Andelka Phillips* and Jan Charbonneau+
Would you give your banking password to a stranger? Obviously not … imagine what they could do with it! But thousands of consumers willingly give their most personal information – their DNA – to consumer genomics companies, trusting they will protect it. Whether consumers are buying tests because they are interested in learning about their ancestry or their health, their DNA and related personal data are likely to be used in ways that they will not anticipate and which pose privacy risks to them as individuals and to their wider family groups. This industry, however, has rarely taken privacy and security seriously, hiding behind extensive privacy policies & contracts full of legalese that consumers seldom read and, if they did, would understand.
An earlier blog,[1] encouraged readers to consider the risks of direct-to-consumer genetics testing (aka DTC or personal/consumer genomics), highlighting issues consumers should consider before purchasing these tests.
In this follow-up, we want to raise awareness about the very real threat to privacy that data breaches by this industry pose. We highlight the consequences of the 23andMe data breach and draw on findings from our online public survey (we are planning a further article for this Blog series about our survey later in 2025).
In 2023, the genetic data of almost 7 million 23andMe customers[2] was breached. Since the data breach, 23andMe has been faced with some 40 class actions filed in the USA,[3] and another in the Canadian province of British Columbia. In June 2024, a joint probe into the 23andMe breach was announced by the UK’s Information Commissioner’s Office (ICO) and the Privacy Commissioner of Canada (OPC), with investigations ongoing.[4] A $30 million settlement has recently been reached and approved in the US. However, consumers impacted by the breach may be eligible to claim up to $10,000 where they experienced ‘significant losses, such as identity theft’,[5] but may only receive $100 if their ‘health information was compromised.’ [6] There is also a strong possibility the company and its extensive genetic databases will be sold to another entity.
While the settlement figure is not insignificant overall, the amount that consumers can claim, including those who have been victims of identity theft, seems minimal. Remember, too, that the data released included genetic information, home addresses, dates of birth and photographs.[7] It is also important to recognise that for US consumers, having their health information compromised could impact their insurance coverage. Such a settlement highlights the reality that often victims of a data breach will have little recourse, even where they suffer substantial loss. The fact that this breach was facilitated by credential stuffing is also problematic. Credential stuffing occurs where an attacker obtains login details of users from other platforms[8] (eg. Google) and then uses those details to log on to another website.
This really highlights the need for businesses to pay more attention to their security practices and the design of their platforms if they are committed to protecting their consumers’ privacy. While allowing consumers to create accounts by linking them to larger platforms such as Google and Apple offers efficiency for consumers, it is a practice that ought to be banned in the context of services like these that handle sensitive information. While no system can be completely secure, using the same password and username for multiple websites is really not good security practice.
The aftermath of this breach has seen 23andMe’s financial position rapidly deteriorate with the company announcing plans to fire 40% of its employees in November 2024.[9] Unfortunately for consumers concerned about privacy, their data is included in the assets which could be sold on to another entity.[10]
Let’s be clear this is not the first time this has happened. It is not the first time the industry has experienced a data breach. Other prominent examples include MyHeritage, Vitagene, and Veritas Genetics.[11] MyHeritage was informed of the breach by a researcher who found a file on a private external server, which contained ‘email addresses and hashed passwords of 92,283,889 users,’[12] although according to the company, this did not involve disclosure of genetic data as this was stored on a separate system. It is still a very serious occurrence given the number of people involved and the fact that the company only learnt of the breach after being notified by an external researcher.
The Vitagene example (now 1Health) involved the exposure of genetic health data and information on medical conditions, as well as full names and dates of birth.[13] They have since been fined by the US Federal Trade Commission (FTC) (although the fine was only $75,000) and the FTC has also issued refunds to their customers.[14]
Furthermore, it is not the first time that a DTC company has been acquired by another entity. A good early example is that of Navigenics’ acquisition by Life Technologies in 2012.[15] Yet, the size of 23andMe’s database, which has reached 15 million and its previous partnerships with GenTech, Pfizer, and GlaxoSmithKline (the partnership with Glaxo was extended in October 2023)[16] does mean that the range of ways that consumers’ data could be used and shared is significantly increased. Given the number of consumers’ data that 23andMe has accumulated data sharing and data use has the potential to impact a much larger group of people who are related to the consumers and may not wish to have their data included in these systems. This creates a variety of unknown future risks for consumers and their wider family groups, which require further scrutiny and there is a real need for regulators to step in.
In 2022, we conducted an online public survey of 1000 New Zealanders and 1000 Australians exploring privacy perceptions in the context of DTC.[17] The Genepri survey included questions related to participants’ engagement with privacy policies using examples based on clauses from real policies. Genepri results showed high levels of support for governments to have laws in place to protect consumers’ genetic privacy (80% agreement) and for corporations to take responsibility for protecting their genetic data (77%).
