The DNA Test Comparison That Forgot the Most Important Question
Matt Baker compared five DNA testing companies and told millions of viewers which ones were worth their money. He explained the prices, the health reports, and even how to collect saliva. But he left out something more important: what happens to your DNA after you send it away.
In May 2021, Matt Baker of UsefulCharts published a comparison of five consumer DNA tests: CircleDNA, FamilyTreeDNA, 23andMe, AncestryDNA, and MyHeritage.
He had taken all five. He compared their prices, studied their reports, and checked how closely their ancestry predictions matched his family history.
His recommendations were straightforward. CircleDNA offered the most health information. FamilyTreeDNA suited advanced genealogists. AncestryDNA was best for North Americans, MyHeritage for Europeans and Jewish customers, and 23andMe for people wanting both ancestry and health reports.
Baker even explained that customers should avoid brushing their teeth for 30 minutes before collecting a DNA sample.
What he did not explain was how long companies might keep that sample, who could gain access to the genetic information, or what would happen if the company holding it failed.
That omission was not a minor oversight.
Five years later, one company he recommended had suffered a breach affecting nearly seven million customers, entered bankruptcy, and transferred its genetic-data business to a new owner.
Another company had already experienced a breach involving more than 92 million accounts before Baker published his comparison.
The most consequential difference between DNA companies was never simply how accurately they identified someone's Irish ancestors.
It was what they could do with the information entrusted to them.
The Warning Was Already There
Baker's video did not need to predict the future to examine genetic-data security.
In June 2018, three years before his comparison appeared, MyHeritage disclosed that information associated with 92,283,889 user accounts had been exposed.
The compromised information included email addresses and hashed passwords.
MyHeritage said it had no evidence that customers' DNA information or family trees had been accessed. Those records were stored separately with additional security protections.
That distinction matters. The incident was not evidence that 92 million genetic profiles had been stolen.
But it was unmistakable evidence that a major genealogy company could lose control of customer information.
MyHeritage acknowledged the incident publicly, making it information a reviewer could have considered in 2021.
Baker instead concentrated on its $80 testing price, ancestry reports, European records, and family-tree features.
He recommended MyHeritage particularly to customers outside North America.
There was nothing inherently unreasonable about that recommendation. The service may have been a good choice for those genealogical purposes.
But without examining privacy and security, he had not established that it was the best overall choice for customers.
An inexpensive DNA test can become expensive in ways that never appear on a receipt.
The 23andMe Breach Exposed the Real Cost
The clearest demonstration arrived in 2023.
Between April and September that year, attackers used stolen usernames and passwords from other breaches to gain unauthorized access to 23andMe accounts.
The technique, called credential stuffing, relies on people reusing login information across different websites.
According to a joint investigation by the privacy regulators of Canada and the United Kingdom, attackers directly accessed more than 18,000 accounts.
Yet the incident affected approximately 6.9 million customers worldwide.
How could access to thousands of accounts expose information concerning millions of people?
The answer lay partly in the feature that made 23andMe valuable for genealogy.
DNA Relatives allowed customers to identify and connect with genetic relatives. Once attackers entered certain accounts, they could also access information about other users matched to those customers.
Depending on the account and its settings, the exposed information included names, birth years, geographic locations, ancestry information, and details about biological relationships. Raw genetic information and health data were accessible in some compromised accounts.
The very system designed to connect families expanded the consequences of unauthorized access.
The regulators uncovered something even more troubling.
At the time of the breach, multifactor authentication was optional. Fewer than 22% of customers had enabled it or another enhanced sign-in method.
23andMe told investigators that it had avoided making multifactor authentication mandatory because it wanted to reduce friction for users.
That decision deserves particular attention.
A business holding intensely personal biological information had treated convenient account access as a reason not to require stronger login protection.
Investigators also found inadequate monitoring of suspicious activity, insufficient protection against compromised passwords, and missed opportunities to detect the attack earlier.
The UK Information Commissioner's Office subsequently imposed a £2.31 million penalty for failures to protect affected British customers.
Baker could not have known in 2021 that this specific attack would happen.
But his recommendation encouraged customers to evaluate 23andMe through the information it provided, rather than through the risks of entrusting it with information.
The breach demonstrated why those questions belong together.
A relative-matching database is not merely a useful feature.
It is also a network of sensitive personal information whose security depends on the company operating it.
What Happens When the Company Goes Bankrupt?
The 23andMe story did not end with the breach.
