As quickly because the genetic testing firm 23andMe filed for chapter on March 23, 2025, issues about what would occur to the non-public data contained in its huge genetic and well being data database had been swift and widespread. A number of days after, a U.S. decide dominated that the corporate might promote its shopper knowledge as a part of the chapter.
The attorneys normal of a number of states warned their residents to delete their genetic knowledge. California urged its residents to request that 23andMe delete their knowledge and destroy their spit samples. Michigan’s lawyer normal launched an announcement warning that “23andMe collects and stores some of the most sensitive personal information, our genetic code.”
When clients initially signed up for 23andMe, they agreed to phrases and situations and a privateness discover that permits the corporate to make use of their data for analysis and growth in addition to share their knowledge, in mixture, with third events. If shoppers consented to further analysis, which the overwhelming majority did, the corporate can moreover share their particular person data with third events. 23andMe has additionally been clear that whether it is concerned in a chapter or sale of property, shopper data could be bought or transferred.
Whereas 23andMe has warned clients all alongside about every thing that’s at present taking place, many are nonetheless stunned and anxious.
I’m a lawyer and bioethicist who has been finding out direct-to-consumer genetic testing for nearly a decade. Understanding what data 23andMe has been gathering, and the way it could be used if bought or shared, may also help make clear issues for shoppers.
What’s 23andMe?
In 2007, 23andMe, named after the 23 pairs of chromosomes present in a human cell, was one of many first direct-to-consumer genetic testing corporations to open in america. It was backed by a big funding by Google, which shortly attracted the curiosity of different traders, permitting 23andMe to thrive when many different direct-to-consumer genetic corporations went shortly out of enterprise.
The direct-to-consumer enterprise mannequin is pretty simple: A shopper orders a genetic check package on-line, spits right into a tube that comes within the mail, returns it to the corporate and accesses their ends in a web based portal. Over 15 million shoppers purchased 23andMe, and the overwhelming majority consented to its analysis. At its peak, the corporate was valued at US$6 billion.
The destiny of the trove of non-public data 23andMe has gathered through the years has wide-ranging implications for shoppers.
Whereas the market initially believed within the worth of 23andMe’s enterprise mannequin, its inventory has been in decline for years, and the corporate owes tons of of tens of millions of {dollars} to collectors.
Causes for this fast decline embody a lower within the sale of check kits after a 2023 hack of just about 7 million individuals’s knowledge, in addition to a failure to revenue sufficient from offering knowledge entry to different non-public sector corporations. Lack of personal curiosity in 23andMe knowledge could also be associated to the truth that a lot of the knowledge the corporate collects is self-reported, which is usually thought of much less dependable than data written down by a physician in a medical document.
What sort of knowledge does 23andMe acquire?
Whereas the saying goes “If you’re not paying, you’re the product,” 23andMe managed to persuade its shoppers to each pay for AND be the product. It did this by promoting genetic testing kits to shoppers in addition to gathering a large quantity of their useful knowledge.
And 23andMe collected extra than simply genetic knowledge generated from shoppers’ spit. Eighty-five p.c of shoppers consented to 23andMe analysis, permitting their individual-level knowledge for use for research. The corporate then collected data from survey questions on their private well being and past, equivalent to ingesting habits and danger tolerance.
Which means that not solely does 23andMe possess the genetic knowledge of 15 million individuals, but it surely additionally possesses virtually a billion further knowledge factors related to this genetic data. This makes the 23andMe dataset probably very non-public – and really useful.
At first, drug corporations appeared to agree. For instance, in 2018, 23andMe granted pharmaceutical firm GlaxoSmithKline an unique license to make use of consented buyer knowledge to develop new medicine. GlaxoSmithKline additionally made a $300 million fairness funding in 23andMe. When 23andMe went public in 2021, its $6 billion valuation mirrored the promise of this enterprise mannequin.
However for over a decade, students, together with me, have been warning that permitting 23andMe to gather and use private knowledge was not one which clients totally understood, or had been truly snug with.
What ought to 23andMe clients fear about?
In response to present public concern about knowledge privateness, 23andMe has said that there shall be no adjustments to the way it shops and protects knowledge throughout its chapter proceedings. However as soon as that stage is thru, what precisely ought to clients fear about?
First, regulation enforcement might use genetic data in civil or felony instances. This occurred in 2018, when police used the genetic testing firm GEDmatch to assist determine the Golden State Killer. Police pretended they had been clients searching for family tree knowledge and despatched in an previous crime scene blood spot. This allowed them to connect with identified suspects with blood relations who had given their genetic data to the corporate as shoppers. Whereas this was in violation of GEDmatch’s personal insurance policies, the proof was efficiently utilized in courtroom.
Second, genetic data may very well be used to discriminate towards clients if it reveals that they’ve or are at excessive danger of growing a genetic illness or dysfunction. The federal Genetic Data Nondiscrimination Act prohibits well being insurers and employers from asking about genetic data or utilizing it to discriminate in work or medical health insurance choices. It doesn’t, nonetheless, shield towards discrimination in long-term care or life insurance coverage.
Giving somebody your genetic, medical and private data provides them alternatives to take advantage of you.
Westend61/Getty Photographs
Lots of the warnings from the media and attorneys normal are targeted on genetic data as a result of it’s distinctive to just one individual. However direct-to-consumer genetic testing corporations additionally retain a large quantity of non-public data from the surveys shoppers are requested to finish. A lot of this data may very well be embarrassing if it had been inadvertently or deliberately revealed, equivalent to an individual’s intelligence.
Within the 2025 e-book “Careless People,” former Meta government Sarah Wynn-Williams reported that Fb would use indications of self-consciousness about private look, equivalent to deleting a selfie, to advertise magnificence merchandise. If corporations know such intimate particulars about an individual, they may not solely be used to promote merchandise, but in addition probably manipulate them over social media or the web in methods they don’t even notice. It may very well be used for focused promoting or to construct algorithms that exploit an individual’s vulnerabilities.
I consider shoppers are proper to be frightened about how their genetic knowledge may very well be misused. However the survey knowledge containing all types of different private data are at the very least as a lot, if no more, of a privateness drawback. That is notably regarding if the information is pooled along with different data accessible on the web, like a courting profile, to create a extra detailed – and private – image of a person.
I’m deleting my very own 23andMe knowledge. Sooner or later, I might additionally warn shoppers towards freely gifting the non-public sector with details about their fears, hopes, limitations and successes.
That data is efficacious to extra individuals than simply you.
