When a home DNA testing company fails...
17:28 Share

This BBC podcast is supported by ads outside the UK.

This formula supports all three tear film layers and provides advanced hydration to instantly moisturize and soothe dry eyes. Refresh Optiv Mega 3 is safe to use as often as needed, so you can make it part of your wellness routine. Find Refresh online or in the eyedrop section at all major retailers. FSA and HSA eligible. So you want to start a business?

You might think you need a team of people and fancy tech skills, but listen to me when I say you don't. You just need GoDaddy Arrow. I'm Walton Goggins, an actor, and I like the sound of starting my own business, Walton Goggins Goggle Glasses. But I couldn't do this on my own.

GoDaddy Arrow uses AI to create everything you need to grow a business. It'll make you a unique logo. It'll create a custom website. It'll write social posts for you and even set you up with a social media calendar. How cool is that? Well, listen to this.

For a limited time, you can get Aero All Access for just a dollar a week for 12 weeks. We're talking all the AI power of GoDaddy Aero plus a domain, e-commerce store, payments, professional email, a unified inbox, all for less money than I spend on deep tanning lotion while sunbathing off the Amalfi Coast. You know what that sounds like? A plan. Get started at GoDaddy.com. Terms apply. Hello and welcome to Business Daily from the BBC World Service with me, David Reid.

Today, the story of a DNA testing company that four years ago was valued at $6 billion but is now bankrupt. 23andMe was going to be the next big thing. How did it then become the next big thing to fail?

There are only so many people who want to use the service. And ultimately, like, they did run into a roadblock in getting new customers. And what about all that sensitive data containing millions of people's DNA? How informed was the consent when the data was gathered in the first place? And did it take a police manhunt for a serial killer to finally wake the public up to the risks posed by online genetic databases?

I didn't know that it was going to be sold to like pharmaceutical companies. Yes, I did feel, I did feel duped. I felt like, oh, you know, you could have told me. Most people really weren't thinking about the risks. But at that time, the Golden State Killer case broke. And that began to really raise a lot of questions around disclosing one's DNA in a more public way and what the implications of that were on a broader scale.

Many of us have questions about who we really are. In the past few years, at-home DNA testing has been riding an extraordinary wave of publicity. Night and day, questioning, who am I? TV and radio has fed us the most incredibly compelling stories. Now amazing advances in DNA technology.

Send in a saliva sample and wait a few weeks for your life to be upended by long-lost relatives, undisclosed infidelities, even a new ethnic identity. This is the perfect time for the secret to end. One of the leading outfits delivering up these results was the genetic testing company 23andMe.

It's the one Jamila Zeng chose to satisfy her curiosity about her family tree, especially as Jamila is African-American and large chunks of her family history were wiped out with slavery. I've traced all the way back to like the early 1800s and then it gets cold.

But Jamila's DNA results did help her locate the town her African genes were from and even root out relatives there. It's like living in a cloud of I'm African-American and that's all I know to, oh my gosh, like there was like, you know, thousands, tens of thousands of years worth of ancestry that came from Nigeria, that came from West Africa. So it was...

It was eye-opening and definitely a shocker. Well, today is the day that I am going to Nigeria. Jamila even visited her new relatives in Nigeria and has become involved with African friendship groups near where she lives in the States. Her DNA journey has been fascinating and enriching. And all that from one test.

And that's the problem for DNA testing companies. No repeat trade. Once a customer's taken a test, there's not much point in taking another, as the product they're selling you is your own genetic profile, and that doesn't change.

Ultimately, what they offer is an interesting service that has a limited value. My name is Jason Kelly, and I'm the activism director at the Electronic Frontier Foundation. EFF campaigns for digital privacy and civil rights online. There are only so many people who want to use the service, and they did run into a roadblock in getting new customers. As you or someone in your family gets a test,

There's not a need for you to get another test. Usually the people in your family are going to have basically the exact same results that you do. But 23andMe was also making money from something else.

The company was founded in 2006 by Ann Wojcicki, at that time married to Google's founder, Sergey Brin. 23andMe was very much a Silicon Valley offshoot. Sure, it sold ancestry tests, but also monetized its vast database of genetic information through lucrative deals with big pharmaceutical companies.

23andMe's chief scientist said to Forbes magazine in 2019, it was genius that customers were paying the company to build its database. People, he said, want their data to be used and to help scientific discoveries. If you ask Jamila, that's true, but only up to a point.

I did sign up for it to be used for medical research initially because I believe in helping. Like if it's going to help someone, then sure. I didn't know that it was going to be sold to like pharmaceutical companies or working with them. I was thinking, you know, for research purposes, you know, for the greater good. And yes, I did feel, I did feel duped. I felt like, oh, you know, you could have told me.

