Sequencing DNA can be empowering. But the recent 23andMe bankruptcy announcement has thrust privacy into the spotlight. Over 15 million people sent their spit to 23andMe, and the DNA they shared may have exposed people who didn’t to privacy risks – relatives, perhaps, or people with similar traits or demographic characteristics. As customers with buyer’s remorse rush to delete their genetic information (as I’ve reported here), millions more who don’t have an account but whose DNA is linked to those who do have no such recourse. This is especially troubling for people from vulnerable or marginalized groups. The bankruptcy court could appoint a consumer privacy ombudsman to address these concerns, but it seems unlikely.
“I’ve always questioned how we use individual consent as the lawful basis/condition for the processing of sensitive personal information where there is such a highly asymmetric power dynamic,” writes Samantha Simms in a recent LinkedIn post. The digital lawyer and coach tells me she’s particularly concerned about the high numbers of people with Caribbean, African American and Latin American backgrounds who flocked to take the tests “because the lure of these services is profoundly emotional.”
DNA Sequencing Carries Benefits – And Serious Risks
Once sequenced, DNA can tell you where you came from, but this blueprint of life can also tell you what lies ahead. It can act as an early warning system for disease risk and a roadmap for personalized medicine. So it’s no surprise that direct-to-consumer genetic testing is so popular.
Sequenced DNA is also popular with biomedical researchers and pharmaceutical companies, who can use it to link genetic markers to diseases or traits and find cures. For example, researchers have discovered that mutations in the BRCA-1 and BRCA-2 genes signal higher risk for certain cancers like breast cancer. People can now be screened for cancer risk and plan early interventions. With DTC genetic testing, they don’t need to wait for a doctor to order tests.
Yet bioethicists, privacy experts and national security experts warn that genetic information can also be misused in dangerous ways. We can’t change our DNA if it falls into the wrong hands, unlike other identifiers like a social security number. Greshake Tzovaras, founder of the now-closed OpenSNP project, told 404 Media why he decided to shut down the genetic database he’d created to democratize genomic research. He’s seen how genetic databases intended for biomedical research have largely been re-purposed for law enforcement. He cites “a rise in far-right and other authoritarian governments” as a key driver for deleting the data, which he fears could be used to target individuals or create pseudo-scientific justifications to vilify vulnerable groups.
“Thinking about gender representation, minorities, sexual orientation—23andMe has been working on the whole ‘gay gene’ thing, it’s conceivable that this would at some point in the future become an issue.”
The U.S. Department of Justice has issued a final rule prohibiting the bulk transfer or sale of genomic data to “countries of concern” like China. The rule extends to the sale of de-identified genomic data because it can be matched with other information to re-identify individuals or used to attack an identifiable population. The risks are significant: the same data used to offer personalized medical treatment could also be weaponized to hyper-target pathogens or bioweapons. But the rule doesn’t prevent 23andMe from selling genetic data to buyers in other countries not listed as “countries of concern.” Nor does it prevent domestic actors from misusing genetic data, as I’ve discussed here.
The Lure Of These Services Is ‘Profoundly Emotional’ For For People Displaced By Colonialism And Slavery
Simms does a lot of ancestral research, but she can only trace her story back to 1784. Like many in her community, she longs to understand her history pre-1600s. “Coming from a people displaced by over 300 years of genocidal chattel slavery, I cannot provide any more precise details of my African ancestry without the aid of a direct-to-consumer DNA testing company, such as 23andMe,” writes Simms on LinkedIn.
“We often carry the ache of a tree without roots. With few photographs, no clear family records, and little oral history preserved, DNA testing offers, albeit partial, answers to an individual’s story. The desire to know where we come from is so fundamental that it often outweighs what is seen as the more abstract risks to privacy.”
Despite this, Simms eventually decided against using a DTC genetic testing service over privacy risks and fears about how this data could be used against her community. Breaches, lack of transparency and control, and the possibility of unchecked sharing, data enrichment and profiling by data brokers were top of mind. Now, with the Trump administration’s aggressive anti-DEI measures and health secretary RFK Jr. making race-based assertions regarding Black people and COVID, Simms is worried about U.S. government access to genetic data.
DTC Genetic Tests Present Unique Challenges For Indigenous Communities
Dr. Krystal Tsosie, an Indigenous geneticist-bioethicist and assistant professor at Arizona State University tells me that DTC genetic testing exposes Indigenous communities to unique group privacy risks. Because they tend to be small with shorter generational gaps and larger families, both individuals and tribal communities are re-identifiable. She worries about the stigmatizing effects of genomic profiling; the use of genomic data for research never agreed by those communities; and the loss of Indigenous Data Sovereignty.
Historical misuse of Indigenous data by researchers has caused some tribes to issue moratoria against sharing their genetic data with researchers. In addition, concerns over community privacy have spurred tribal leaders to discourage their members from using DTC genetic testing services. Researchers sometimes fill these gaps using data from other communities as proxies, raising serious accuracy and data quality concerns.
Dr. Tsosie notes that colonially displaced descendants of Native Americans hoping to re-connect with those communities feel compelled to turn to DNA testing for answers. But this reifies it as a biological construct and raises concerns around false claims to Indigeneity. “We construct belonging and citizenship in ways that do not consider these genetic ancestry tests. So it’s not just a matter of what you claim, but it’s a matter of who claims you,” says Kim Tallbear in an interview with CBC. Tallbear is Dakota, a professor in the Faculty of Native Studies at the University of Alberta and author of Native American DNA; Tribal Belonging and the False Promise of Genetic Science. She emphasizes that sharing genetic material doesn’t constitute lived experience in community, or shared values, beliefs and cultural practices.
It’s one thing to accept privacy risks for yourself. When your choices impact others, the risks are amplified. Simms wasn’t ready to take a leap of faith with 23andMe, despite its privacy assertions. She feels vindicated. “Large-scale data breaches, attempts to purchase data by the CEO post-bankruptcy, and an inability to handle deletion requests are not in line with a company that honoured its role to emotionally vulnerable consumers,” she says of 23andMe. “There is no perfect fix for this imbalance.” Until there is, the safest approach may be not to share at all.
