Is It Safe to Upload Your Raw DNA to ChatGPT?

Updated October 2026 with ChatGPT Health, the sale of 23andMe, and ChatGPT's current privacy settings.

ChatGPT has written poems, debugged code, and planned vacations. So when you're looking at a file full of your DNA, it's natural to wonder: what would happen if I dropped this into the chatbot too? The file looks like a jumble of letters, but it's one of the most personal records you'll ever have.

If you're weighing it up, we'd keep the file out of the chat. ChatGPT isn't built to read a raw DNA file reliably. Anything you upload or type in can be kept, and it can be used to train future models unless you change a setting. And DNA can't be made anonymous once it's out, because it's unique to you and shared with your family.

What a Raw DNA File Actually Is

A raw file from 23andMe, Ancestry, or MyHeritage lists hundreds of thousands of letters (A, C, G, T) at set spots in your genome. Each spot is a SNP (pronounced "snip"), a place where people's DNA commonly differs by a single letter. The National Human Genome Research Institute (NHGRI) notes that genetic testing companies can use information like this to tell you about your genetic ancestry or your possible risk for certain health conditions. It's also what nutrigenomics uses to look at how your genes shape your response to food and nutrition. It's a plain text file, so you can also check it for a specific marker yourself.

NHGRI is just as clear about the privacy side: "each person's DNA sequence is unique, which means a DNA sample can never be truly anonymized." What looks like harmless text is a permanent identifier, and that matters once you think about where you share it.

Why ChatGPT Can't Reliably Read Your DNA File

It's tempting to treat ChatGPT as a universal explainer. But a chatbot is trained to predict words. Making sense of a raw DNA file means checking hundreds of thousands of genotypes against curated research and weighing them together, and a general chatbot isn't built or tested for that job.

The evidence on accuracy is still thin. We haven't found a published study that tests chatbots on consumer raw DNA files. The closest is a 2025 benchmark in The Pharmacogenomics Journal, which asked large language models, including GPT-4o, to reproduce established gene-and-drug guidelines across 599 scenarios. The authors found that "general-purpose models frequently produced incomplete or unsafe outputs." That's a narrower task than reading a whole file.

A wrong answer here has consequences. If a chatbot mislabels a variant or suggests a supplement plan with no basis, you can end up falsely reassured or worried for nothing. And even if it read your file perfectly, there's still the question of what happens to the file after you hit enter.

What Happens to Data You Put Into a Chatbot

OpenAI's privacy policy says it uses the content you share "to improve and develop our Services and conduct research." Here's what that means in practice, based on OpenAI's own help pages:

• Training is on by default. Your chats can be used to train future models unless you turn off "Improve the model for everyone" in Settings under Data controls.
• Temporary Chat helps, but not completely. Temporary chats don't appear in your history and aren't used for training, but OpenAI may keep them for up to 30 days for safety reasons.
• Deleting a chat takes time. Deleted chats are scheduled for removal within 30 days, unless OpenAI has to keep them longer for security or legal reasons.
• Legal holds happen. During the New York Times lawsuit, a court order required OpenAI to keep ChatGPT conversations it would normally have deleted. OpenAI says that obligation ended on September 26, 2025, but it is still storing a limited set of user data from April to September 2025.

Companies have learned this the hard way. In 2023 Samsung banned staff from using ChatGPT and similar tools after an employee uploaded sensitive internal code. TechCrunch and Bloomberg both reported that Samsung's internal memo warned the data was stored on outside servers, was hard to retrieve and delete, and could end up being shown to other users. If a global company can't pull its data back, one person uploading a genome has even less control.

What About ChatGPT Health?

In January 2026 OpenAI announced ChatGPT Health, a separate space for health questions. On July 23, 2026 it began rolling out to adults in the United States. You can connect supported medical records and Apple Health data, and OpenAI says "connected medical records and Apple Health information, and conversations that use it, are not used to train our foundation models or target ads."

That promise is specific. It covers connected medical records and Apple Health data, and OpenAI's announcements don't mention raw DNA files at all. OpenAI's Health help page adds that conversations that don't use connected data follow your standard model-training setting. So a DNA file you upload to an ordinary chat falls under the normal ChatGPT settings above. Health is also US-only for now, and it wasn't offered in the EU, Switzerland, or the UK at launch.

Why "Anonymous" DNA Usually Isn't Anonymous

It's common to assume that if your name isn't attached, your DNA is safe to share. Research says otherwise. Name-free files can often be traced back to a person, or to their relatives, through patterns in the data.

