Your DNA holds the intricate code of who you are. It’s a unique biological blueprint. For years, companies like 23andMe and Ancestry have gathered this deeply personal information from millions. Now, as these businesses face financial challenges, a critical question emerges: What is your genetic data truly worth on the market? And who should ultimately control its destiny and profit from its use?
This isn’t just a theoretical debate. It’s playing out with real companies holding sensitive data.
The Rise of Consumer Genetics and Data Monetization
The journey to understanding our genetic makeup has become significantly faster and more affordable. Direct-to-consumer (DTC) genetic testing kits, once a niche offering, exploded in popularity. Companies offered insights into ancestry, health predispositions, and even quirky traits based on a simple saliva sample.
But beneath the promise of personal discovery lay a powerful asset: aggregated customer data. As these databases grew, their potential value for research and development in fields like pharmaceuticals became clear. This shift marked a turning point, transforming intensely personal genetic information into a potential commodity.
Early Signals of Data Value
Significant transactions revealed the hidden monetary value of these vast genetic databases. In 2018, pharmaceutical giant GlaxoSmithKline (GSK) struck a landmark deal with 23andMe. GSK paid $300 million for access to the exomes – the protein-coding parts of DNA – of over 5 million people. This suggested an early value of about $60 per individual exome for researchers at the time, as noted by Aldo de Pape, founder of Genomes.io.
The perceived value appeared to soar just two years later. In 2020, private equity firm Blackstone acquired Ancestry.com for a staggering $4.7 billion. Ancestry’s database included DNA samples from 18 million subscribers. This acquisition implied a much higher value, around $250 per exome, signaling a strong upward trend in the market’s valuation of genetic information. These deals underscored that the core business model for some DTC genetic companies involved leveraging their massive data sets for external partnerships and sales.
Aldo de Pape observed this trend with concern. He saw genetic data as a highly identifiable, unique piece of information. Treating it like a simple commodity, bought and sold without users sharing in the profit or having control, seemed risky.
The Limits of DNA Alone: Context is Key
Despite the large sums involved in data deals, the intrinsic value of genetic information by itself is limited. This is a key lesson learned by geneticists like Ernst Hafen, who founded a startup in the early 1990s called The Genetics Company. His company aimed to identify specific genes linked to diseases, hoping to be acquired by a pharma company.
Hafen’s venture ultimately failed. He discovered that focusing solely on isolated DNA provided insufficient information. Genetic data gains significant value only when placed in context. This includes population data, family history, and, most importantly, phenotypic data. Phenotype refers to observable characteristics and health outcomes resulting from gene expression. Information found in medical records, like sleep quality or cholesterol levels, provides this crucial context. Without phenotype, an individual’s DNA often reveals little of practical value to researchers seeking to understand complex diseases. Hafen’s experience reinforced the idea that the utility of genetic information alone quickly runs out.
The Current Market Reality and 23andMe’s Struggles
Ernst Hafen points to the recent struggles of 23andMe as further evidence that DNA alone isn’t the goldmine once imagined. Despite accumulating 15 million sequences, the company faced significant financial difficulties. After a peak valuation of over $6 billion post-IPO in 2021, its value plummeted by over 97% by 2024. Compounded by a major data breach in October 2023 that affected nearly 7 million users and cost $30 million in settlements, the company ultimately filed for bankruptcy.
More recently, reports indicate 23andMe is exploring the sale of assets. Based on figures like a potential $305 million sale price for core assets and a reported 15 million users, the implied value per exome drops dramatically, perhaps to around $20. This is far less than the previous high valuations and even less than the initial GSK deal when adjusted for inflation. This “sputtering,” as Hafen describes it, highlights the challenge: the value of genetic data is not static and is less potent without rich contextual information. For some purposes, like predicting health risks for insurance, other data points, such as detailed purchase history showing lifestyle habits, might currently be considered more valuable and easier to acquire than abstract genetic data.
Who Controls Your Genetic Blueprint?: Privacy and Ownership Concerns
The precarious situation of companies holding vast amounts of genetic data raises serious privacy questions. Customers provide this intimate information, often with the understanding it’s for personal insights or helping medical research in an anonymized way. However, the reality of corporate finance, sales, and bankruptcy introduces complex challenges regarding who ultimately controls this data.
Crucially, federal health privacy laws like HIPAA (Health Insurance Portability and Accountability Act) do not apply to direct-to-consumer genetic testing companies. These firms operate outside the traditional healthcare system, treating users as consumers, not patients. The Genetic Information Nondiscrimination Act (GINA) offers some protection by preventing discrimination in health insurance and employment based on genetic data, but it doesn’t govern how companies collect, store, or transfer your data, especially during a sale or bankruptcy.
