The announcement that 23andMe is filing for bankruptcy and has put its genetic genealogy database up for sale has sent its customers into a bit of a privacy tizzy . On March 21, California Attorney General Bob Bonta issued a consumer alert with detailed instructions about how to delete one's data .
Author
- Julia Creet
Professor of English, York University, Canada
23andMe and its databases are located in California; regardless of where customers live, privacy is then governed by California law and some weak U.S. federal laws. Canadian privacy laws have no sway in this case.
Rise of consumer genetic testing
It's worth backing up a bit to see how 23andMe built its brand , what makes the database valuable and who might be in the market to buy the database if Anne Wojcicki, its founder , is unsuccessful in her bid to buy back the company herself .
I have been studying the development of the industry of family history for the last 20 years. Genetic genealogy rose to prominence in the early 2000s, with the development of the science and early databases by committed genealogists and the market demand for locating ancestors .
23andMe's innovation was to use this burgeoning lust for ancestors as a way to build a new kind of direct-to-consumer database, one that looked at inherited markers for diseases afforded by the potent combination of genetic and genealogical information.
They weren't the first to hit on this idea. deCODE Genetics in Iceland had already built a national database of braided genealogical and genetic information for the same purpose. Within 10 years, it too went bankrupt and sold its database .
Ahead of government
23andMe was the first to market the idea in North America when Wojcicki founded the company in 2006.
Wojcicki claimed a high mission: to liberate health information from the hands of the medical industry and put it directly into the hands of consumers. Her business model made it clear that the direct-to-consumer genetics industry was always in the business of doing an end run around government and university databases that were governed by much stricter privacy laws.
23andMe ran into trouble with the FDA in 2013 for providing medical information without any medical supervision, a wrinkle that took two years for the company to iron out. But the more lucrative end of the business was always the sale of the accumulated data to the pharmaceutical industry.
23andMe pitched its research arm as the greater good, and 80 per cent of its consumers opted in to share their information for research purposes. The database has always been monetized for secondary uses. In its profile of 23andMe in 2017, Nature quoted cardiologist Euan Ashley at Stanford University, California: "They have quietly become the largest genetic study the world has ever known ."
A rapid unravelling
Five years ago, the company and the genetic genealogy industry as a whole started to unravel almost as quickly and precipitously as it had risen. Sales of direct-to-consumer genetic genealogy kits plummeted, given a combination of privacy concerns and market saturation .
The advent of law enforcement incursions into genetic genealogy databases gave consumers a fright, and woke them up to the possible unanticipated third-party uses of commercial databases.
Almost a decade later, governments are still trying to figure out how to set up guardrails on the use of genealogy databases for law enforcement, a practice that has become widespread across the U.S. and Canada .
Currently, the Information and Privacy Office of Ontario is actively working to develop regulations that are acceptable to all stakeholders since, once again, the greater good argument of catching cold-case killers holds considerable sway over the right to privacy of consumers.
Nonetheless, the issue of third-party uses has had a marked effect on the popularity of what seemed like a benign pastime, the search for ever-more-distant relations.
Industry expansion
Over the years, 23andMe expanded by buying health services and pharmaceutical holding companies. But in 2023, a massive data breach exposed the vulnerabilities of the company, particularly its genealogical information.
In addition to the 1.5 million users whose profiles were breached, hackers accessed the personal information of about 5.5 million people who opted in to 23andMe's DNA Relatives feature .
Stolen data included customers' names, birth years, relationship labels, percentage of DNA shared with relatives, ancestry reports and self-reported locations.
Fully a third of 23andMe's users' genealogical information had been scraped by the hackers. And here we see the real vulnerability in the entire industry: Anyone who has submitted a DNA sample and built family connections has exposed everyone in their family line.
This seems to be a classic case of closing the barn door after the horses have already bolted.
Like 23andMe, deCODE was a high flier in the genetics space having built a genealogical database that included almost all Icelanders, who invested heavily in the company. The company went bankrupt during the financial crisis of 2008, and it sold its database to American pharmaceutical company Amgen . Amgen in turn sold part of it to a Chinese company.
Corporate dealings
So who are the likely buyers for 23andMe?
Wojcicki herself, if she can somehow raise the capital, which seems unlikely. Any big pharmaceutical company, including international buyers (in 2018, 23andMe signed a US$300 million deal with GlaxoSmithKline ). Chinese biotechnology company BGI might well bid on the company, as China is seemingly on a mission to collect DNA from around the globe .
Other potential buyers include: Google, who were early investors and thus already part owners ; Ancestry.com, which, with its own genetic genealogy testing arm, would make it one of the of the largest privately held genetic genealogy databases in the world; and an outlier, Dutch life sciences firm Qiagen.
Qiagen acquired California-based forensic genomics company Verogen in 2023. Verogen had previously acquired the geneaology database GEDmatch (one of the earliest grassroots ancestor DNA matching sites) for the purposes of creating a one-stop forensics genealogy shop for law enforcement.
Changing privacy
Each time a database is sold, privacy provisions are subject to change. Even though Wojcicki is promising to protect the privacy of costumers currently in the database, she might not have much control in the long run.
So what should 23andMe's customers do? Should they delete what data they can? Absolutely. Will it make much difference in the end? Probably not.
What is now manifestly apparent is that the industry of direct-to-consumer genetics has far outpaced the ability of governments to regulate the information, so consumers are suddenly nervous.
We should have paid attention at the very beginning of this dubious exercise in the privatization of personal data. Now we have to live with all that relatedness as a valuable commodity over which we have little say.
Julia Creet receives funding from Social Sciences and Humanities Council of Canada and previously from the Office of the Privacy Commissioner of Canada.
