ALBUQUERQUE, N.M. (WHAT THE TECH?) —  Millions of Americans have used at-home DNA test kits. Now there are new concerns over who has that information and what they can do with it.

It didn’t have to be you. But someone in your family spit in a tube maybe to find out where they came from, or what health risks they might face. Even if you never took a DNA test, your genetic information could still be at risk.

One of the largest DNA testing companies, 23andMe was hacked a few years ago. Now it’s up for sale, and lawmakers are asking: what happens to all that genetic data when ownership changes hands?

By law, health insurance companies aren’t allowed to use your DNA to deny coverage. But that law doesn’t apply to life insurance, disability, or long-term care policies. That means your DNA—or a relative’s—could be used to raise your premiums, or deny you altogether. 

So why worry if you never took a test? Because your DNA is still part of the puzzle. A third cousin—maybe someone you’ve never met—uploads their DNA to a public site like GEDmatch. Since you share part of that same genetic code, your identity can be traced through them.

That’s exactly how police caught the Golden State Killer. Investigators used DNA from a distant relative who submitted their results to GEDmatch. From there, they built a family tree, found a match, and arrested him decades after the crimes. It shows how powerful—and revealing—DNA data can be. 

If you’ve taken a DNA test, check your privacy settings. download your raw data and delete it. And have a conversation with your family. If someone else has submitted their DNA, they should do the same. Because their DNA isn’t just theirs, it’s tied to you, and it could affect your access to insurance, care, or services in the future.