You probably wouldn’t hand out your social security number without having a pretty good idea of how that information was going to be used, right? That would be dumb. It’s extremely sensitive information. And yet, the consumer genetic testing market is booming thanks to people readily giving up another piece of their identity: their genetic code.
Ever-cheaper DNA sequencing technology has allowed genetic testing to become far more than a tool for doctors. Genetic testing has become entertainment, with companies offering tests that provide insight into ancestry, athletic ability, sleep habits and much more. The consumer genetic testing market was valued at $70 million in 2015, but estimates expect it to expand to $340 million by 2022.
When you spit in a test tube in in hopes of finding out about your ancestry or health or that perfect, genetically optimized bottle of wine, you’re giving companies access to some very intimate details about what makes you, you. Your genes don’t determine everything about who you are, but they do contain revealing information about your health, relationships, personality, and family history that, like a social security number, could be easily abused. Not only that—your genes reveal all of that information about other people you’re related to, too.
Despite all that, we’re guessing that when you signed up for Ancestry or 23andMe, you probably didn’t read the fine print to find out what, exactly, those companies plan to do with your data. We can’t blame you—they’re long, boring polices written in legalese that’s difficult to understand. If you actually read those policies, though, you might not have gone ahead with the test. It turns out that the breadth of rights you are giving away to your DNA is kind of terrifying.
Lucky for you, Gizmodo slogged though every line of Ancestry.com, 23andMe, and Helix’s privacy, terms of service, and research policies with the help of experts in privacy, law and consumer protection. It wasn’t fun. We fell asleep at least once. And what we found wasn’t pretty.
“It’s basically like you have no privacy, they’re taking it all,” said Joel Winston, a consumer protection lawyer. “When it comes to DNA tests, don’t assume you have any rights.”
In general, it’s always a good idea to read the terms before you click. But because we know there’s a good chance you won’t, here’s what you need to know before giving away your genetic information.
Testing companies can claim ownership of your DNA
Okay, so your DNA is inside of you. A corporation can’t really claim ownership of it. But they can claim ownership of the DNA sample you send them, and the analysis they run on it, including the resulting information on the makeup of your genome.
When it comes to Ancestry, while the company recently revised its policy to state that it “does not claim any ownership rights in the DNA that is submitted for testing,” another clause in its policies asserts that even if they don’t actually own your DNA, the company can use that DNA basically however it wants:
“By submitting DNA to AncestryDNA, you grant AncestryDNA and the Ancestry Group Companies a royalty-free, worldwide, sublicensable, transferable license to host, transfer, process, analyze, distribute, and communicate your Genetic Information for the purposes of providing you products and services, conducting Ancestry’s research and product development, enhancing Ancestry’s user experience, and making and offering personalized products and services.”
If that language sounds scary, that’s because it is.
“This is a huge red flag,” said Winston. “Even though Ancestry says they don’t really own your DNA—which is true, because they can’t take it from you—they now own rights to it. They could test it in a 100 years from their freezer for whatever purpose they want.”
In response, an Ancestry spokesperson emphasized to Gizmodo that AncestryDNA does not claim ownership rights to customer DNA. When pressed, though, the spokesperson conceded that it is “broadly correct” that the license it claims on your data allows the company the perks of ownership.
“We couldn’t send samples to the lab to be analyzed, transmit the results, etc. if we didn’t have a license,” the spokesperson said. “None of that supersedes the fact the we don’t, and will not, share data for research or commercial purposes with third parties without a customer agreeing to an Informed Consent. If they don’t want us to have a license any longer, they can delete their account or ask us to delete their data. If they don’t want their data shared, they can decline the consent.”