Respondents also believed these companies would only share their data with consent – ‘I am confident my personal genetic results will only be shared with other people with my permission’ (54% agreement). They also believed that companies would keep their genetic samples and data secure (50% agreement). Respondents also expressed discomfort with a privacy policy which would allow sharing of data with ‘companies under common ownership, our partners and affiliates’ (60%). And they were also uncomfortable with clauses that would allow companies broad discretion to change their policies ‘at any time or from time to time’ (59%).
This trust and support for regulation is at odds with how the industry in fact operates. This is an industry that operates internationally and has primarily relied on self-regulation. It is also generally characterized by partnerships and mergers predominantly with the pharmaceutical industry, but also with Big Tech and the insurance industry, as well as examples of data sharing with law enforcement (eg. FamilyTreeDNA). The true range of uses of data and data sharing policies are often buried in lengthy contracts or privacy policies which consumers do not read. This means that the validity of consumers’ consent both in relation to how their genetic data and other forms of personal data are collected and used could be challenged. Several terms commonly included in these contracts are also challengeable on the basis of unfairness in the EU, the UK, Australia, and New Zealand, as these jurisdictions have very similar legislative control of unfair terms in consumer contracts. A broad variation clause allowing the company to change terms at its discretion is one particularly problematic example of a term that may be challengeable on this basis.[18]
In earlier work,[19] it was found that it was common for companies to deem consent to the use of their services through visiting the website, which is extremely problematic given the sensitive nature of these services. And this is a practice that continues. In our GenePri survey, 46% of participants agreed that they tended to ‘just click agree rather than reading changes to terms and conditions.’
This is of course not unique to this industry, but the sheer volume of contracts and privacy policies that consumers engage with mean that it is reasonable that a consumer may fail to read these documents. As with many other online services, the design of websites may also nudge consumers towards purchase rather than sufficiently highlighting the need to read the company’s terms. In other work, it was found that it was common for DTC companies to allow people to access their payment screens without ever viewing their contractual terms [20].
Unfortunately, those who have been impacted by the 23andMe data breach may have little real remedy. What is really needed quite urgently is better oversight of the industry by data protection and consumer regulators, together with better enforcement of existing laws, and improvement in business practices in relation to how consumers’ data is collected, shared, and protected. Given the sensitive nature of the data the industry relies on, reform of the privacy policies and contracts is also needed. This should include improving how these documents are presented to consumers. Privacy and security by design should not just be nice expressions, but mantras that businesses handling sensitive data take to the heart of their operations.
* Andelka Phillips is an academic affiliate at the Centre for Health, Law and Emerging Technologies (HeLEX), University of Oxford and Affiliate with the Bioethics Institute Ghent (BIG), Ghent University.
https://www.law.ox.ac.uk/people/andelka-phillips
+ Jan Charbonneau is an adjunct researcher at the Centre for Law & Genetics, Faculty of Law, University of Tasmania.
[1] Andelka M Phillips, ‘Hacking your DNA? Some things to consider before buying a DNA test online’ Health Law Blog Sweden (2 March 2024) https://healthlawsweden.blogg.lu.se/2024/03/02/hacking-your-dna-some-things-to-consider-before-buying-a-dna-test-online/ – this also mentionedan animated video that had been made as part of a Borrin Foundation funded project, this is available here https://youtu.be/wy5NILzn8ZE?si=xv68gNDV8Riu1Djj
[2] 23andMe and Ancestry.com represent the major players in consumer genomics. Other significant companies in this space are MyHeritage, FamilyTreeDNA, LivingDNA, as well as Orig3n. The industry has been characterised by frequent partnerships and mergers and for more on the wide variety of companies operating please see AM Phillips, ‘Data on Direct-to-Consumer Genetic Testing and DNA testing companies’ (Version 1.3) (2018) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.1183565
[3] A Jewett, ‘$30M 23andMe settlement resolves data breach multidistrict litigation’ Top Class Actions (20 September 2024) https://topclassactions.com/lawsuit-settlements/privacy/data-breach/30m-23andme-settlement-resolves-data-breach-multidistrict-litigation/
[4] ICO, “ICO to investigate 23andMe data breach with Canadian counterpart” ICO Statement (10 June 2024) <https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/06/ico-to-investigate-23andme-data-breach-with-canadian-counterpart/>.