A significant concern arises from companies’ terms of service and privacy policies. While 23andMe has stated it won’t share individual data with employers, insurers, or law enforcement without a subpoena (and has resisted law enforcement requests), their terms explicitly reserve the right to transfer customer data during a sale or bankruptcy proceeding. Privacy experts warn that a new owner might not be legally bound by the previous company’s privacy policy and could change terms after acquisition. This means customers who consented to share data under one set of rules might find their information in the hands of a third party they never anticipated, potentially used in new ways. The 2023 data breach affecting millions further underscores the security risks inherent in these large databases.
Seeking Alternatives: Models for Data Ownership
Recognizing the privacy risks and the lack of control consumers have, some alternative models are emerging. Aldo de Pape, concerned by the commodification of genetic data, co-founded Genomes.io. This service aims to put data ownership squarely in the hands of the individual.
Genomes.io sequences a user’s DNA and stores it in a secure, encrypted “virtual vault” using blockchain technology. The user retains the sole key to decrypt and access their information. Researchers interested in using the data for studies must request access through Genomes.io, pay the company, and obtain explicit permission from the individual user. Even then, researchers interact with the data in a controlled, encrypted environment, unable to identify individuals or retain raw genetic information. This model potentially allows users to monetize their own data by opting in to paid research projects, addressing the issue of who profits from the data’s value. However, startups like Genomes.io face challenges, including the need for scale to make their databases valuable for large-scale research.
The Future of Genetic Data: Value, Risks, and Regulation
Despite the current complexities and debated standalone value, the market’s interest in genetic data persists. This is driven by the belief that as genetic science and technology, particularly in areas like artificial intelligence and multi-omics research, advance, the latent value of this information will grow exponentially. This ongoing pursuit keeps the spotlight on the ethical and legal challenges.
The risks associated with vast genetic databases remain significant. Beyond the threat of data breaches and re-identification, concerns include potential use for discrimination beyond health insurance and employment (which GINA covers), financial fraud, or even more speculative concerns like the development of bioweapons using population-specific genetic information. The unprecedented nature of potentially selling such sensitive databases during corporate distress highlights the urgent need for robust safeguards. Experts and privacy advocates, like I. Glenn Cohen from Harvard Law School, are calling for stronger protections. They argue that the U.S. needs a comprehensive federal data privacy law that specifically addresses genetic information and ensures protections persist even when companies face bankruptcy or sale, going beyond the limitations of current state and federal regulations.
Taking Control: What Can Individuals Do?
Given the evolving landscape and inherent risks, consumers who use or consider using DTC genetic testing services should be informed. Reading the terms and conditions and privacy policy carefully before submitting a sample is crucial, although these documents are often complex and subject to change, especially during corporate transitions.
Most companies, including 23andMe, offer options to control data use. Users can typically opt out of having their de-identified data used for research purposes. If deeply concerned, users can request account deletion, which usually discards saliva samples and removes the ability for future research use. However, it’s important to understand the limitations: data already de-identified and shared with third parties for past research may not be retrievable or deletable. Companies may also retain some basic information (like genetic data, date of birth, sex) to comply with legal obligations, even after account deletion. Ultimately, exercising available privacy controls and staying informed about the company’s status are the primary actions individuals can take in the current regulatory environment.
Frequently Asked Questions
How do genetic testing companies like 23andMe make money from user data?
Companies like 23andMe primarily monetize aggregated genetic data by partnering with pharmaceutical, biotech, and research firms. They provide these partners with access to large, de-identified datasets for research and drug development. Deals like 23andMe’s $300 million partnership with GlaxoSmithKline and Ancestry’s $4.7 billion acquisition by Blackstone demonstrate the significant value placed on these data troves for research access.
What happens to my genetic data if a company like 23andMe faces bankruptcy or is sold?
If a direct-to-consumer genetic testing company like 23andMe faces bankruptcy or is sold, your data, considered a valuable asset, can potentially be transferred to the acquiring entity. While companies’ privacy policies often state how data is handled in such events, legal experts caution that a new owner may not be strictly bound by the previous terms and could change them, potentially exposing data to different uses than originally consented to.
Is my genetic data safe with direct-to-consumer testing companies, and what are the risks?
While companies implement security measures, risks exist. Recent data breaches, like the one affecting 23andMe’s users in 2023, highlight security vulnerabilities. Your data could be vulnerable to re-identification, misuse, or access by third parties, including potentially law enforcement (though 23andMe has resisted this). Federal laws like HIPAA and GINA offer limited protection for DTC data, leaving users largely relying on company policies and state-specific laws, which vary.
In conclusion, the value of your genetic data is complex and fluctuating. While once seen as a goldmine for research, its worth is heavily dependent on context like health records and scale. Companies like 23andMe built massive databases, leading to lucrative partnerships, but also revealing critical privacy vulnerabilities, particularly as they face financial instability and bankruptcy. The debate continues over data ownership, the need for stronger regulation, and how to ensure that as genetic science advances, the power over this deeply personal information remains with the individual.
