Somewhere in the first day or two of your child's life, a nurse comes in with a card and a lancet. She pricks the baby's heel, squeezes five drops of blood onto a piece of filter paper, and leaves the room (and the baby crying.)
This test is one of the great public health wins of the last century. It screens for dozens of conditions where catching it in week one instead of year three can mean the difference between a healthy childhood and permanent damage. I'm not going to argue against it, and you shouldn't either. But the thing nobody tells you is that the card doesn't necessarily get destroyed.
Michigan has been collecting newborn blood samples since the 1960s, and its statutory scheme provides for what amounts to indefinite storage of both the physical blood spots and the genetic markers extracted from them into a state electronic system. Your child's first medical test may still be sitting in a freezer, and depending on where you live, it may still be there when they're forty.
Why This Article Is Different
I've spent two articles in this series on how little control you have over your family's medical information. Part I was about HIPAA and how much less it does than the name implies. Part II was about Amazon buying its way into the pipeline.
Ryan Gardner
Ryan Gardner
There's an important nuance I want to restate, because it sets up everything below. When something in your medical record is wrong, you don't get to correct it. If you think something is "not accurate, relevant, timely, or complete" you can request an amendment. Under the HIPAA Privacy Rule, the provider can deny that request if they disagree. That means the person who wrote the note you're disputing is the person who decides whether the note was wrong. They have sixty days to respond. If they say no, they attach your request, their denial, and your written disagreement to the file. If they say yes, the amendment goes in beside the original. Either way the original stays.
Records only accumulate. That's the pattern across this whole series.
Genetic data is the purest version of it. A password changes in seconds. An email address gets abandoned. Genome data does neither, and it isn't only about the person it came from. It describes their siblings, their parents, and children who haven't been conceived yet.
Three Things That Are Genetic Testing, Which Nobody Calls Genetic Testing
Ask a parent whether their kid has had genetic testing and most will say no. But usually the answer is three times before kindergarten.
The heel prick. Newborn screening is the single largest application of genetic testing in the United States, and in most states there is no requirement of informed parental permission for the screening itself. You're not asked because the law doesn't require asking. What varies enormously, state to state, is what happens to the leftover sample. New Jersey retained blood spots for 23 years before dropping to ten. Utah passed a law in 2025 requiring parental consent for retention, with destruction inside 90 days if consent isn't given. Some states hold indefinitely. Very few people know which regime they're living under, and I'd include myself before writing this.
There's active litigation on exactly this question. A cert petition in Kanuszewski v. Shah went to the Supreme Court in January 2026 on whether retaining and using newborn blood spots without parental consent violates the Fourth and Fourteenth Amendments. It's still pending as of September 2026.
The prenatal blood draw. Noninvasive prenatal testing, the blood test around week nine or ten, is genetic sequencing performed on a fetus. It produces cell-free DNA data, and that data lives in a commercial laboratory. A published review of lab privacy practices found that most laboratories permitted prolonged use and sharing of cfDNA data, showed incomplete adherence to professional privacy recommendations, and used consent documents that didn't clearly explain any of it.
The testing kit gift. Someone buys you a genetic testing kit for the holidays or a shower. This is the one point in the chain where a parent actually clicks through a consent flow, which makes it the only place real choice happens, and also the place where a child gets enrolled into open-ended research that nobody in the family will think about again.
Your Family's DNA Is a Shared Account
This is the part that breaks the model of privacy, and I think it's the most important section in the article.
Forensic genetic genealogy doesn't need your child in a database, it just needs a relative. Investigators upload a crime scene profile, find partial matches, and build family trees backward until the tree points at a person. A cousin or an aunt tests, the match runs through them, and your child is locatable in a system they were never entered into.
The consumer platforms have policies about this, and policies are not the same as law. In one Florida case, a judge granted police a warrant to search the entire GEDmatch database, roughly a million people, overriding the site's own opt-in restrictions. Fewer than a dozen states currently require a warrant before law enforcement searches a consumer DNA database.
