Does MyHeritage share DNA data with police or law enforcement?

No. MyHeritage explicitly prohibits law enforcement from using its DNA services. Their Terms of Service state: 'Using the DNA Services for law enforcement purposes, forensic examinations, criminal investigations, cold case investigations... is strictly prohibited.' They will only provide customer information if compelled by a valid court order or subpoena for genetic information.

Can you delete your DNA data from MyHeritage?

Yes. You can delete your genetic data by going to Account Settings > Manage DNA Kits. To destroy your physical DNA sample (stored at Gene by Gene lab in Texas), you must separately contact privacy@myheritage.com or call +1-844-994-1888. Important: deleting your account does NOT automatically destroy your physical sample - you must request this separately.

Who owns your genetic information at MyHeritage?

You do. MyHeritage explicitly states: 'DNA users are the sole owners of their DNA data. We hold no rights to your data.' They also commit in capital letters that they will NEVER sell or license genetic or health information to insurance companies, government agencies, employers, or other third parties.

How long does MyHeritage keep your DNA sample?

MyHeritage may store physical DNA samples for up to 10 years with your explicit approval. Samples are stored at the Gene by Gene laboratory in Houston, Texas. You can request sample destruction at any time by contacting MyHeritage customer support.

Has MyHeritage ever had a data breach?

Yes. MyHeritage's own 2018 cybersecurity statement disclosed an incident affecting user email addresses and hashed passwords. According to that statement, DNA data and family trees were on segregated systems separate from the email addresses, and the file was found on a private server outside of MyHeritage. The specific figures and dates are quoted from MyHeritage's published statement, which is linked on this page.

MyHeritage DNA Privacy 2026: Is MyHeritage Safe? Past Breach, Police Access & How

Item: MyHeritage Privacy Policy
Rating: 35
Author: Sergei Tokmakov, Esq.

🧾 What Should I Do? Your MyHeritage Action Plan

In my framework's view, MyHeritage scores 35/100 mostly because of its past disclosed security incident and the policy's up-to-10-year sample retention, not because it sells your data. On the no-sale point the policy is emphatic, quoted below. What you do next depends on which kind of user you are. Pick the column that fits you.

Everyday user

You tested for genealogy and want to lower your exposure without leaving.

1Set a unique, strong password and turn on two-factor authentication. MyHeritage's own past breach disclosure described exposed emails and hashed passwords, so a reused password is the real risk here.
2Decide on sample storage. During checkout MyHeritage asks for explicit approval to keep your physical sample up to 10 years. You can decline, or revoke later by email (see the red box below).
3Review DNA Matching. Go to DNA › DNA Settings and disable matching if you do not want to be compared with, or visible to, other users and relatives.
4Check research consent. Research use requires your explicit opt-in; if you are unsure whether you opted in, review your consent in DNA settings and withdraw if you prefer.

Concerned about family / non-consent

You worry your DNA exposes relatives who never agreed to anything.

1Understand the core issue: a DNA test reveals information about biological relatives who never consented. Matching can surface unknown relatives, including in adoption and donor-conception situations.
2Turn DNA Matching off under DNA › DNA Settings so your kit is not compared against, or surfaced to, other testers.
3Do not upload relatives' raw DNA or test minors without genuine authority. Only the account holder should manage a kit.
4If a relative tested and you want your shared data minimized, ask them to disable matching too; one person's choices affect the whole biological line.

Already exposed / want full deletion

You think you were affected by MyHeritage's disclosed breach, or you simply want everything gone.

1Assume an older email and password may be public. Change that password everywhere you reused it, not just on MyHeritage.
2Delete your DNA results in-account, then separately email to destroy the physical sample. Both steps are required (full checklist in the red box below).
3If you are a California or EU resident, you can also send a formal CCPA/CPRA or GDPR deletion and access request in writing. See the demand-letter link at the end of this section.
4Keep written confirmation of every deletion and sample-destruction request, with dates. That record is what makes a later complaint or demand credible.

⚠ The DNA Deletion Trap: Deleting Your Account Does NOT Destroy Your Sample

This is the single most misunderstood thing about MyHeritage. Erasing your digital results and destroying your physical tube of saliva are two separate actions. Doing one does not do the other.

Step 1 - Required

Delete the digital genetic data

In your account, open Account › Manage DNA Kits (also reachable from DNA › DNA Settings), select the kit, and choose to delete the DNA data. This removes your results, matches, and ethnicity estimate. Deleting the kit, or the whole account, does not by itself touch the saliva sample held at the lab.

Step 2 - Also Required

Destroy the physical sample

Separately request sample destruction by emailing privacy@myheritage.com (the policy also lists phone support). Your physical sample is stored at the Gene by Gene lab in Houston, Texas, for up to 10 years unless you tell them to destroy it. Ask for written confirmation.

Both steps are required for true deletion. If you only do Step 1, your biological sample can still sit in a Texas freezer for years. If you only do Step 2, your processed digital data remains in your account.

Want to put your deletion or access request in writing with legal weight? See my CCPA / CPRA privacy-rights demand letter guide, and compare MyHeritage against the AncestryDNA privacy review and 23andMe privacy review before you decide where to keep your data.

⚠ Why DNA Privacy Matters More Than Other Data

Your DNA is uniquely risky: Unlike passwords or credit cards, genetic data cannot be changed if exposed. It reveals information about your biological relatives who never consented. And despite legal protections like GINA, genetic information could theoretically impact insurance (life, disability, long-term care are NOT covered by GINA) and employment. This review documents exactly what MyHeritage can and cannot do with your most sensitive data.

🌎 International Company Notice

MyHeritage describes itself as an Israel-headquartered company, and the policy and DNA pages state that DNA testing is processed at the Gene by Gene laboratory in Texas, USA, with US-based data centers. Per the policy, data transfers between jurisdictions are handled under standard contractual clauses for GDPR purposes. Because the corporate structure spans more than one country, a cross-border access or deletion request can be more complex.

⚠ Past Security Incident (Disclosed by MyHeritage)

MyHeritage's own published cybersecurity statement disclosed an incident affecting user email addresses and hashed passwords. The figure it reported:

92,283,889 users, per MyHeritage's statement

According to that same statement, the file was found on a private server outside of MyHeritage. The company stated that "Credit card information is not stored on MyHeritage" and that "family trees and DNA data are stored on segregated systems, separate from those that store the email addresses." The figure and these descriptions are quoted from MyHeritage's own statement, linked below.

Source: MyHeritage Official Statement (June 4, 2018)