So Jamila withdrew consent for her DNA, her genome, to be used for drug development by pharmaceuticals like the British company GSK, which made an equity investment of $300 million in 23andMe in 2018. I actually originally studied 23andMe around 2016 to 17. And I interviewed some of those early adopters of the service.

I am Dr. Jennifer King. I am the Privacy and Data Policy Fellow at the Stanford Institute for Human-Centered Artificial Intelligence. One of the things that people were particularly motivated by was this idea that they were contributing to a project that was about the common good and trying to find potential pharmaceuticals or medical treatments that

For the benefit of humanity, I don't think they were as upfront about the commercial aspect of the research as they could have been with a lot of the customers because they absolutely front and centered the nonprofit university collaborations, for example. But what they were less

upfront about, although again, if you dug, you could find it, were the partnerships with big pharmaceutical companies and so on. And with those, they were a lot less descriptive and informative about the types of things they were doing. Now, you could look at pharmaceutical companies as performing a vital social role, directing the profits from the drugs they sell into developing more medicines for more illnesses for the good of all of us.

But not everyone sees Big Pharma this way. Many see it as prioritising profits over patient welfare. It's why perhaps, as Jen King suggested, 23andMe didn't headline these tie-ups, but left some users, Jamila included, with the impression the research may have been an academic collaboration, a non-profit. I was thinking more in a research-type setting, you know, for the greater good, and it's more for...

So, yeah, that's when I went in and changed it. But this only partly explains the concerns over 23andMe and its database. Already, public attitudes to online DNA databases in the States were shifting, and particularly between 2016 and 2018, as a result of a police manhunt to catch a notorious serial murderer. At that time, the Golden State Killer case broke.

You're listening to Business Daily on the BBC World Service. I'm David Reid and today we're looking at the fall of 23andMe and how public awareness of the risks of online DNA databases altered radically during a police hunt for a Californian serial killer. ...seems to be straight out of the pages of a horrific crime novel...

In August 2020, Joseph DeAngelo was sentenced to life in prison for multiple murders and kidnappings he committed in the 1970s and 80s. The culmination of an investigation relaunched four years earlier

Californian cops had finally tracked the 74-year-old down by running crime scene DNA through an online genetic database called GEDmatch. He was only caught by a quirk of modern technology. Investigators found a large pool of people directly related to D'Angelo's four-times-great-grandfather,

The family tree that led to the killer contained 1,000 people. He was sentenced to spend the rest of his life in prison. Okay, so it was obviously a good thing to track down a murderer like D'Angelo.

But for GEDmatch users, well, many didn't appreciate being caught up in a police manhunt, nor to find out they were related, however distantly, to a mass murderer. It wasn't exactly the DNA surprise they'd signed up for. In fact, the company was roundly criticised for failing to protect customer privacy and permitting police to compare DNA without user consent and despite specific opt-outs.

And that began to really raise a lot of questions around disclosing one's DNA in a more public way and what the implications of that were on a broader scale. And until that happened, it was really difficult, I think, for most people to grasp what the potential risk was.

And things got even more real for 23andMe users when, in 2023, the company suffered a huge data breach affecting some 7 million customers. Reports that hackers were trying to sell curated lists of Ashkenazi Jewish and Chinese genetic information on the dark web weren't just off-the-scale creepy, but also further underlined how compromising this kind of data can be in the wrong hands. Jason Kelly again.

This kind of genetic information is immutable. It doesn't change no matter what you do. You know, your genetic data is basically going to be the same. It's not like a credit card. And it has leaked. People thought, oh, well, you're getting this neat data and you're learning about your history. And now more people are realizing, oh, there's actually a value to this and a danger to it.

23andMe compensated users for the breach. By now, the company, which had never turned a profit, was in trouble. Valued at $6 billion in 2021, after the breach, its value plummeted. In March this year, 23andMe filed for bankruptcy, raising questions about the future of the database.

According to her 2016 research, the users Jen King interviewed never saw this coming.

It's especially ironic that we're having this conversation now because when I asked people about this possibility that the company could disappear, go bankrupt one day, it was absolutely just not on anybody's minds that this could happen. I think it was because of that clear Silicon Valley relationship with Google, with this impression that they had very deep pockets. Nobody was at all speculating that this was a future they saw for the company.

There's a recurring theme here, isn't there? Things looking far worse today than they did yesterday when people signed up. Whether it's the Golden State dragnet, Big Pharma, the hacked database, or placing your faith in DNA in a company from Silicon Valley's winner's enclosure that then goes belly up, well, if your DNA is mixed up in this, then buyer's remorse doesn't really cover it.

The direction of travel is so clear here that you could question whether user consent was adequately informed and valid.