In March 2025, the company filed for bankruptcy protection.
Its assets, including genetic information and biological samples, subsequently became part of a court-supervised sale.
TTAM Research Institute, a nonprofit led by 23andMe co-founder and former chief executive Anne Wojcicki, agreed to acquire substantially all of the company's assets for $305 million.
The transaction transferred the genetic-data business to an organization connected to its original founder, not an unrelated advertising company.
The buyer also agreed to additional privacy and security protections.
Nevertheless, the proposed transfer generated serious objections from state authorities concerned about consumers' genetic information.
California argued that transferring genetic information and biological samples without customers' affirmative consent conflicted with its Genetic Information Privacy Act.
The bankruptcy court and a federal district court rejected California's objections.
On October 19, 2026, California Attorney General Rob Bonta announced a proposed $6 million settlement resolving the state's breach-related claims and its challenge to the transfer. The settlement remained subject to court approval.
California also confirmed that affected consumers retained rights to request deletion of their genetic information and destruction of their stored samples.
The sale does not establish that the purchaser has misused customer information.
Nor does bankruptcy automatically eliminate privacy protections.
The significant fact is simpler: customers who originally entrusted a company with their DNA subsequently found their genetic information involved in a corporate bankruptcy and asset transfer.
They did not necessarily choose that transaction.
A consumer might accept this risk. Another might decide that a family-history report is not worth it.
Neither could make an informed judgment from Baker's comparison alone.
Your DNA Can Tell Strangers About Your Family
One of Baker's most appealing personal discoveries came through genetic relative matching.
AncestryDNA helped him find a first cousin he had never known existed.
They connected online and discovered that they shared a health problem.
It was a meaningful outcome. Genetic genealogy can reconnect families, help adoptees identify biological relatives, and provide answers unavailable through ordinary historical records.
But the same discovery illustrates a privacy problem.
Genetic information is not exclusively about the person who submits the sample.
It can reveal information about biological relatives who never bought a DNA test.
The National Cancer Institute acknowledges that genetic results may have implications for blood relatives who hold different opinions about whether they want such information discovered.
There is another important distinction between testing companies.
FamilyTreeDNA's privacy policy allows customers to opt into investigative genetic genealogy matching, through which authorized law-enforcement accounts may identify matches relevant to qualifying investigations.
Its policy says customers must opt into both ordinary matching and investigative matching for their information to become visible through that feature.
Ancestry follows a different approach.
It says it does not voluntarily provide customer data to law enforcement and prohibits investigators from using its genealogy services for criminal investigations.
Its transparency report, published in February 2026, recorded zero valid law-enforcement requests for customer DNA data during 2025.
These differences do not establish that one company is universally safer than another.
They establish that companies make different decisions about how their databases may be used.
That is precisely the sort of distinction a serious DNA-testing comparison should investigate.
Baker compared the companies' abilities to find relatives.
He did not compare who else might be permitted to search for those relatives.
A Longer Health Report Is Not Necessarily Better Medicine
Privacy was not the only missing dimension.
Baker presented CircleDNA as the strongest choice for customers seeking detailed genetic health information.
Its premium package, costing $629 at the time, examined genetic risks associated with 36 hereditary cancers and 79 additional conditions.
It also included carrier screening for 163 hereditary conditions and reports concerning responses to 103 FDA-approved medications.
Those numbers sound impressive.
But the number of conditions covered does not establish how accurately a test predicts disease or whether its findings can improve medical treatment.
Baker's own experience contained an important warning.
CircleDNA identified an increased genetic susceptibility to type 2 diabetes, consistent with his family history.
It did not identify increased susceptibility to ulcerative colitis, a disease he had already developed in his twenties.
Baker acknowledged the limitation, observing that genetics does not determine everything about a person's health.
That qualification was scientifically responsible.
The problem was that his recommendation still relied heavily on the quantity and detail of CircleDNA's reports rather than independently established clinical value.
The National Cancer Institute estimates that only approximately 5–10% of cancers arise from harmful inherited genetic changes.
It also explains that a negative hereditary-cancer test does not establish freedom from cancer risk. Even when no harmful variant is identified, family history and other risk factors may justify medical follow-up.
A report covering 36 hereditary cancers therefore cannot be interpreted as a comprehensive examination of someone's likelihood of developing cancer.
The distinction between testing for inherited risk and predicting actual disease is essential.
The medication reports require similar care.
The fact that a drug is FDA-approved does not mean every genetic test claiming to predict an individual's response to that drug has been authorized by the FDA.