• In 2013, researchers (Gymrek et al., Science) re-identified people from supposedly anonymous DNA by using Y-chromosome markers to infer surnames through genealogy databases.
• A 2024 scoping review in JMIR Bioinformatics and Biotechnology notes that a genetic database only needs to cover about 2% of a population to find a third-cousin match for nearly anyone.
• The European Data Protection Board said in 2021 that whether genetic data can be anonymized at all "remains an unresolved issue."
• Because you share DNA with your parents, siblings, and children, your file also says something about people who never agreed to share it.

A file without your name on it is still a personal identifier, for you and for your family.

What the Law Does and Doesn't Protect

Many people assume strict laws protect genetic data automatically. Protection depends on where you live and who is handling the data. In the US, HIPAA and GINA don't cover you uploading DNA to ChatGPT. In the EU, GDPR sets a high bar but wasn't written with chatbots in mind.

In the United States:

• HIPAA protects health information only when it's held by covered entities like hospitals, health plans, and their partners, according to the U.S. Department of Health and Human Services (HHS). A chatbot company you share a file with isn't one of them. Even HHS's own de-identification guidance admits "there is a possibility that de-identified data could be linked back to the identity of the patient."
• The Genetic Information Nondiscrimination Act (GINA) limits how health insurers and employers can use your genetic information. It isn't a privacy law. As NHGRI puts it, "no federal laws prohibit companies from providing individuals' genetic information to third parties."
• In 2023 the FTC charged 1Health.io (formerly Vitagene) with leaving nearly 2,400 health reports and the raw genetic data of at least 227 consumers in publicly accessible cloud storage, and with deceiving people about getting their data deleted. The company agreed to pay $75,000, and the FTC finalized the order in September 2023.
• New federal bills such as the Genomic Data Protection Act and the Don't Sell My DNA Act were introduced in 2025 but haven't passed. Several states moved faster, with Montana and Texas among those that enacted genetic privacy laws in 2025.

In the European Union and UK:

• The General Data Protection Regulation (GDPR, in force since 2018) treats genetic data as a special category that needs extra safeguards. The EDPB has also confirmed that pseudonymized data, where names are swapped for codes, still counts as personal data.
• In June 2025 the UK Information Commissioner's Office fined 23andMe more than £2.3 million for failing to protect the personal information of more than 150,000 UK residents in its 2023 breach.

None of these rules stops you from handing your own file to a chatbot. Once you do, you're relying on that company's settings and policies.

What Recent Breaches and Sales Show

It's easy to think "this won't happen to me," but DNA companies have already lost control of genetic data, and one has changed owners.

• In December 2023, 23andMe admitted that hackers had reached about 14,000 accounts directly, including raw genotype data and health reports. Through its relative-matching feature, profile and ancestry information for about 6.9 million people was exposed (The Guardian).
• Months earlier, in October 2023, a hacker had offered to sell names, addresses, and ancestry details reportedly belonging to 1 million 23andMe customers of Ashkenazi Jewish heritage (The Guardian).
• In March 2025, 23andMe filed for bankruptcy. California's Attorney General urged customers to consider deleting their data, and about 1.9 million people, roughly 15% of customers, asked for their genetic data to be deleted (TechCrunch). More than two dozen states sued over the sale. In July 2025 the company was sold for $305 million to TTAM Research Institute, a nonprofit led by co-founder Anne Wojcicki.

If dedicated DNA companies can lose control of genetic data, or be sold along with it, a general chatbot isn't a safer place for your file.

What To Do Instead

You don't have to ignore your data to keep it safe. The goal is to keep control local, keep the number of copies small, and think about your family as well as yourself.

• Use tools that analyze your file on your own device. Our guide to on-device versus upload-based DNA tools walks through how to tell the difference.
• Keep one encrypted master copy. Work from a duplicate and delete it when you're done.
• Don't sync your raw file to cloud storage. If you have to, use a strong password and two-factor authentication.
• Use neutral filenames. Leave your name and birthdate out of them.
• Read the privacy policy before you share. Look for clear statements on how long data is kept, who it's shared with, whether it's used for training, and how deletion works.
• Already uploaded your DNA to ChatGPT? Delete the chat, which OpenAI says removes it from its systems within 30 days, and turn off "Improve the model for everyone" so future chats aren't used for training.

A Better Path

You don't have to choose between privacy and learning from your DNA. On-device analysis means the work happens on your computer instead of a company's server.

Noorns reports work that way. Your file is read in your browser, and your DNA never leaves your computer. Your DNA file is never uploaded or stored. The report shows which foods and vitamin forms are most likely to help you, and which matter less, based on your genes and the published research behind each gene and nutrient link.

