Would you consent to your DNA data being shared with other companies? The rise and fall of 23andMe...

[JohnS]

As the title states, buy a genetic testing kit for home from a company like 23andMe and you can know a lot more about yourself than just by looking in the mirror or relying on your memories. In 2021, 23andMe became a publicly listed trading company worth $US6 billion. Today, around three years later, the company is worth about 2% or $US120 million. How did it fall so spectacularly? Have you used their services? And, more importantly, would you want to?

To provide some background context, according to Wikipedia (I know, I know...not objectively verifiable but it's great for quick summative information)...

23andMe Holding Co. is a publicly trading personal genomics and biotechnology company based in South San Francisco, California. It is best known for providing a direct-to-consumer genetic testing service in which customers provide a saliva sample that is laboratory analysed, using single nucleotide polymorphism genotyping, to generate reports relating to the customer's ancestry and genetic predispositions to health-related topics. The company's name is derived from the 23 pairs of chromosomes in a diploid human cell.

The company had a previously fraught relationship with the United States Food and Drug Administration (FDA) due to its genetic health tests; as of October 2015, DNA tests ordered in the US include a revised health component, per FDA approval. 23andMe has been selling a product with both ancestry and health-related components in Canada since October 2014, and in the UK since December 2014.

In 2007, 23andMe became the first company to begin offering autosomal DNA testing for ancestry, which all other major companies now use. Its saliva-based direct-to-consumer genetic testing business was named "Invention of the Year" by Time in 2008.

23andMe became a publicly traded company in 2021 and soon had a market capitalization of US$6 billion. By 2024, its valuation had fallen to 2% of that peak. Source: https://en.wikipedia.org/wiki/23andMe

‘There are no serious safeguards’: can 23andMe be trusted with our DNA?

The at-home genetic testing company is dealing with financial woes and a data breach. What does that mean for customers?

A 23andMe saliva-collection kit. The company is facing major financial issues. Photograph: nevodka/Alamy

What’s next for 23andMe? Most people know the biotech company as a genetic testing service. Stories of people sending their cheek swabs off in the mail only to discover that a parent who raised them wasn’t their biological one have become a kind of millennial horror genre. Of course, most 23andMe experiences aren’t that dramatic: the company says more than 14 million people have used the service in hopes of learning more about their ancestry.

But this month, 23andMe revealed it is facing major financial troubles, and more information came to light about a devastating security breach at the company last year. Now, customers might be wondering: can they trust 23andMe with their DNA?

The DNA ‘bait and switch’

Last week, 23andMe reported dismal third-quarter fiscal results, tanking stocks in the company, CNBC reported. Its financial woes come down to a longevity problem: the company’s most famous offering, the DNA ancestry test, is a one-and-done deal. After taking the test, there’s no reason for consumers to keep spending money on 23andMe, which has led to a plateau of sorts.

Nevertheless, the company’s CEO, Anne Wojcicki, told Wired she remains “optimistic” about 23andMe’s future.

At-home DNA tests are so ubiquitous that you can order one for a dog. 23andMe was the first company to offer the (human) service, back in 2007, and now an estimated one in five Americans have tried at-home genetic testing. Some customers were handing over personal data that Wojcicki and company used for purposes other than inspiring family reunions.

From 2018 to 2023, 23andMe partnered with the pharmaceutical giant GlaxoSmithKline, using customers’ genetic information to help develop drug targets. (A drug target is a molecule that plays a role in a disease; researchers use them to develop therapies for certain diseases.) This year, the partnership became non-exclusive, which means 23andMe can strike deals with more pharmaceutical companies to milk more money out of its DNA trove.

“It’s a real resource that we could apply to a number of different organizations for their own drug discovery,” Wojcicki said, adding that 23andMe was interested in studying inflammation immunology, particularly asthma.

23andMe already has two cancer drugs undergoing drug trials; those drugs came from users’ genetic data. But 23andMe users may not understand that the spit they gave the company months or years ago is being used to make more money.

As the health reporter Kristen V Brown wrote for Bloomberg in 2021: “It wouldn’t be crazy for the 8.8 million 23andMe customers who once absently checked a box saying, yeah, sure, use my data for whatever, to feel like they’ve been bait-and-switched now that their genes are laying the groundwork for potential cancer cures.” (Since 2021, the number of customers who have checked that box has risen to 10 million, according to Wired.)

Customers can revoke consent

Americans tend to believe that their health data is covered by Hipaa, the health privacy law – surely 23andMe, with its official-looking cheek swabs and far-off labs, must be, too. But 23andMe isn’t a healthcare provider. The same rules do not apply.

“There are no serious safeguards, no regulation around the collection and sale of really sensitive personal data,” said Suzanne Bernstein, a law fellow at the Electronic Privacy Information Center. “For 23andMe, the nefarious [data] breach constitutes a security issue, but so does the company sharing your information with a party that you didn’t know about. Customers may technically consent to their data being shared by accepting the terms and conditions, but those are really long and a lot of people don’t read them.”

