Skip to Content

Do DNA Testing Companies Like 23andMe Own Your Biological Data?

The Federal Trade Commission issued a striking holiday missive last year: If you’re thinking of buying an at-home DNA testing kit, make sure to consider the privacy implications: “Although most tests require just a swab of the cheek,” the agency wrote, “that tiny sample can disclose the biological building blocks of what makes you you.”

The issue flagged by the FTC: Who else might profit from your most personal of data?

Genome sequencer 23andMe, for example, has DNA from its 5 million customers. It also has partnerships with academic institutions and drug companies like Genentech and Otsuka. 23andMe’s CEO and cofounder Anne Wojcicki says those relationships shouldn’t cause customers concern: their data is de-identified and can only be used with their consent.

Wojcicki says, almost evangelically, that she wants 23andMe’s consumers to own their data—and to have the information they need about any potential genetic risks to act.

The idea that patients would actually be in charge of such personal information is— shockingly—a radical one. And a welcome one to people like cardiologist and digital health pioneer Eric Topol. “I strongly believe that everyone should own their medical data—and they have a right to that,” says Topol, the director of the Scripps Translational Science Institute. “It’s their body and it can make a life- or-death difference.”

Read more on this topic on our feature Tech’s Next Big Wave: Big Data Meets Biology.

But, says Topol, that data’s underlying value also makes it vulnerable. “It’s being hacked and stolen left and right, no less being sold without people knowing it—even though, in many cases, it’s de-identified.”

Some companies, indeed, openly boast about how easy it can be to identify individual consumers from myriad sources of data. Acxiom, one of the country’s largest data brokers, touts its potential to marry consumer data—income level, shopping habits—with clinical records and medical claims. While the Arkansas company says that de-identified data remains that way, such a fuller picture of consumers can enable health care companies to do a better job treating, insuring, or marketing to them, it says.

Sheila Colclasure, who heads data ethics for Acxiom, says we no longer live in an era of privacy but one of “ethical data use.” Your data will—and should, she argues—be used to gain the valuable insights that come through its collection and analysis. For consumers, though, the question remains: Who gets the value?