See how private DNA analysis works →

Frequently Asked Questions

Can ChatGPT analyze my 23andMe or Ancestry raw data?

It can open a text file and talk about what's in it, but it isn't a tested tool for interpreting genotypes, and a 2025 benchmark found general-purpose models often gave incomplete or unsafe answers on a related genetics task. The file also stays in your chat history under OpenAI's normal data rules.

Does ChatGPT Health keep my DNA file private?

OpenAI's promise not to train on health data covers connected medical records and Apple Health data, and the conversations that use them. Its announcements don't mention raw DNA files, and OpenAI's help page says conversations that don't use connected data follow your standard ChatGPT training setting.

Why isn't DNA anonymous if my name isn't attached?

Your DNA is unique and shared with relatives, so it can often be matched back to you through genealogy databases. Europe's data protection regulators still call anonymizing genetic data an unresolved issue.

Does HIPAA or GDPR protect me if I share DNA with ChatGPT?

Generally not HIPAA, which only covers hospitals, health plans, and their partners. GDPR treats genetic data as specially protected, but when you choose to upload it to a chatbot, you're relying on that company's settings and policies.

I already uploaded my DNA to ChatGPT. What should I do?

Delete the conversation and turn off "Improve the model for everyone" in Settings under Data controls. OpenAI says deleted chats are removed from its systems within 30 days, unless it has to keep them for security or legal reasons.

What should I do instead of putting my DNA into AI?

Use tools that analyze DNA on your own device, keep one encrypted master copy, avoid cloud syncing, and read privacy policies before you share.

References

• National Human Genome Research Institute (NHGRI). Privacy in Genomics. Updated February 6, 2024.
• Zack M, et al. Benchmarking large language models for replication of guideline-based PGx recommendations. The Pharmacogenomics Journal. 2025.
• OpenAI. Privacy Policy. Updated February 6, 2026.
• OpenAI Help Center. Data controls in ChatGPT.
• OpenAI Help Center. Chat and file retention policies in ChatGPT.
• OpenAI. How we're responding to The New York Times' data demands. June 5, 2025, updated October 22, 2025.
• OpenAI. Introducing ChatGPT Health. January 7, 2026.
• OpenAI Help Center. ChatGPT release notes: Health in ChatGPT. July 23, 2026.
• OpenAI Help Center. Health in ChatGPT. Accessed October 3, 2026.
• TechCrunch. Samsung bans use of generative AI tools like ChatGPT after April internal data leak. May 2, 2023.
• Bloomberg. Samsung bans ChatGPT and other generative AI use by staff after leak. May 2, 2023.
• Gymrek M, et al. Identifying Personal Genomes by Surname Inference. Science. 339(6117):321-324, 2013.
• Thomas M, Mackes N, Preuss-Dodhy A, Wieland T, Bundschus M. Assessing Privacy Vulnerabilities in Genetic Data Sets: Scoping Review. JMIR Bioinformatics and Biotechnology. 2024.
• European Data Protection Board (EDPB). Response to the European Commission on the consistent application of the GDPR, focusing on health research. February 2, 2021.
• U.S. Department of Health and Human Services (HHS). Summary of the HIPAA Privacy Rule. Reviewed March 14, 2025.
• HHS. Methods for De-identification of PHI. Reviewed February 3, 2025.
• Federal Trade Commission (FTC). FTC says genetic testing company 1Health failed to protect privacy and security of DNA data. June 16, 2023.
• FTC. FTC finalizes order with 1Health.io. September 7, 2023.
• GovTrack. Genomic Data Protection Act (S. 863). Introduced March 5, 2025.
• GovTrack. Don't Sell My DNA Act (S. 1916). Introduced May 22, 2025.
• Covington, Global Policy Watch. Multiple States Enact Genetic Privacy Legislation in a Busy Start to 2025. June 2025.
• The Guardian. Genetic testing firm 23andMe admits hackers accessed DNA data of 7m users. December 5, 2023.
• The Guardian. Hackers got nearly 7 million people's data from 23andMe. The firm blamed users in "very dumb" move. February 15, 2024.
• The Guardian. DNA testing firm 23andMe fined £2.3m by UK regulator for 2023 data hack. June 17, 2025.
• California Attorney General. Consumer alert to 23andMe customers. March 21, 2025.
• TechCrunch. 23andMe says 15% of customers asked to delete their genetic data since bankruptcy. June 11, 2025.
• OPB. Judge OKs sale of 23andMe to a nonprofit led by its founder. July 1, 2025.