23andme sells your results to life insurance, disability insurance, and and long-term care insurance companies, who use it to deny claims based on genetic information (which is legal under GINA). 23andme also gives your results to the feds for DNA evidence in cases, but usually only on a judge's order. Same for ancestry.com
People used to recommend Promethease, but they got bought by MyHeritage and send every result to them (unless you're in the EU), so they should be avoided, as well. The bottom line is that any non-medical private company is able to sell your results if they want to, or provide your results to law enforcement if they're compelled to.
If you're curious about what genetic diseases you and your family are at risk for, see a genetic counselor and your results' privacy will be protected by HIPAA, the strongest privacy protection that exists in the US.