The Risky Business of DNA At-Home Test Kits

By Lindsey Sweetgall-Brock, Staff Editor

As at-home DNA test kits grow in popularity, consumers need to be aware of what is happening to their genetic information after sharing it with the company. Some answers may lie in the consent forms and privacy information, but what about privacy risks that are not shared with the consumer?

At-home genetic testing companies started with a simple goal: to make testing affordable to the public.[1] MIT Technology Review called 2017 “The Year Consumer DNA Testing Blew Up.”[2] Its research showed that more people had their DNA tested in that single year than all previous years combined.[3] This developing industry comes with substantial risks. Three years later, the general public is beginning to wonder about potential privacy concerns and where their genetic information is ending up.[4]

On February 4, Law professor Elizabeth Joh tweeted, “First rule of data: once you hand it over, you lose control of it. You have no idea how the terms of service will change for your ‘recreational’ DNA sample.”[5] This unsettling statement captures the concerns that desperately need to be addressed in privacy regulations today.

When consumers are selecting the at-home DNA test kit they would like to receive, they are prompted to fill out a typical consent form.[6] However, consumers may be unaware of the choice to not have their test information shared.[7] Statistics show that more than eighty percent of 23andMe users check the opt-in box, though it is not required to use the service.[8] Due to ambiguous terms and language, the average consumer has no idea exactly what they are consenting to, and how the information will be shared.

For example,’s “Informed Consent” page reads: “Your consent to participate in this research is completely voluntary and is not required to use any of our products or services. Even if you consent to participate in the research, you may withdraw your consent at any time, but your information will not be removed from research that is in progress or completed.”[9] Once the consumer has agreed to the company’s DNA sharing process, whether knowingly or not, there is essentially no way to turn back from the mass of privacy issues that lie ahead.

At-home DNA test kits usually involve placing a simple cheek swab or a not-so-glamourous saliva sample into a tube and mailing it off to the company of choice. The reward for such a simple task is a link to the past through a genealogy analysis, diseases an individual is most susceptible to, even suggested dietary restrictions. All an individual must do is provide one thing, their genetic code. Once the proverbial cat is out of the bag, these companies have a whole host of business opportunities, as there is no regulation to stop the sale of customer DNA to third parties, law enforcement, and even life insurance companies.[10] Third party buyers range from big pharmaceutical companies to public research groups, like state universities, meaning many things are being done to genetic information without further consent or notice to the individual.[11] Bioethics professor Udo Schuklenk notes that, “the very set-up of this venture suggests that its initiators are not quite serious about 23andMe’s customer’s informed consent.”[12]

These companies tout the fact that consumers may revoke consent to have the DNA shared with third parties.[13] However, it is essentially impossible to trace the places that have already received the genetic information, let alone fully eradicate it if the consumer revokes consent. Other provisions of the consent form allow the company itself to store the sample and use again in the future regardless of consent revocation.[14] Companies give consumers a false sense of security by stating that no personal information is sold with the genetic data.[15] Unfortunately, genetic data is entirely personal. In 2013, using only an internet connection and a database of genetic information, researchers were able to identify a number of participants from a genomic study.[16]

Massive problems are in store for the consumers in the genetic testing industry if protections are not adopted quickly. Genetic testing is a popular and expansive industry in the United States. It needs to be regulated to protect consumers. Future implications could include discrimination by employers, insurance companies, doctors, spouses, landlords and more. As rapidly as technology advancements grow, regulations need to be put in place before issues become too big to quash.


[1] Julian Segert, Understanding Ownership and Privacy of Genetic Data, SCIENCE IN THE NEWS (Nov. 28, 2018)

[2] Eric Ravenscraft, How to Protect Your DNA Data Before and After Taking an at-Home Test, N.Y. TIMES (June 12, 2019)

[3] Id.

[4] Id.

[5] Antonio Regalado, More Than 26 Million People Have Taken an At-Home Ancestry Test,  MIT Technology Review (Feb. 11, 2019)

[6] 23andMe’s New Research Overview Page, 23andMeBlog (Sept. 26, 2018)

[7] Do You Have Privacy Conerns About DNA Test Kits? Here’s What You Need to Know, Tech Times (April 11, 2019)

[8] 23andMe’s New Research Overview Page, 23andMeBlog (Sept. 26, 2018)

[9] AncestryDNA Informed Consent, AncestryDNA

[10] Megan Molteni, The US Urgently Needs New Genetic Privacy Laws, WIRED (May 1, 2019)

[11] AncestryDNA Informed Consent, AncestryDNA

[12] Id.

[13] Research Participation And Consent, 23andMe

[14] Eric Ravenscraft, How to Protect Your DNA Data Before and After Taking an at-Home Test, N.Y. TIMES (June 12, 2019)

[15] Greg Miller, Scientists Discover How to Identify People From ‘Anonymous’ Genomes, Wired (Jan. 17, 2013)

[16] Id.