The clarity of the consent shifted over time. The company, I think, did not do a great job at really making it clear to people just the extent to which disclosing one's DNA also ends up disclosing the DNA, or at least of connecting all of your potentially living relatives. At the point when I was interviewing people, that was just not very well understood. So

So in that sense, it was not truly informed consent of the mind I think of when you're participating in an academic research study or undergoing a medical procedure where they're obligated to talk through all of the risks and the repercussions that can happen to you. The research piece of the house, they never really disclosed, as far as I recall, all of the risks necessarily in donating your data.

Which is perhaps why, when a court decided that 23andMe's database of human genomes was a saleable asset, users were allowed to delete their DNA and profiles before the sale. When I spoke to Jamila Zeng in the run-up to last month's auction, she was pretty sure what she wanted to do.

Everyone is quite concerned that I've talked to. I've heard a lot online of other people, like there's different groups that I'm in, in Facebook and things who are deleting or have already deleted. So I get the feeling that a lot of people will, in fact, delete just like I plan to for us.

Around 15% of 23andMe customers are estimated to have done the same thing. Now, the auction. To cut a long and complicated story short, it now appears that former 23andMe CEO Anne Wojcicki has won. Her non-profit TAM Research Institute has bought 23andMe for $305 million. An unnamed Fortune 500 company is also reported to have lent a hand.

The deal is expected to close in the coming weeks, but not before a number of US states, more than two dozen in fact, challenge the sale of customer data in court. Tam has said it will uphold existing privacy policies and data protection laws. The Electronic Frontier Foundation's Jason Kelly is still worried.

There's a danger in the data privacy concerns. There's a danger in where it gets sold. We still need to make sure this data doesn't leak. We still need to make sure that the companies that use it don't share it with law enforcement at the drop of a hat. Because, I mean, for us, that amounts to, at EFF, essentially a warrantless search, a dragnet warrantless search of, you know, everyone's most sensitive data.

I think that this could potentially have an impact on the whole personal genetic testing field. We approached 23andMe. To paraphrase, they said they've been transparent about risks to users. The extent of collaborations, including with pharmaceutical companies, they say they have strict privacy policies and continually invest in safeguarding user data.

But is there another way of going about this outside of the current corporate setup so this most sensitive data can be used to research genetics and medicines but without the catalogue of issues we've heard about? Dr Jennifer King has some ideas.

So on that consumer genetic space, I think we've already seen the peak. Whether we're going to see other big pharma companies be able to generate the type of interest and trust and motivation for people to participate, I think that's an open question. I don't think it's impossible though. If

The companies were willing to potentially build a shared database that was held under like a nonprofit trust, for example, that was really built from the start as a data collaborative that was really intended to help with kind of global genetic drug discovery. Then I think it's entirely possible. I just don't see why any one company would necessarily be the one that the public would be excited to contribute to.

It is an interesting idea, especially if it makes clear exactly how DNA will be used, rather than leaving it to the public to decipher the often weaselly legalese of company terms and conditions. Recently, the UK's Information Commission have fined 23andMe £2.3 million for its, quote, profoundly damaging data breach. A non-profit trust would need the technical chops to reassure people it's safe to share their DNA.

That's all from Business Daily for today. And from me, David Reid, thanks so much for listening.

Go on, get a little out there into the big heart of Nevada, where you can go off road and off the map on two lakes or on horseback. Dip into hot springs and dive into deserts. Climb a mountain or make your best effort. See thousands of stars in some of the darkest skies. Stake out haunted hotels. Can you make it to sunrise? There's always something new to see because we've got plenty of space to just be. Plan your trip at TravelNevada.com.

So you want to start a business. You might think you need a team of people and fancy tech skills, but listen to me when I say you don't. You just need GoDaddy Arrow. I'm Walton Goggins, an actor, and I like the sound of starting my own business, Walton Goggins Goggle Glasses. But I couldn't do this on my own.

GoDaddy Arrow uses AI to create everything you need to grow a business. It'll make you a unique logo. It'll create a custom website. It'll write social posts for you and even set you up with a social media calendar. How cool is that?

Well, listen to this. For a limited time, you can get Aero All Access for just $1 a week for 12 weeks. We're talking all the AI power of GoDaddy Aero plus a domain, e-commerce store, payments, professional email, a unified inbox, all for less money than I spend on deep tanning lotion while sunbathing off the Amalfi Coast. You know what that sounds like? A plan. Get started at GoDaddy.com. Terms apply.

If you've never been to the Presidio, San Francisco's very own national park site, consider this your invitation to visit and bring your own. Bring your own flavor for a barbecue with views of the Golden Gate Bridge. Bring your own imagination and explore the exciting Presidio Tunnel Tops. Bring your own curiosity and discover miles of trails, beaches, food trucks, free events, and more. Plan your visit at Presidio.gov.