Colin Sheridan: Taking a DNA test to trace your ancestry can have more sinister outcomes than finding your roots

Someone spitting into a tube to gain insight into their ancestry — and occasionally their health — is giving away highly valuable and tradable information, not just about themselves but their families too

A DNA test does not just reveal where you might come from. It also generates an intensely personal dataset about who you are.

France has long had some of the strictest rules in Europe on consumer genetic testing. For years, it has been illegal there to take a recreational DNA test outside a medical setting. 

Yet a recent political debate reported by Le Monde suggests the country may now be considering something striking: allowing law enforcement to access commercial genealogy databases to solve cold cases.

The proposal highlights a growing tension around the world. The same DNA databases that promise people insight into their ancestry — and occasionally their health — are increasingly seen by governments as powerful investigative tools. But those databases were built not by police but by ordinary people sending away small tubes of saliva in search of their roots.

For a country like Ireland, where ancestry is practically a national pastime, the rise of direct-to-consumer DNA testing carries particular resonance.

Companies such as 23andMe and AncestryDNA have turned curiosity about family history into a global industry. Millions of people — particularly in the United States — have ordered kits, spat into a tube, and mailed it back to a laboratory to receive a digital breakdown of their ethnic origins and genetic traits.

And if there is one heritage that people seem especially eager to discover, it is Irish.

For generations, the Irish diaspora has cultivated a powerful emotional connection to ancestry. Americans travel across the Atlantic hoping to trace family lines to a parish or townland. Politicians and celebrities regularly lean into claims of Irish roots. 

When the actor Tom Cruise visited Ireland some years ago, he was ceremoniously presented with a “certificate of Irishness” — a tongue-in-cheek acknowledgement of just how elastic the notion of Irish identity can be.

Magical scientific key to the past

In that sense, DNA testing can appear to offer something almost magical: a scientific key to the past.

But behind the cheerful marketing — and the glossy pie charts of ancestry percentages — lies something more complicated. A DNA test does not just reveal where you might come from. It also generates an intensely personal dataset about who you are.

And once that data is created, the question becomes: who controls it?

Under European law, genetic data sits among the most sensitive categories of personal information. The EU’s General Data Protection Regulation — GDPR — classifies it as “special category” data, meaning it can only be processed under strict conditions.

In practice, however, that protection usually rests on a single legal foundation: consent.

“Legally, you can process special category data when an individual provides explicit consent,” explains Orla Lynskey, professor of law at University College London and a leading expert on EU data protection law. 

“This is likely provided before providing any genetic sample.” 

In other words, somewhere along the journey of ordering and activating a testing kit, customers will be asked to agree to terms and conditions that permit the company to analyse their DNA.

Whether that consent is genuinely informed is another question.

“It would depend on the terms and conditions, and it would not be in the interests of commercial genetic testing companies to draw certain issues to people’s attention,” Lynskey says.

Those issues are not trivial. Genetic information is unlike almost any other type of personal data because it does not belong neatly to one individual.

“The relational dimension of data — the idea that the same data can concern many people at once — is a big challenge to the idea of individual rights in relation to data,” Lynskey explains. 

This is most acutely felt with genetic data, where the decisions of one person about their genetic data can have intergenerational impacts.

In other words, a DNA test does not just reveal something about you. It reveals something about your siblings, parents, children and distant relatives as well.

Uncovering long-buried secrets

That reality has already reshaped family histories around the world. Consumer DNA testing has helped people find lost relatives, discover unknown parentage and reconnect families separated by adoption or migration. But it has also uncovered long-buried secrets and occasionally caused painful upheaval.

From a privacy perspective, the technology raises a deeper philosophical question: can an individual truly consent to sharing information that partly belongs to others?

The answer, in practice, tends to be pragmatic rather than philosophical.

Companies typically rely on lengthy consent forms and privacy policies to explain how genetic data may be processed, stored or shared. Customers agree with a click before sending their sample.

But consent, Lynskey notes, is an imperfect safeguard.

“Consent is, from a data protection perspective, a very leaky cauldron,” she says. “We are faced with so many complex consent decision-making moments on a daily basis that the rational thing to do is not to engage with it meaningfully.” 

That reality is familiar to anyone who has ever clicked “accept all cookies” simply to access a website.

In the context of genetic data, however, the stakes are far higher. Unlike a password or an email address, DNA cannot be changed.

Regulatory oversight crucial

Because of that, Lynskey argues, regulatory oversight becomes crucial.

“This makes regulatory oversight — by the Data Protection Commission — even more important,” she says, referring to Ireland’s national data protection authority.

Ireland occupies an unusual position in the global data protection landscape. As the European headquarters for many major technology companies, it has become a key centre for GDPR enforcement.

Yet consumer DNA testing largely remains a private commercial activity, with samples often processed in laboratories abroad. Irish consumers who purchase kits online are participating in a global data ecosystem that extends far beyond the State.

Recent corporate turmoil has also raised new questions about what happens to genetic data once it has been collected.

When 23andMe entered insolvency proceedings in the United States, privacy experts quickly raised concerns about the fate of its vast genetic database. Millions of people had entrusted the company with some of the most intimate information imaginable.

Situations like this are complex from a legal perspective.

“In the 23andMe insolvency, a privacy expert was appointed to recommend terms to the court dealing with the insolvency proceedings,” Lynskey explains. Those recommendations were ultimately accepted voluntarily as part of the process.

But similar safeguards may not always apply.

“It is far less clear what happens in acquisitions,” she says. “In principle, the original terms and conditions should continue to apply unless individuals are informed otherwise.” 

That uncertainty highlights the broader reality of consumer genetic testing: once a DNA sample is analysed and digitised, it becomes part of a powerful and potentially valuable dataset.

Companies have used aggregated genetic information for pharmaceutical research partnerships and large-scale studies into disease. In many cases, customers are invited — again through consent forms — to allow their anonymised data to be used for research.

For some people, that possibility is part of the appeal. The idea that their genetic information might contribute to scientific breakthroughs carries a certain civic virtue.

Commercial value of data

But critics argue consumers may not fully appreciate the commercial value of the data they are generating.

The renewed debate in France reflects these broader tensions. DNA databases originally built for genealogy could potentially become tools for policing. Genetic data submitted for curiosity about ancestry might ultimately serve purposes that individuals never imagined when they first spat into a plastic tube.

For Ireland, a country deeply invested in questions of origin and belonging, that tension is particularly striking. The search for roots has always been part of the Irish story — whether through parish records, census, ship manifests or family lore passed down through generations. DNA testing offers a modern extension of that impulse. Yet it also transforms something deeply personal into something measurable, analysable and, ultimately, tradable.

What's your view on this issue?

You can tell us here

The irony is that in trying to discover where we come from, we may also be creating a new kind of legacy: vast genetic databases that will outlive the individuals who helped build them.

And unlike a family tree scribbled in an old notebook, those records carry implications that stretch far beyond the past — into the uncertain territory of privacy, technology and the future of identity itself.