While genetic ancestry services like 23andMe offer some value in terms of tracing lineage and discovering potential health risks, they also come with considerable privacy risks. With the growing number of data privacy laws and the lack of comprehensive healthcare privacy protections, users need to weigh the benefits against the long-term potential risks. The current struggles of 23andMe demonstrate the instability that can affect these companies, making consumer data privacy an ongoing concern.

Considerations Before Using Ancestry Tracking Companies:

• Privacy Regulations Are Not Uniform: Without universal healthcare protections, genetic data can be more easily exploited if privacy policies change.
• Data Sharing Can Go Beyond Your Consent: Ownership transfers and financial challenges could lead to data sharing or monetization with third parties.
• Long-Term Consequences Are Uncertain: Sharing personal genetic information is an irreversible step with potential future implications for family members and descendants.
• Account Deletion Requires Diligence: While deletion is an option, it’s on consumers to ensure they follow the proper steps, and deleted data may still be in research use.

23andMe, once a pioneer in consumer genetic testing and ancestry tracing, is currently facing significant financial and structural challenges, casting doubt on its future stability. As the company restructures, cutting 40% of its workforce after a mass board resignation in September, its stock continues to plummet, raising both financial and privacy concerns among users. The question of what might happen to the sensitive genetic data of its 15 million users, especially if the company changes ownership, has heightened consumer anxiety. Here’s an in-depth look at the concerns and why potential users may want to be cautious before opting for such services.

1. Privacy Concerns and Weak Health Protections

Unlike traditional healthcare companies, consumer-based genetic testing services like 23andMe are not subject to stringent health privacy laws. As a result, users’ personal genetic data does not fall under the same legal protections afforded to medical records. This regulatory gap means that in the event of a sale or acquisition, a new owner could potentially access or even monetize this genetic data under the existing user agreements. Though the current policy requires users to opt in for data sharing, a transfer of ownership could lead to revised privacy policies, leaving sensitive data vulnerable.

2. Financial Instability and Potential Acquisition Risks

Given 23andMe’s precarious financial position, with substantial losses over the last two years and further quarterly declines, rumors of a potential acquisition are mounting. For users, this prospect raises serious questions: what happens to their genetic data if the company is sold? While CEO Anne Wojcicki has announced plans to take the company private and has ruled out third-party offers, there’s no guarantee that this stance will remain unchanged. If acquired, the company’s most valuable asset—its massive genetic database—could be used in ways beyond the original purpose, with consumers’ sensitive data potentially up for negotiation in such a deal.

3. Uncertain Data Protections and Ownership Concerns

Under the current user agreement, customers consent to 23andMe’s use of their DNA data, with 80% of users opting into the company’s research program. While the company states that this data is anonymized, privacy experts warn that anonymized genetic data can still be re-identified with advanced technology. Further, state privacy laws in at least 11 U.S. states require consumer consent for genetic data transfers. However, there are no federal protections in place, leaving privacy regulations largely dependent on individual state laws, which could create loopholes in the event of an acquisition.

4. Minimal Consumer Benefits for Privacy Trade-Off

Many consumers purchase genetic testing kits for a one-time ancestral insight, a convenience that is hardly worth the ongoing risks. Given the minimal benefit beyond curiosity about lineage, these services come at a high privacy cost. Personal genetic data can be revealing not just about an individual’s health predispositions, but about entire family histories and future generations, raising ethical concerns about the long-term consequences of sharing this data.

5. Data Deletion is Possible, But Cumbersome

Users concerned about the privacy of their genetic data do have the option to delete their accounts, which 23andMe states can be done through account settings. The deletion process involves submitting a request and confirming it via email, after which the company claims to destroy the user’s genetic sample and personal information. However, this option places the burden on the consumer to safeguard their data, and does not erase data that may already be anonymized and in use for research purposes.

Should You Avoid Genetic Ancestry Services?

While genetic ancestry services like 23andMe offer some value in terms of tracing lineage and discovering potential health risks, they also come with considerable privacy risks. With the growing number of data privacy laws and the lack of comprehensive healthcare privacy protections, users need to weigh the benefits against the long-term potential risks. The current struggles of 23andMe demonstrate the instability that can affect these companies, making consumer data privacy an ongoing concern.

Considerations Before Using Ancestry Tracking Companies:

• Privacy Regulations Are Not Uniform: Without universal healthcare protections, genetic data can be more easily exploited if privacy policies change.
• Data Sharing Can Go Beyond Your Consent: Ownership transfers and financial challenges could lead to data sharing or monetization with third parties.
• Long-Term Consequences Are Uncertain: Sharing personal genetic information is an irreversible step with potential future implications for family members and descendants.
• Account Deletion Requires Diligence: While deletion is an option, it’s on consumers to ensure they follow the proper steps, and deleted data may still be in research use.

For those who value privacy, the current state of 23andMe serves as a warning to consider whether the benefits of a genetic ancestry service are worth the potential risks to personal data. As privacy laws evolve and companies face economic challenges, consumer data may be one of the first assets on the negotiation table.

https://www.cbsnews.com/news/23andme-data-sale-genetic-testing-what-to-know/