People sometimes ask in genealogy forums whether 23andMe sell your DNA. The quick answer is that they do, but only if you consent to this. Most of their customers do.
This article covers who 23andMe sells or shares your DNA with, and what limits are in place for your protection.
Does 23andMe Sell Your DNA?
23andMe sells or shares aggregated anonymized data for research into disease and pharmaceutical remedies.
Data from your DNA will be included if you consent to participate in 23andMe’s research studies. Your personal information is removed from the data which is then pooled and summarized.
When the summarized data is provided to third parties, they have no access to your identity or your 23andMe account.
What does “aggregated” actually mean?
You’ll see the term “aggregated” often used when describing the use of 23andMe data. But what does that actually mean?
The researchers want as much similar DNA data that they can get. A higher volume improves the accuracy of their research.
When they enter into agreements with 23andMe, they make specific requests. A request will go something like this:
Provide summarized DNA from specific locations on the 15th chromosome pair of 10,000 samples of West European heritage.
Your part of this data is simply labeled as something like sample #9,528.
Who Does 23andMe Sell Or Share DNA With?
23andMe enters commercial agreements to provide anonymized genetic data with a range of pharmaceutical companies.
They also share DNA with non-profit organizations such as academic institutions and philanthropic organizations.
GlaxoSmithKline was the first massive commercial arrangement that 23andMe entered into. The pharmaceutical giant spent $300 million in 2018 to take shares in 23andMe.
In return, their researchers got access to anonymized genetic data from 23andMe customers.
At the time, 23andMe send emails to every customer to inform them of this arrangement. I was already a customer and received this communication. We were reminded that we could opt-out of participating in all research and given instructions on how to do so.
Some commentators were critical that 23andMe didn’t follow a double opt-in process. In other words, the company didn’t require customers to opt in again after this major event.
Other pharmaceutical companies
Aside from GSK, 23andMe has entered commercial agreements with several other pharmaceutical companies.
For example, they started collaborating in 2017 with Genentech to research potential drugs for Parkinson’s disease.
In 2020, 23andMe licensed a Spanish pharmaceutical company to develop a new drug based on their research. This targets conditions like psoriasis and Crohn’s disease.
Other big companies include Biogen and Pfizer.
23andMe also shares data with some non-profit organizations with research expertise.
This includes Stanford University and the Michael J. Fox Foundation.
Does 23andMe Sell Data To Insurance Companies?
A big concern for many people is that their DNA information is sold to insurance companies who will use the data to make decisions on health cover.
So, people ask the question: does 23andMe sell to insurance firms for this purpose? The answer is no. 23andMe does not sell data to insurance companies.
Let’s hear from their Privacy Officer:
23andMe does not sell customers’ personal information…we do not share customer information with insurance companies or employers.Jacquie Haggarty, 23andMe Privacy Officer, 2021
To be fair to the skeptics, words are cheap. To be fair to 23andMe, they have backed up their words with actions.
23andMe were active supporters of the development of the GINA act. This is the Genetic Information Nondiscrimination Act of 2008. It prevents using genetic data to discriminate in some forms of health insurance.
Following that, they also supported a similar California act enacted in 2011.
Possible Future Changes To Laws Governing Insurance Firms
What if the U.S. laws that prevent insurance companies from genetic discrimination are changed?
What if the U.S. laws are changed so that they can demand you show them your 23andMe health reports before they provide cover?
If this question worries you, then consider how worried companies like 23andMe would be. Their business would collapse if this came about.
I don’t live in the United States, so this specific question doesn’t affect me. I simply don’t believe it would be allowed in my country in my lifetime. And after all, I have a vote.
If you’re American, then so do you.
Does 23andMe Give Your DNA To Law Enforcement?
Some DNA companies encourage law enforcement agencies to use their DNA databases to assist criminal investigations. Their customers can opt out of unfettered access, but the general policy is of co-operation.
23andMe is not one of these companies. They actively discourage the use of their services for law enforcement purposes.
However, the company must comply with legitimate requests backed by court orders, search warrants, or subpoenas.
23andMe publishes information about how many legal requests they have received. This shows that it’s a very small number.
When I looked at the figures in 2021, they had received requests for 11 individuals in six years. You can see the report yourself here.
Does 23andMe Share Data With The Government?
The previous section has covered how 23andMe restricts access to law enforcement agencies.
The company does collaborate with some universities and research institutions. These research studies can cover aspects of public health, which of course are of interest to national health institutions.
The academic studies may be partly funded with government monies.
However, that doesn’t mean that government institutions can use your DNA against you. All DNA data shared with third parties is anonymized. Your personal details are not included.
What If the Ownership Changes?
What if the company changes hands and the new owners decide to disregard your consent choices? Sell all your data to anyone who comes looking for it?
Your consumer rights protect you from this kind of cowboy action. Your purchase was under a specific set of terms and conditions.
The new owners would have to approach you with changes. They can’t simply apply new conditions retrospectively.
If you want to learn more about who is in charge of the company, check out our article on the ownership of 23andMe.
Is 23andMe Data Safe?
The question is: could it be possible that hackers get at your DNA information through a security breach?
Personally, I think this is a more reasonable concern than nebulous worries that our DNA is being sold in bad faith.
After all, it has happened to other companies in the industry. I wrote about several security breaches reported by DNA companies in 2020.
23andMe wasn’t amongst those affected. But that doesn’t mean that it couldn’t happen.
However, the company is one of the market leaders in the industry. They have a reputation to protect, and undoubtedly put significant investment into information security. They are also certified by several independent security auditors.
23andMe encrypts your DNA data in the customer database. They also keep DNA records separate from account information.
This means that if one area was breached, the hackers couldn’t put specific DNA together with personal details.
Aside from the market leaders, several smaller companies offer DNA testing services. Personally, I would have some concerns about the ability of a small firm to fund the security infrastructure to keep my data safe. However, I don’t have concerns about 23andMe’s ability to keep data safe.
How To Protect Your Privacy
I’ve written an in-depth article on whether you can test your DNA with 23andMe anonymously.
Although complete anonymity isn’t possible, you’ll get a lot of tips on protecting your privacy.