Anne Wojcicki, the company’s CEO, in 2015. Photograph: Brad Barket/Getty Images for Fast Company

Some people might find it honorable that their genes are being used for cancer research. Others might feel ripped off: they paid about $229 for a DNA testing kit, but 23andMe is using their health data for free. Thorin Klosowski, a security and privacy activist at the Electronic Frontier Foundation, says 23andMe could do more to ensure that customers better understand this dynamic before they opt in.

“The amount of people who are surprised by how much data goes elsewhere is a sign that 23andMe isn’t explaining things very clearly,” he said.

Klosowski added that while users can opt out of their data being used by 23andMe long after they’ve sent away their DNA swab, their information may have already been used for research purposes. “You can ask 23andMe to stop using your information, but you can’t ask for data to be removed from a list once it’s been sold off,” he said.

For its part, 23andMe maintains that users are asked to opt in to research at point of purchase, and all personal data is stripped of identifying information before it’s shipped off for analysis. Data isn’t used without this consent, and consent can be revoked. The company’s research wing is also overseen by an “independent, impartial” review board. (23andMe did not respond to a request for comment.)

Data breach leads to class-action suit

23andMe’s security breach is still at the forefront of many customers’ minds, too. Last year, nearly 7m customer profiles were hacked. Over the course of five months, hackers were able to access health records, including carrier-status reports, as well as personal information from up to 5.5 million people who opted in to one of 23andMe’s best-known features: the chance to find relatives.

Customers with Chinese and Ashkenazi Jewish heritage appeared to have been targeted in the breach and their information sold on the dark web, the New York Times reported. Some of those users recently filed a class-action suit against the company, saying 23andMe had failed to notify them about the exposure.

As the Guardian reported on Thursday, 23andMe downplayed its responsibility for the hack in a letter to customers, arguing the health information accessed “cannot be used for any harm”. It also blamed customers who “negligently recycled and failed to update their passwords” – a response that one former customer criticized as “morally and politically very dumb”.

Wojcicki didn’t speak directly about the leak due to pending litigation, but she told Wired that 23andMe had introduced two-factor authentication and made customers reset their passwords. “Data privacy and security has always been a really high priority and remains a high priority for the company and something that we are going to invest even more into,” she said.

Are 23andMe’s security issues the death knell for a company that Time once hailed as the “invention of the year”? Whether or not customers’ privacy concerns are well-founded, the company’s financial fall has been swift, and CNN reports it could be delisted from Nasdaq if its stock price doesn’t go up.

Dominic Sellitto, a clinical assistant professor at the University of Buffalo who focuses on digital privacy, believes that if 23andMe survives the year, it will be due to data mining. “There’s a lot of demand and money for data, especially quality healthcare data,” he said. “If 23andMe continues to monetize that, it will be their golden ticket in 2024.”

Source: https://www.theguardian.com/technology/2024/feb/17/23andme-dna-data-security-finance

[eltoroosborne]

No


Sent from my iPhone using Tapatalk

[JohnS]

Indeed. Me neither. So I wonder what the appeal of all this has been, thus far?

[btort910]

Nope!

 

[chasy]

In my opinion - this was a gimmicky / single use product from the onset. There is value and entertainment in the ancestry test. Beyond that, it was a classic case of a one dimensional company spinning a much broader and sexier narrative to support valuation etc. The reality is that there is limited value in the data set and the company has struggled to apply their data to new drug development. Unclear if that was always the case or if they truly believed it would be commercialized.

Additionally, Wojcicki was married to Sergey Brin for a period of time and it’s been pretty well documented that the fame of the marriage had influence on her - she started hangin w celebrities, bringing celebs to the office, etc. She even ousted her cofounder (which happens a lot).

I don’t see any redeemable outcome for the business and would expect a fire sale or bankruptcy to occur.

And no, I would not consent to providing them with my medical data. Especially now that the company is almost surely going under.

[PigFish]

NFW…

With my political views. The internet is scaring me at this point.

[MrBirdman]

33 minutes ago, PigFish said:

NFW…

With my political views. The internet is scaring me at this point.

Ray based on our conversations we have pretty different political views, and the internet scares me too. That should scare everyone! 

I think the demise of these services comes partly because they’re largely gimmicks and also from justifiable public suspicion. Ironically, a lot of that I think comes from the crimes solved by it - even though 23 and Me et Al guarantee they won’t post your info on databases (and they don’t). It’s not that people are afraid they’ll kill someone some day and then get caught - rather, it shows the power of letting the public (and thus the state) have access to your genetic information.  

Personally, I have considered getting genetic testing for specific medical conditions. But I would only do so if there was a legal regime in place to enforce privacy (including destruction of samples and non-retention of the info after a period, like with HIPAA). 

