What a sale could mean for 23andMe's genetic data

Over almost 20 years, 23andMe has built a large genetic database that includes a plethora of information about customers' health predispositions and ancestral backgrounds.

Currently, the company's privacy policies emphasize that each customer's consent is required to share any genetic information, but those policies also state that customer information is a salable asset in the event of a merger or acquisition.

A spokesperson for 23andMe told The Atlantic that while they can't fully guarantee the sanctity of customer data, "any scenario which impacts our customers' data would need to be carefully considered. We take the privacy and trust of our customers very seriously, and would strive to maintain commitments outlined in our Privacy Statement."

A person's genetic information can reveal a lot about their own health and their family's health. "So if someone had access to that information, and they could identify you, they could learn something about your health," said Anya Prince, a genetic privacy expert and professor at the University of Iowa's College of Law.

Prince, also said that people concerned about their genetic information may not realize how few federal protections exist, noting that "HIPAA does not protect data that's held by direct-to-consumer companies like 23andMe."

While a 2008 law called the Genetic Information Nondiscrimination Act protects against discrimination by employers and health insurers based on genetic data, gaps in the law exempt providers of life, disability, and long-term care insurance from these restrictions.

"In the vast majority of states, those types of insurance are allowed to take into account one's genetic information," Price said, adding that only Florida has laws that ban all three insurance types from making decisions based on genetic information.

This means that if, for example, you have a genetic marker correlating with a heart condition and a life insurer discovers it, the insurer could legally deny you a policy, regardless of whether you develop that condition, The Atlantic reports.

Price also notes that a drugmaker could potentially use genetic information to better tailor its advertising. "It might be innocuous, as in you'd be marketed products for diabetes if you have a predisposition," she said. "It could be annoying but not harmful."

Jason Kelley, activism director at Electronic Frontier Foundation (EFF), said that, while existing laws do prevent some insurance companies from discriminating against individuals, it's possible a more nefarious third party that owns a large amount of genetic data could do some damage.

"The concern is not about what people could find out today, but in the future. Having access to this kind of information could give someone an enormous amount of intelligence about groups of people and potentially individuals," Kelley said. "And there's a sort of dystopian nightmare scenario where that kind of data can be tied back to individuals, or leaked to the internet."

Law enforcement agencies have also used DNA data to solve difficult cases. And while 23andMe says it requires a warrant to share data, other companies have been laxer, granting broad access to police, The Atlantic reports.

"There's a lot of ways that this data might be misused or used in a way that the consumers couldn't anticipate when they first bought 23andMe," said Suzanne Bernstein, counsel at the Electronic Privacy Information Center.

What can 23andMe customers do?

Cybersecurity experts have advised that all 23andMe customers review the company's privacy policies and consider how and with whom they want to share their data.

In a post on X, Eva Galperin, director of cybersecurity at EFF recommended account holders delete their data from 23andMe.

"If you have a 23andme account, today is a good day to log in and request the deletion of your data," she wrote.

An individual account holder does have the ability to request a deletion of their genetic information under 23andMe's privacy policy.

"You have the ability to download data and delete your account if you're no longer interested," Prince said.

However, if you've agreed to allow the company to share your data in a de-identified way for research purposes, you can reverse that consent, but you can't retract the data that's already been shared. "You can't find it at whatever pharmaceutical companies it's already been shared with, because it doesn't have a person's name attached to it," Prince said. "So there's nothing to be done there."

In the future, Kelley said he urges people to "think very carefully about how much data they are giving away when they use a service like" 23andMe.

"In general, sharing data like this with any third party is something people should take seriously," Kelley said. "For a long time, people have not known what information they were giving away and how it was used and people becoming more aware of how their information can be used or it can be dangerous if there is a data breach." (Daniel, Forbes, 10/15; Brown, The Atlantic, 9/27; Cerullo, CBS News, 10/15)

We're likely to see continued action and enforcement from the FTC when it comes to sharing sensitive health data. Read on for how FTC's new focus on consumer privacy could impact healthcare.