Are you one of the 15 million people whose DNA is in the hands of 23andMe? Your genetic data may be in danger. 23andMe is facing serious financial challenges. Since the company went public in 2021, it has had trouble finding a workable business model – and it's never made a profit. Highlighting the dire nature of the company's finances, the Wall Street Journal reported that 23andMe may run out of cash as early as next year. The company's uncertain future raises alarming questions about the fate of your DNA if the company gets sold.
23andMe's privacy policy includes a clause that you might have overlooked when you sent in your sample: In the event of a bankruptcy, merger, or sale of assets, your genetic information could be transferred or sold to another entity.
If your data were sold to Ancestry.com, MyHeritage.com, or another company that offers genetic-based services, that might not be so bad. However, it could also be sold to a data broker and then resold to whichever companies or people are willing to pay. We've all seen how this plays out with other personal data sold or shared by social media companies. Information about you is collected and combined with data from other sources. So even if your data were anonymous when 23andMe sold, it could be combined with other data that would reveal your identity, as is outlined by this BMC Med Ethics study. In that case, there are serious risks.
Read more: Social Media's Shocking Data Harvesting & Sharing Practices Exposed
The real risks
Insurance discrimination
In the U.S., the Genetic Information Nondiscrimination Act (GINA) protects against discrimination in health insurance and employment based on genetic data. However, this law doesn’t cover life insurance, disability insurance, or long-term care insurance. If insurance companies gain access to genetic data, they could potentially use it to deny coverage or increase premiums.
Third-Party data sharing
Many genetic testing companies reserve the right to share your data with third parties, including pharmaceutical companies, research institutions, or even law enforcement, sometimes without explicit consent. This raises ethical concerns over how the data is used and whether users have control over it once submitted.
Family privacy concerns
Genetic data doesn't just reveal information about you but also about your relatives. Sharing your data can inadvertently expose family members to risks, such as the discovery of unknown familial connections or health risks. This has already occurred in criminal investigations, where law enforcement used genealogical databases to track down suspects based on relatives' DNA.
Potential for genetic profiling
With the rapid advancement of genetic technologies, there’s a concern that genetic data could be used for profiling. This could lead to social or governmental discrimination based on genetic predispositions for certain traits or diseases. It also raises ethical concerns about the potential future misuse of genetic data by authoritarian regimes.
How to Protect Yourself
Given the potential consequences, I'd recommend deleting your DNA data from 23andMe. However, before you delete, make sure you download a copy of your DNA data.
Here’s how to get a copy of your DNA data and then delete it from 23andMe:
- Log into your 23andMe account.
- Go to Account Settings, and in the “23andMe Data” section, select “View”
- Select the data you want to download and select “Request Download.”
- Once you receive a copy of your data, go back into Account Settings, and in the “23andMe Data” section, select “View.”
- Scroll down and select “Permanently Delete Data.”
- Submit a deletion request.
- Verify the deletion request when you receive the confirmation email.
Important note: Even after you delete your data, 23andMe will continue holding onto some of it, and any data the company has already shared for research can't be retracted. When your data is shared, it doesn't have your identifying information, so it's impossible at that point to trace who has it.
Here’s the pertinent part of 23andMe’s Privacy Statement:
"23andMe and/or our contracted genotyping laboratory will retain your Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations, including the federal Clinical Laboratory Improvement Amendments of 1988 (CLIA), California Business and Professions Code Section 1265 and College of American Pathologists (CAP) accreditation requirements, even if you chose to delete your account. 23andMe will also retain limited information related to your account and data deletion request, including but not limited to, your email address, account deletion request identifier, communications related to inquiries or complaints and legal agreements for a limited period of time as required by law, contractual obligations, and/or as necessary for the establishment, exercise or defense of legal claims and for audit and compliance purposes."
The bottom line
If you want to get genetic testing, do it in a medical facility where HIPAA laws will protect your data. The benefits of keeping your genetic data with a private and/or for-profit company simply don't outweigh the risks.
[Image credit: concept drawing of DNA helix generated by DALL-E]
For the past 20+ years, Techlicious founder Suzanne Kantra has been exploring and writing about the world’s most exciting and important science and technology issues. Prior to Techlicious, Suzanne was the Technology Editor for Martha Stewart Living Omnimedia and the Senior Technology Editor for Popular Science. Suzanne has been featured on CNN, CBS, and NBC.
