Obtaining a DNA sample from a cheek swab is one way the International Olympic Committee plans to screen female athletes to ensure those competing are “limited to biological females.” 

Last month, the International Olympic Committee formally announced that all female athletes wishing to compete in the 2028 Los Angeles Games must undergo genetic sex testing. Eligibility for the Games will be determined by a one-time SRY gene screen via saliva, cheek swab or blood sample to ensure that those competing are “limited to biological females.” 

The committee calls this testing “unintrusive compared to other possible methods” and describes it as a one-time screen. But the SRY gene screen also generates a permanent biological sample, a processed genetic result and a stored eligibility determination. What the committee has not described is any public standard governing what happens to any of those things once collected.

Get Digital Access and Stay Informed With Trusted Local News.

Get Digital Access and Stay Informed With Trusted Local News.

As former FBI Director Robert Mueller once warned, “There are only two kinds of companies: those that have been hacked and those that will be.” In 2023, hackers targeted 23andMe, exposing the genetic data of nearly 7 million users, including batches advertised on dark web forums of Ashkenazi Jews and people of Chinese descent, raising immediate concerns about ethnically targeted attacks. Two years later, the company filed for bankruptcy. 

Article continues below this ad

The federal courts, including the 8th Circuit Court of Appeals, also declined to block the sale of 23andMe’s data to a new owner. As a result, consumers lost control of their most personal biological information even though laws like California’s Genetic Information Privacy Act had been passed to prohibit that outcome. 

Now, the International Olympic Committee is building repositories of genetic samples and data on a global scale — and is offering athletes even fewer protections. 

See more S.F. Chronicle on Google

In the 1990s, the committee used a version of genetic sex testing before abandoning it as scientifically unreliable and harmful, subjecting athletes with natural chromosomal variations to disqualification and public stigmatization. That choice led some athletes to withdraw from competition. The medical literature concluded that such athletes did not possess an unfair competitive advantage over other women. The committee discontinued the practice in 1999, citing medical inconsistencies, discriminatory effects and undue costs.

World Athletics, the international governing body for track and field and other sports, had already moved ahead independently, implementing mandatory SRY gene testing for elite female competitors in September 2025. The SRY gene, found on the Y chromosome, triggers male embryonic development. The International Olympic Committee’s announcement brings the Games in line with that existing infrastructure and scales it to every female athlete seeking to compete in Los Angeles and beyond.

Article continues below this ad

American regulators have spent years establishing baseline protections for genetic data in the commercial testing industry. The Federal Trade Commission has taken action against companies for failing to secure genetic data, deceiving customers about deletion practices and changing privacy policies without notice. In one settlement, laboratories were required to destroy consumer DNA samples retained for more than 180 days. Federal and state law requires express consent before genetic data is collected or transferred and gives consumers the right to demand destruction of their biological samples. No comparable rights are publicly guaranteed to athletes. No clear deletion right. No enforceable destruction right. No explanation of what happens to the sample once testing is complete.

The consent problem runs deeper still. Switzerland’s Federal Act on Human Genetic Testing requires free and express consent covering not only the purpose of testing but also how samples and data will be handled afterward, limits storage to what is strictly necessary and demands separate consent for any secondary use. European Union data-protection obligations may also arise depending on where processing occurs. Consent obtained under threat of losing Olympic eligibility is hard to treat as freely given.

Genetic data is not like other data. It does not just identify the athlete; it implicates every biological relative, parents, siblings, children and generations not yet born. And even a narrow test requires a physical, biological sample. What happens to that sample afterward, whether it is destroyed, retained or reused, is not publicly specified.

Sports federations are building repositories of this material without published security standards, without retention limits, and without independent oversight. When a federation collapses or loses recognition, there is no court supervising the process, no ombudsman weighing privacy interests, no attorney general with standing to intervene. 

The Olympic Charter routes their disputes to the Court of Arbitration for Sport, a private arbitration body designed for eligibility and doping cases, not for enforcing data-protection standards.

Guest opinions in Open Forum and Insight are produced by writers with expertise, personal experience or original insights on a subject of interest to our readers. Their views do not necessarily reflect the opinion of The Chronicle editorial board, which is committed to providing a diversity of ideas to our readership.

Read more about our transparency and ethics policies

If the International Olympic Committee proceeds with this new policy, it must commit to destroying biological samples and genetic data once eligibility is determined, ban secondary uses, require independent oversight with real enforcement authority, and publish security standards with breach notification requirements. These are the same protections federal regulators have demanded from commercial genetic testing companies for years. Neither the committee nor World Athletics has publicly committed to any of them.

The Los Angeles Games are less than two years away. Athletes are already submitting biological samples under rules that offer fewer protections than U.S. law guarantees to anyone who orders a DNA kit online. The concern is not hypothetical. A breach, a contractor acquisition or an institutional collapse could expose that information to insurers, employers or foreign governments with no legal remedy in sight. That is not an oversight. It is a governance failure, and one that will be very difficult to undo once the repositories exist.

Dov Greenbaum is a research affiliate in molecular biophysics and biochemistry at Yale University and the director of the Zvi Meitar Institute for Legal Implications of Emerging Technologies.

© San Francisco Chronicle