Individual consent is the entire foundation of privacy law, and here it doesn't hold. Your family's genetic privacy is a shared resource, and any single member can spend it for everyone, permanently, by mailing a tube of spit to a company they heard about on a podcast.
"We will never sell your data" Has a Shelf Life
In March 2025, 23andMe filed for Chapter 11. The genetic data of more than fifteen million people went into the bankruptcy estate, and in bankruptcy, customer data is an asset. And we all know assets get sold.
After a final round of bidding in June 2025, the winning bid of $305 million came from TTAM Research Institute, a nonprofit led by Anne Wojcicki, who co-founded 23andMe and had been its CEO. The bankruptcy court in the Eastern District of Missouri approved the sale that summer over privacy objections from multiple states, and it closed in July.
There's a part that cuts the other way, though, and you should know that, too.
TTAM committed to continuing the existing deletion and research opt-out policies. In approving the sale, the judge found that customers were "likely to have the same or better experiences (with respect to privacy and otherwise) with TTAM as they have with the Debtors today". Roughly 1.9 million users deleted their data during the proceedings, which means the delete button mostly worked.. And in July 2026, a settlement with forty-two state attorneys general confirmed that deletion rights survived both the bankruptcy and the change in ownership. As corporate collapses go, this one landed about as softly as it could have.
That's exactly why it's the useful example. Nobody had to act in bad faith for fifteen million genomes to change hands. A privacy promise is a statement about what an organization currently intends, and current intentions are not among the things that survive a Chapter 11 filing. The entity you consented to is not guaranteed to be the entity holding the sample in ten years. For your own data, that's a risk you accepted. For a child's, it's a risk you accepted on their behalf, for a period you can't see the end of.
The Law Has a Loophole
There is a federal genetic nondiscrimination law, but it's fairly narrow. The Genetic Information Nondiscrimination Act (GINA) prohibits health insurers and employers with fifteen or more employees from using genetic information against you. It does not cover life insurance, disability insurance, or long-term care insurance.
| Context | Covered by GINA? |
|---|---|
| Health insurance | Yes |
| Employment, 15+ employees | Yes |
| Life insurance | No |
| Disability insurance | No |
| Long-term care insurance | No |
For an adult shopping for term life next spring, that gap is a known risk you can reason about. For a four-day-old, it's a forty-year exposure to three markets they will need to enter at roughly the same stage of life when a genetic marker starts to matter. Whatever underwriting looks like in 2044, the sample taken this week will still be a match.
Where I Stand: Autistic Kids and Genetic Research
If your child is Autistic, you might have been asked to contribute their DNA to research. Possibly more than once.
I'll say where I stand before I get into the mechanics, because pretending to be neutral here would be dishonest. I'm Autistic. Under our current sociopolitical climate, I'm against genetic research on Autistic people. We haven't reached the point where our institutions treat Autistic people as a variation rather than a defect, and I hold the social model of disability: disability is produced by the environment, not the person. So, who holds the genetic data, what they say they're looking for, and what becomes of that data in forty years is all a huge risk. If we want to learn more about Autistic people, we need to first ask them about their experience.
SPARK is the largest study of Autistic people ever conducted, with more than 400,000 participants. Its mission, in its own words, is to "improve the lives of people with autism by identifying the causes of autism and informing more effective therapies, treatments, services, and supports." That sentence makes my stomach turn. Sit with "identifying the causes." Cause is a prelude. You don't fund cause research at that scale to arrive at acceptance.
This isn't hypothetical, and it isn't fringe. Spectrum 10K launched in the UK in 2021 to collect DNA from 10,000 Autistic people and their families. It was paused inside of three weeks after an Autistic-led boycott raised eugenics and consent objections and pointed out that almost nobody had asked Autistic people first. The study's own website had to state that it "does not aim to eradicate autism." When a genetics project has to put that in writing, the community it wants to study has already told you what it hears in the mission statement. The study never restarted.