The agency's guidance states that it has not authorized direct-to-consumer pharmacogenetic tests to predict a person's response or adverse reactions to a specific therapeutic drug.
It warns that some claimed associations between genetic variants and drug responses may lack sufficient clinical evidence.
This does not prove that CircleDNA's individual findings were inaccurate.
It establishes that testing coverage and clinical reliability are separate questions.
A responsible comparison would distinguish medically validated findings from exploratory predictions and recreational reports.
Baker moved from hereditary cancer risks to predictions about musical talent, muscular development, personality, and intelligence.
The entertainment value was obvious.
The clinical significance was not.
Ancestry Accuracy Was Judged Too Generously
Baker considered AncestryDNA the most accurate of his five tests.
His reasoning was understandable.
He already knew that much of his family history involved ancestors from Germany, England, and Ireland who settled in Nova Scotia.
AncestryDNA returned results that corresponded closely with that history.
FamilyTreeDNA, by contrast, estimated more Eastern European ancestry than he expected.
But agreement with an existing family tree does not establish that an ethnicity-estimation method is the most accurate.
Companies compare customers' genetic markers against reference populations selected and analyzed using different methods.
The National Library of Medicine explains that reference databases differ, populations are unevenly represented, and historical migration complicates ancestry estimates.
Consequently, two companies may produce different geographic classifications without either result necessarily being a straightforward measurement error.
AncestryDNA's large North American database offered a credible practical advantage for finding relatives in that population.
That is different from proving that its ethnicity percentages were more accurate across populations.
Baker had five reports and one known family history.
He did not conduct a controlled accuracy study.
His conclusions were useful as firsthand consumer impressions. They should not be mistaken for independent validation of the companies' ancestry algorithms.
The Promotional Codes Were Disclosed. The Risks Were Not.
Baker deserves credit for acknowledging that some testing kits were supplied free for review.
He also disclosed promotional offers.
CircleDNA customers could receive a 33% discount using his code, while MyHeritage viewers were offered free shipping through another code.
Those arrangements are not evidence that his conclusions were purchased.
The supplied transcript does not establish whether Baker earned commissions from purchases, and nothing in this investigation establishes editorial interference.
But the promotional structure reinforced the comparison's central weakness.
The viewer was repeatedly directed toward choosing and buying a product.
Far less attention was given to what customers were surrendering when they completed that purchase.
A DNA test is unusual because its most valuable input may be the information supplied by the customer, not the money collected at checkout.
The broader industry has produced documented examples of why that distinction matters.
In 2023, the Federal Trade Commission finalized an order against genetic-testing company 1Health.io, formerly Vitagene.
The agency charged that the company had failed to protect sensitive genetic information, misrepresented its deletion practices, and retroactively expanded data-sharing permissions without adequately notifying affected consumers or obtaining their consent.
The FTC also found that sensitive information had been stored without adequate safeguards.
The settlement required strengthened security practices, restrictions on information sharing, and consumer refunds.
Vitagene was not one of Baker's five reviewed companies.
Its case nevertheless demonstrates that a genetic-testing company's promises about privacy, deletion, and future data use can become matters of regulatory enforcement.
The risks are not confined to hackers.
They also concern how companies manage information, interpret consent, change policies, and honor deletion requests.
The Law Does Not Protect Every Genetic Secret
Consumers may assume that genetic information receives the same legal protections as ordinary medical records.
That assumption can be dangerously incomplete.
In the United States, the Genetic Information Nondiscrimination Act, or GINA, generally prohibits covered health insurers and employers from discriminating based on genetic information.
But its protections do not extend to every insurance product.
The National Library of Medicine specifically identifies life insurance, disability insurance, and long-term care insurance as areas outside GINA's federal protections, although additional state laws may apply.
This does not mean insurers automatically receive access to consumer DNA databases.
It means genetic information does not enjoy identical legal protection in every circumstance.
For a customer deciding whether to submit DNA for recreational genealogy, that is an important distinction.
The same federal guidance recommends investigating what happens if a testing company is sold or closes, whether biological samples can be destroyed, whether results can be deleted, and whether information may be shared with commercial researchers or law enforcement.
Those are not obscure questions invented by privacy activists.
They are basic considerations identified by a government medical-information service.
They also expose how narrow Baker's purchasing framework was.
The Verdict: The Best DNA Test Is Not Simply the Best Report
Matt Baker made consumer DNA testing understandable.