[jazzboypro]

It's not like they are the first company being hit with a serious data breach. Private life/personal information/anonymity as been a thing of the past for decades. Companies/Government know more about us than we know about ourselves. Those who took the tests probably had a good reason to do so. Personally I don't really care about my ancestors and I'm not sure I want to know what awaits me health wise. 

The danger I see is the data being used for example by insurance company not wanting to sell you insurance or asking very high premiums or even banks refusing loans to customers.

[MrBirdman]

3 hours ago, jazzboypro said:

The danger i see is the data being used for example by insurance company not wanting to sell you insurance or asking very high premiums

Fortunately this is already illegal, at least in the US. 

[jazzboypro]

3 hours ago, MrBirdman said:

Fortunately this is already illegal, at least in the US. 

It is probably the case in many countries but I wonder if it's being done anyway.

[Bijan]

I have no concerns. I'd post my test results in a public database. It's not even the full genome just large patterns/portions of genes.

The data is there in every hair that you leave anywhere in public. So the dystopian outcomes are not ones you can avoid by avoiding these testing companies.

Tl;Dr this is the state of the world and the only real protection is tin foil hat and never leaving your home.

Edit: I do feel differently about minors/children.

[MrBirdman]

3 hours ago, jazzboypro said:

It is probably the case in many countries but I wonder if it's being done anyway.

It isn’t (I’ve worked in healthcare compliance) but I think your concerns about genetic info being used in discriminatory ways isn’t entirely unfounded. It’s the premise of the excellent movie Gattaca. 

[helix]

Of course the security services in all countries get the DNA data, don't kid yourselves. Not a conspiracy theory.

[MrBirdman]

5 minutes ago, Bijan said:

I have no concerns. I'd post my test results in a public database. It's not even the full genome just large patterns/portions of genes.

The data is there in every hair that you leave anywhere in public. So the dystopian outcomes are not ones you can avoid by avoiding these testing companies.

Tl;Dr this is the state of the world and the only real protection is tin foil hat and never leaving your home.

I agree - I just don’t see the point in getting the testing in the first place unless I had reason to suspect I had a latent predisposition to some kind of preventable disease. 

Although, my curiosity about ancestry has been satisfied by close blood relatives getting the testing. 

[TacoSauce]

Having spoken with people who worked there, they were pretty open about the fact that the company was always and originally a data collection outfit. A big part of their internal operations was managing the facade that the individual was the customer. 

[MrBirdman]

5 minutes ago, Bijan said:

I have no concerns. I'd post my test results in a public database. It's not even the full genome just large patterns/portions of genes.

The data is there in every hair that you leave anywhere in public. So the dystopian outcomes are not ones you can avoid by avoiding these testing companies.

Tl;Dr this is the state of the world and the only real protection is tin foil hat and never leaving your home.

One point I’ll add to this as an FYI for all is that, in the US, no warrant is needed to collect genetic info you dispose of in public (that includes your trash once it goes to the curb). 

[Bijan]

3 minutes ago, MrBirdman said:

I agree - I just don’t see the point in getting the testing in the first place unless I had reason to suspect I had a latent predisposition to some kind of preventable disease.

To me the trade-off is between the small utility in having your genetic results vs the small harm of getting into the database if you happen not to be a person of interest.

If you happen to be a person of interest, on some sort of radar, then there's only utility in it, assuming the companies give you real results (non falsified).

[helix]

Unmatched DNA from crime just waiting.

[MrBirdman]

8 minutes ago, Bijan said:

To me the trade-off is between the small utility in having your genetic results vs the small harm of getting into the database if you happen not to be a person of interest.

If you happen to be a person of interest, on some sort of radar, then there's only utility in it, assuming the companies give you real results (non falsified).

Agree entirely, though as I’ve always thought about it there’s actually the added factor of being related to a suspect in a crime (which is typically how these databases are used to catch people - I think Kohberger was tracked through like a 2nd or 3rd cousin; Golden State killer through relatives with the same great-great-great grandparents). Whether that’s a risk or utility depends on your perspective I suppose, but I actually have considered submitting my info on the minute chance it helps solve a crime.

Also, FWIW, I have already submitted my genetic info to a bone marrow donation bank. I’m approaching the age where they won’t use me even if I’m a match, but I felt it was worth the risk to my data for the opportunity to save a life. I’ve known people (including kids) who’d be dead without a stranger who did the same.

[helix]

If you have nothing to hide..............................

[bassistheplace]

Uh, no thanks

[Chas.Alpha]

I used it, just to confirm that I was descended from a race of Atomic Supermen. 💪

[Chibearsv]

🙄 Holy crap, imagine if they cloned an army of Chas.  😳

[LLC]

Zero interest.


Sent from my iPhone using Tapatalk

[Boss Hog]

36 minutes ago, LLC said:

Zero interest.

You and me both, my fellow brother.