Two different things get stored
There is the physical sample, the saliva tube itself, and there is the digital genotype file the lab produces from it. They are governed separately, and the settings that control them are usually in different parts of the account.
Most services let you decline biobanking, meaning they process the sample and destroy it rather than storing it. This is normally a checkbox at registration, and it is easy to miss.
The digital file is the part that persists. It is small, it is exportable, and once you have downloaded it, copies exist outside the company's control, including any third-party site you upload it to.
What research consent actually authorises
Every major service asks whether your de-identified data may be used in research, often including partnerships with pharmaceutical companies. It is opt-in, it is genuinely optional, and the test works identically if you decline.
De-identified is doing real work in that sentence. Genetic data is inherently identifying in a way that a stripped name field does not undo, and researchers have repeatedly shown that anonymised genomic data can be re-linked to individuals given enough auxiliary information.
Withdrawing consent stops future use. It does not retract data already included in completed studies, because those datasets have left the building. Read the withdrawal clause before opting in, not after.
The relative problem
You share roughly half your DNA with a parent, a child or a sibling, and meaningful fractions with cousins you have never met. Testing yourself exposes probabilistic information about all of them, and none of them were asked.
This is not theoretical. Investigators have identified suspects by matching crime-scene DNA to distant relatives in consumer genealogy databases, which means a database becomes searchable for people who never joined it.
The relative-matching feature is also how the surprises happen: undisclosed adoptions, misattributed parentage, half-siblings. If those possibilities would be destabilising for your family, that is a reason to think before testing, not a reason to assume it will not happen.
Law enforcement, insurers and employers
Access policies differ sharply by company, and the difference is a legitimate reason to pick one over another. Some require a warrant and publish a transparency report; others operate opt-in matching for law enforcement searches; a few are open by default. Check the current policy rather than what you remember reading.
In the United States, GINA restricts the use of genetic information in health insurance and employment. It does not cover life insurance, disability insurance or long-term care insurance, which is the gap people are most surprised by. Rules elsewhere differ, so check your own jurisdiction.
Company ownership can change, and privacy policies change with it. Bankruptcy proceedings have already raised the question of what happens to a genetic database as an asset. Assume today's policy is a statement of intent, not a permanent guarantee.
Deleting your data, properly
Deletion is a real right at the major services, and it is a two-part job. Delete the digital account and data through the account settings, and separately instruct the lab to destroy the stored sample if you consented to biobanking.
Expect exceptions. Companies generally retain some minimum record of the transaction for legal and regulatory reasons, and, as above, data already in completed research is not clawed back.
If you uploaded your raw file to a third-party matching or health-interpretation site, delete it there too. That copy is subject to that site's policy, not the one you bought the test from.
Take the confirmation email and keep it. It is the only evidence the request was made.
Settings to change before you post the sample
Decline sample storage unless you specifically want it. Decline research consent unless you have read what it covers and want to participate.
Turn relative matching off, or set it to display without contact, if you do not want to be discoverable. You can enable it later once you have decided.
Use a strong unique password and turn on two-factor authentication. A genetics account is a high-value target and reusing a password here is a poor trade.
Then choose on policy as well as features: our DNA testing comparison covers what each service stores and how it handles requests, with AncestryDNA (9.6/10) and 23andMe (9.2/10) taking noticeably different approaches to matching and research.