers and AI-driven health startups. Yet, most consumers don’t fully understand what they’ve agreed to when they tick “I accept” on a company’s privacy policy, and we’re now realising just how problematic this could be.

The Legal Grey Zone of Genetic Ownership

So, who owns your DNA once it’s been digitised? The answer isn’t simple, and that’s kind of the problem.

In the UK and EU, data protection laws like GDPR classify genetic data as “special category data”, meaning it requires extra safeguards. However, they stop short of explicitly defining ownership. Once you’ve submitted a sample, companies often claim broad rights to use or store that information, sometimes indefinitely.

In the US, where data privacy laws are patchier, most genetic testing firms maintain that you still “own” your DNA, but their terms of service often grant them a perpetual, global licence to analyse, share or sell anonymised versions of it.

The result is a murky landscape where consumers retain theoretical ownership but very little control. You may “own” your genetic data, but the company owns the systems, the algorithms and the datasets that give that data meaning. And the problem is that whenever regulations surrounding these sorts of things are even just a little murky, it leaves room for some questionable activity.

The Wearable Revolution Meets Biometric Reality

If genetic testing was the first phase of the personal biology boom, biometric wearables are the next.

Devices like Whoop, Oura and even the Apple Watch are evolving from step counters into continuous health monitors. Some are already exploring blood biomarkers and metabolic data – the kind of physiological information once only available through lab tests.

These innovations promise huge potential for early disease detection and personalised healthcare. Yet, they also expand the volume of sensitive biological data being collected – and often stored in the cloud.

The more integrated these devices become, the blurrier the distinction between medical data and consumer data. A smartwatch that monitors blood oxygen might sound harmless, until that data is used to predict long-term health risks. Imagine a future where a health insurer adjusts your premium based on your resting heart rate trends or an employer infers fatigue or stress from your wearable data?

It’s not far-fetched. In fact, startups in the UAE and the US are already experimenting with bio-insurance models that link premiums to lifestyle metrics. And to say that’s controversial would be a massive understatement.

The Potential for Misuse

The greatest concern around DNA and biometric data isn’t necessarily corporate greed, it’s about misuse.

Genetic databases have already been used by law enforcement agencies in the US to solve cold cases through “genetic genealogy” – a move that reignited debates around privacy and consent. Meanwhile, cybersecurity experts warn that hacked DNA databases could expose not only your identity but your relatives’ health information.

There’s also the matter of bias and discrimination. Studies show that genetic algorithms and facial recognition systems alike tend to perform better for some demographics than others. If such data begins informing medical research or insurance models, inequality could be baked into the biology of the system itself.

And, once your genetic data is leaked, there’s no way to change it. Unlike a password, your DNA can’t be reset.

There’s no going back. So, surely that means that now is the time to think twice before sharing?

Ethics, Consent and the Illusion of Control

At the heart of the issue is informed consent – or rather, the illusion of it.

When you send off a saliva sample or sync a wearable to the cloud, you’re often agreeing to lengthy terms filled with legal jargon that even experts find difficult to interpret. Few users realise they’re potentially granting companies the right to use their biological data for purposes beyond the immediate service – from research partnerships to algorithmic training.

Ethically, this raises tough questions: can a person truly give informed consent for something as complex and far-reaching as genetic data use? Should there be limits on how “anonymised” genetic data can be commercialised? And, does the right to privacy extend to the molecules that define who we are?

These questions have yet to be fully answered by law – right now, we don’t know if individuals neccessarily even have the ability and right to give this consent without legal intervention. But, these questions are becoming increasingly urgent as AI and genetic data intersect.

The Push for Regulation and a New Digital Bill of Rights

Governments and privacy advocates are starting to take notice. The UK’s Information Commissioner’s Office (ICO) has called for greater transparency in biometric data collection, while the EU’s AI Act introduces stricter rules for health-related algorithms.

Some experts are even proposing a “Genetic Data Bill of Rights”, which would give individuals explicit ownership over their biological information – that includes the right to delete it, revoke access or demand transparency over how it’s used.

Others advocate for a data fiduciary model, where companies handling sensitive biological information must act in the user’s best interest, much like a lawyer or financial advisor.

The Future: A Balance Between Empowerment and Exploitation?

As technology advances, our biological data will only grow more detailed – of course, with that detail comes increased value. DNA insights could help us predict diseases before they appear, tailor treatments to our genetics and extend human lifespan. But, this same potential also makes our biology one of the most sought-after commodities on Earth.

The future of genetic data will hinge on trust – that is, whether tech companies, startups and regulators can work together to build a system that protects individuals as fiercely as it innovates.

Because while DNA may be the blueprint of life, in 2025, it’s also becoming the blueprint of the next data economy – one that forces us to reconsider what it truly means to own ourselves.