There's a reason the word "causes" sets off alarms, and it isn't speculative.
In 1971 the Black Panther Party started a national sickle cell screening program, sending trained volunteers door to door in Black neighborhoods with free finger-stick tests, because the medical establishment had spent sixty years ignoring a disease that mostly affected Black people. Screening was something the community organized for itself. Then states began mandating it, and Congress passed the National Sickle Cell Anemia Control Act of 1972 to force testing back to voluntary.
What happened next had nothing to do with why anyone started testing. The Air Force Academy barred applicants who carried the trait and didn't drop the ban until 1981. Some airlines refused to hire carriers as pilots or flight attendants. Healthy adults with one copy of a gene, shut out of work over a marker, in part because the programs never explained the difference between the trait and the disease. GINA's own text names this history as part of why the law had to be written. The data was collected for one reason and used for another. That's the part that repeats.
Then there's the question of what the research is for. Ask Autistic adults what they want researched and you get services, healthcare that doesn't dismiss them, employment support, communication access, and somewhere to live. Genetics and biology land near the bottom. Analyses of UK funding found roughly 5% going to services and about 2.5% to lifespan issues, and one review found only 27% of funding went to the top ten priorities the community itself named. A portfolio analysis in New Zealand found the same skew toward biology, "at odds with the priorities expressed by autistic and autism community members."
Nobody has to be acting in bad faith for that gap to exist. It exists because the people setting the agenda aren't the people being studied.
SPARK is not Autistic-led. It's run by a foundation, staffed by researchers, and legal guardians enroll their dependents. Everything in this article about the 23andMe bankruptcy applies here at full strength, and probably more, because a research biobank holding hundreds of thousands of genomes from one identifiable population is exactly the dataset you'd least want changing hands. Not because anyone currently holding it means harm. Because it will outlast them, their funding, and the institutional norms they operate under, and it isn't a collection you can reassemble consent for later.
I'm not going to pretend I don't understand why parents enroll. Parenting an Autistic child can be challenging to say the least. You want answers, and a researcher who seemed to genuinely care asked you nicely during a hard year. But your child gets a vote on this eventually, they can withdraw from a study and never unsequence a genome, and a systematic review of the literature found that Autistic adults report strong concerns about exactly this: testing done without their consent, and discriminatory use of the results.
I'll go even deeper in the upcoming Part IV about neurodivergence and medical data specifically.
What I'd Actually Want to Know
Here are five things worth doing for your own family.
Look up your state's blood spot retention policy. Search your state health department for "newborn screening blood spot retention." The range runs from ninety days to indefinitely, and most states have a destruction request process that almost nobody uses.
Delete the account anyway, and don't believe it's gone. Deletion is worth doing. Around 1.9 million people did it during the bankruptcy, and the state settlement confirmed the right survives an ownership change. Read the fine print, though: 23andMe's privacy statement says most of your information is permanently deleted, while the company and its lab keep some of it, genetic information included, for legal compliance. Download your raw data first if you want a copy, delete the account, then request sample destruction as a separate step. Then assume a copy exists somewhere regardless. Once data is created, the honest position is that you can never confirm its absence.
Ask the prenatal lab what happens to the cfDNA after the report. In writing. Retention period, research use, third-party sharing. You may not get a clean answer, and the answer you get is still information.
Treat the gift kit as a family decision. Because it is one, whether or not anyone frames it that way. One person's results are partly everyone's results.
Leave your child a record. A note in the family password manager listing what was collected, by whom, and when. At eighteen they can act on it. Without the list, they won't know there's anything to act on.
2044
A kid born this week turns eighteen in 2044. Nobody can know what genetic data will be worth then, who will hold it, which companies will still exist, or what the law will say. This is a theme I keep returning to, because it's the honest answer about almost every technology I write about here. The difference with this one is that the unknown doesn't apply to the sample. That part is already decided.
