Also, the chances of 23andMe getting hacked are much lower than the chances of your friendly neighborhood email marketing company. I know since I built the site.

I couldn't see anything that indicates this in their Privacy Policy. In fact https://www.23andme.com/about/privacy/#Full says:

Account Closure and Correction of Personal Information

As stated in the applicable Consent Document, however, Genetic Information and/or Self-Reported Information that you have previously provided and for which you have given consent to use in 23andWe Research will not be removed from ongoing or completed studies that use the information. Our contracted genotyping laboratory may also retain your Genetic Information as required by local law and we may retain backup copies for a limited period of time pursuant to our data protection policies. In addition, we retain limited Registration Information related to your order history (e.g., name, contact, and transaction data) for accounting and compliance purposes.

Doesn't look like they're interested in totally zero'ing you out of all of their records even if you explicitly request it (acquisition or not).

Business Transitions

In the event that 23andMe goes through a business transition such as a merger, acquisition by another company, or sale of all or a portion of its assets, your Personal Information will likely be among the assets transferred. In such a case, your information would remain subject to the promises made in any pre-existing Privacy Statement.

From their current privacy policy (https://www.23andme.com/about/privacy/?version=1.1):

Business Transitions

In the event that 23andMe goes through a business transition such as a merger, acquisition by another company, or sale of all or a portion of its assets, your personal information and non-personal information will likely be among the assets transferred. You will be notified in advance via email and prominent notice on our website of any such change in ownership or control of your personal information. We will require an acquiring company or merger agreement to uphold the material terms of this privacy statement, including honoring requests for account deletion.

I think khomenko is correct, with the exception you pointed out (ongoing studies).

related: http://www.quora.com/Is-it-possible-to-use-23andme-anonymous...

1) Mailbox in SF's China Town (a number don't ask for ID even though they're supposed to legally request it). Many also don't speak much English so if anyone comes to investigate good luck to them.

2) Visa/Amex gift card purchased at Walgreens/Safeway in cash - ideally in a different city you happen to be visiting with no connection in. Las Vegas and New York are great choices.

3) Email address created and accessed via TOR within the incognito mode of the browser. Buy the 23andMe subscription/domain/hosting in the same way but making sure you are using a different TOR session.

I've used fake whois records for a while and have never had any problems. I did make my main domain "real" a few years ago to avoid any problems, however.

even if you've ordered under your own name, doesn't this suggest you could just maintain plausible deniability? surely a DNA test can connect it to you- but that would nullify the "john doe" tactic as well, no?

It seems the simplest step to prevent 23AndMe being forced to give up your genetic data at some future dystopic point has already been taken: they already have no way of knowing if it's actually your data. You can take anyone's DNA and call it yours, or give anyone else's name to your own DNA.

the insurance company could simply acquire a dna sample from you and check whether there is a match in the database?

a hackernews reader: https://github.com/orta/dna