His explanations of autosomal DNA, mitochondrial inheritance, Y-chromosome ancestry, and genetic relative matching offered genuine educational value.
He also warned viewers that DNA results might reveal unexpected family relationships and that genetic predisposition does not guarantee disease.
Those qualifications matter.
But they cannot repair the central omission in a comparison designed to tell people which testing company to choose.
Baker evaluated what customers received without adequately examining what companies retained.
The distinction has become impossible to ignore.
A breach exposed information connected to nearly seven million 23andMe customers. A bankruptcy placed a major collection of genetic information into a corporate asset sale. Regulators documented security failures. Other enforcement actions established that genetic-testing companies could mishandle promises about deletion and information sharing.
Not every DNA company experienced these failures.
Not every risk will materialize for every customer.
And the later events do not establish that Baker's original recommendations were dishonest.
They establish something more important: his criteria were incomplete in a way that could materially affect the decision to buy.
A reliable DNA-test comparison must examine security practices, data retention, deletion rights, research consent, law-enforcement access, corporate ownership, and clinical validity alongside price and ancestry features.
The cost of a DNA test is paid once.
The consequences of surrendering genetic information can extend across a lifetime—and beyond the customer who supplied it.
Baker helped viewers choose which company could tell them more about their ancestors.
He did not adequately help them decide which company deserved to hold their family's genetic information.
That was the question worth asking before anyone opened the box.
References
-
UsefulCharts — I Took 5 DNA Tests and Compared Them | Which One Is Best? (Matt Baker, May 2021).
Watch the original video
Original work under review. Establishes Baker's recommendations, reported prices, personal testing results, promotional disclosures, and the subjects omitted from his comparison. -
MyHeritage — MyHeritage Statement About a Cybersecurity Incident (June 4, 2018).
Read the company statement
Primary company disclosure. Confirms exposure involving 92,283,889 accounts and distinguishes compromised credentials from DNA information, for which the company reported no evidence of compromise. -
Office of the Privacy Commissioner of Canada — Joint Investigation into a Data Breach at 23andMe (June 20, 2025).
Read the investigation
Independent regulatory findings. Documents the attack, nearly seven million affected customers, weaknesses in authentication and monitoring, and the consequences of genetic relative matching. -
UK Information Commissioner's Office — 23andMe Fined for Failing to Protect UK Users' Genetic Data (June 17, 2025).
Read the enforcement announcement
Regulatory enforcement. Establishes the £2.31 million penalty and the findings concerning inadequate security protections. -
California Department of Justice — Attorney General Bonta Secures $6 Million Settlement in 23andMe Litigation (October 19, 2026).
Read the settlement announcement
Current legal development. Confirms the bankruptcy-related transfer, California's consent objections, the proposed settlement, and continuing consumer deletion rights; court approval was pending at publication. -
Federal Trade Commission — FTC Finalizes Order with 1Health.io (September 2023).
Read the FTC decision
Regulatory enforcement against another industry participant. Establishes documented privacy, security, consent, and deletion failures without attributing those failures to Baker's five reviewed companies. -
National Cancer Institute — Genetic Testing for Inherited Cancer Risk.
Read the medical guidance
Clinical reference. Explains the interpretation of hereditary-cancer testing, the limitations of negative results, and the importance of family history and genetic counseling. -
US Food and Drug Administration — Direct-to-Consumer Tests.
Read the FDA guidance
Regulatory and scientific guidance. Distinguishes analytical and clinical validity and explains the limits of consumer pharmacogenetic claims. -
National Library of Medicine — What Should I Know Before Proceeding with Direct-to-Consumer Genetic Testing?
Read the consumer guidance
Federal consumer-health guidance. Identifies privacy questions, company-sale and deletion risks, and limitations of genetic anti-discrimination law. -
National Library of Medicine — What Is Genetic Ancestry Testing?
Read the genetics explanation
Scientific reference. Explains why ancestral-population estimates differ across companies and why reference databases do not guarantee identical accuracy. -
FamilyTreeDNA — Privacy Statement (July 29, 2025).
Read the privacy policy
Company policy. Establishes the consent requirements for investigative genetic genealogy matching and the circumstances under which law-enforcement accounts may access matches. -
Ancestry — Government & Law Enforcement Transparency Report (February 27, 2026).
Read the transparency report
Company disclosure. Documents Ancestry's law-enforcement access requirements and its reported absence of valid requests for customer DNA data during 2025.