[5] L Daniel, ‘23andMe To Pay Up To $10,000 To Data Breach Victims—Are You Eligible?’ Forbes (16 October 2024) https://www.forbes.com/sites/larsdaniel/2024/10/15/23andme-to-pay-up-to-10000-to-data-breach-victims-are-you-eligible/ ; see also S Alder, ‘23andMe Settles Data Breach Lawsuit for $30 Million’ The HIPAA Journal (16 September 2024) https://www.hipaajournal.com/23andme-class-action-data-breach-settlement/
[6] Alder, ‘23andMe Settles Data Breach Lawsuit for $30 Million’ The HIPAA Journal (16 September 2024) https://www.hipaajournal.com/23andme-class-action-data-breach-settlement/
[7] A Bronstad, ‘Judge Approves 23andMe’s $30M Data Breach Settlement – With Conditions’ The Recorder (6 December 2024) https://www.law.com/therecorder/2024/12/06/judge-approves-23andmes-30m-data-breach-settlement—with-conditions/ ; T Kika, ‘Could You Get $10,000 From 23andMe’s Data Breach Settlement? Here’s What to Know’ CNET (19 November 2024) https://www.cnet.com/personal-finance/could-you-get-10000-from-23andmes-data-breach-settlement-heres-what-to-know/
[8] For more on this, please see N Mueller, ‘Credential stuffing’ OWASP https://owasp.org/www-community/attacks/Credential_stuffing
[9] ‘23andMe announces layoffs totalling 40% of workforce, discontinues therapeutics division’ (12 November 2024) CBS News https://www.cbsnews.com/sanfrancisco/news/23andme-layoffs-job-cuts/
[10] James Purtill, ‘23andMe is on the verge of bankruptcy. It may be too late to delete your genetic data’ ABC News (17 October 2024) https://www.abc.net.au/news/science/2024-10-17/23andme-genetic-data-privacy-bankrupt-dna-test-ancestry/104455816
[11] S Ferguson, ‘MyHeritage Data Breach of 92M Accounts Raises Many Questions’ Dark Reading (6 June 2018) https://www.darkreading.com/cloud-security/myheritage-data-breach-of-92m-accounts-raises-many-questions ; Norton, ‘MyHeritage data breach exposes info of more than 92 million users’ Norton Security (8 August 2018) https://us.norton.com/blog/emerging-threats/myheritage-data-breach-exposes-info-of-more-than-92-million-user ; Arthur, ‘Lessons from the 23andMe Data Breach: Data Privacy in an Interconnected World’ heyData (19 December 2023) https://heydata.eu/en/magazine/lessons-from-the-23and-me-data-breach-data-privacy-in-an-interconnected-world
[12] Norton, ‘MyHeritage data breach exposes info of more than 92 million users’ (8 August 2026)
[13]Arthur, ‘Lessons from the 23andMe Data Breach: Data Privacy in an Interconnected World’ heyData (19 December 2023) https://heydata.eu/en/magazine/lessons-from-the-23and-me-data-breach-data-privacy-in-an-interconnected-world
[14] S Alder, ‘FTC Fines Genetic Testing Company for Data Privacy and Security Failures’ The HIPAA Journal (20 June 2023) https://www.hipaajournal.com/ftc-fines-genetic-testing-company-for-data-privacy-and-security-failures/ ; FTC, ‘FTC Sends Refunds to Consumers Deceived by Genetic Testing Firm 1Health …’ https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-sends-refunds-consumers-deceived-genetic-testing-firm-1healthio-over-data-deletion-security.
[15]AM Phillips, Buying Your Self on the Internet: Wrap Contracts and Personal Genomics (Edinburgh University Press, 2019), online: https://www.jstor.org/stable/10.3366/j.ctvnjbgvb p.120 and see Life Technologies Corporation, ‘Acquisition of Navigenics Expands Life Technologies’ Capabilities in Diagnostics’, PR News Wire (16 July 2012) https://www.prnewswire.com/news-releases/acquisition-of-navigenics-expands-life-technologies-capabilities-in-diagnostics-162631986.html.
[16] 23andMe, ‘23andMe Announces Collaboration Extension with a New Data Licensing Agreement with GSK’ (30 October 2023) https://investors.23andme.com/news-releases/news-release-details/23andme-announces-collaboration-extension-new-data-licensing
[17] We are grateful to Genomics Aotearoa and the University of Waikato for funding this project. The survey was hosted by Qualtrics who also provided respondents.
[18] Earlier work found that such clauses were quite common amongst DTC companies. 72% of the contracts in a review of 71 contracts from DTC companies marketing tests for health purposes included such a clause. See Phillips, Buying Your Self on the Internet: Wrap Contracts and Personal Genomics 182-3.
[19] Phillips, Buying Your Self on the Internet: Wrap Contracts and Personal Genomics 203, 204, 207.
[20] Samuel I Becher and Andelka M Phillips, ‘Data Rights and Consumer Contracts: The Case of Personal Genomic Services’ in Damian Clifford, Kwan Ho Lau, Jeannie M. Paterson (eds), Data Rights and Private Law (Hart Publishing, 2023) 83-101, 99.
Comments