“COPS, AI, pharmaceutical companies”: Who wants to buy your DNA at 23andm?

The bankruptcy of the Personal Genomics Society 23andme is a title that has exceeded the well -adorned mist of the business world – given, of course, its existential implications for millions of genetic information from Americans. The company, founded in San Francisco 2006, and having served 15 million people to date, is part of a handful of genetic testing companies whose customers send a letter in a cotton of their saliva.

This tiny DNA sample can be used to generate a multitude of complete reports on a person’s ancestry, genetic health risks and even how they deal with certain drugs. Earlier this week, 23andme announced that it would file a bankruptcy procedure in Chapter 11, which would imply the sale of the most sensitive biological data of these consumers to the most offering.

This raises a monumental question: who wants to buy your DNA, and why?

If you hoped that 23andme would inaugurate a long line of buyers who wish to use the data to finally cure cancer, complete. Companies and agencies that are most likely to be interested in 23andme data represent a list of cops of cops, AI startups and pharmaceutical companies. And because DNA and collected by genetic test companies are not protected by the law on health insurance and liability (HIPAA) – confidentiality laws that establish robust standards for providers and insurers, medical data management – sensitive genetic information for users are also at risk to be armed for a number of harmful ends.

“The data could be used and reused for a number of consumer targeting efforts – marketing and blackmail advertising,” Salon Rennie Westcott, senior intelligence analyst at Blackbird.ai.

Darren Williams, an expert in data confidentiality and founder of the BlackFog antivirus software, told Salon in an email that genetic data of 23andm could potentially be used “for identity flight or other malicious purposes, potentially for years”.

As mentioned, 23andme customers first pay online service, then send the company a swab from their saliva. In addition to customer genetic information, 23andme is also in possession of other very sensitive data, “in-depth questionnaires and additional metadata on individuals,” Erika Gray, co-founder and chief doctor of Toolbox Genomics.

“Although the practices of the current genetic industry and 23andme keep their raw data identified, there is a risk that the disidentified data can be re -identified with correct entries, and in particular with the large 23andme questionnaire and` `find your parent ”,” said Gray.

Organizations responsible for the application of laws “from local to state to the federal government” could be “very interested” in the 23andme genetic information troft, a lawyer Adanté Pointer, lawyer for civil rights in Oakland, told Salon. “The fact of being able to access 23andme gives them a more important database of genetic information that they currently have to match a potential suspect, a victim or even a witness to a particular incident on which they investigate,” said Pointer.

Those who have sent their genetic samples to 23 and “may have renounced the right to affirm that constitutional interest in the database or the sample,” said the long and often neglected private derogations of society may also have renounced the rights of individuals.

---

Do you want more health and science stories in your reception box? Subscribe to weekly notes of lounge bulletin.

---

“I imagine that in the consent form, there is a language allowing 23 and its subsidiaries, its sparkling companies or even a company that buys the 23andme assets (including the DNA database), to use this data as they wish,” added Pointer.

The pointer is not unrelated to the use by the police forces genetic information from other sources. In 2022, he represented a woman whose DNA provided in a rape kit which was then used to stop him six years later for a retail flight. The plaintiff, identified as Jane Doe, said that before providing a DNA sample to the San Francisco police service, the authorities assured her that her DNA would be used “only to investigate her sexual assault”. The case finally settled amicably, the DOE being paid about $ 200,000 by the city, said in Salon.

Customer genetic data could also be attractive for companies that serve law enforcement agencies – which have a “ready -to -use customers” of agencies already equipped to process genetic information, said Pointer.

The organizations responsible for the application of laws have long expressed interests in the company’s DNA actions. 23andme received 15 requests from the police between 2015 and 2024, which refused them all. This policy may change, according to whom buys this data from the exit sale of companies of 23andme.

Apart from the police, AI companies could use genetic information to train their data sets. “Cybercriminals are already using a generative AI to automate attacks, and large genetic data sets like this offer a new border,” an email and member of the FBI and the working group on the cybersecurity of the secret service.

Pharmaceutical companies and precision medicine companies could also use data to develop new drugs. It would not be the first time that 23andme user data would have been used by drug manufacturers: in 2018, the Glaxosmithkline pharmaceutical giant bought a $ 300 million stake in 23andme, in exchange for capacity “to extract its genetic database for new therapies”.

Another genetic test company could also be interested – although it is unlikely, since consumer demand has decreased for DNA kits since the height of the pandemic, in 2021. It is logical: those who have their analyzed data really require the service, which means that there are a limited number of people probably to become customers.

“This data is probably more immediate value for developers and drug manufacturers, and therefore the pharmacy is a place of landing probably,” said Westcott. It is a scary moment for consumers of 23 ETME. And in large part, such a sale of data would not represent anything new for the private market or regulators.

“This is not new in practice – user data is purchased and sold constantly without any notification to the user,” said Westcott. In 2020, the Blackstone capital -investment giant paid $ 4 billion for ancestry.com – just a high -level public example.

But given that 23andm himself would be acquired in bankruptcy procedures, “the sale of genetic data is somewhat not tested and not counted for the territory from a legal point of view, and the sale of consumption data in the United States has historically faced less regulatory road dams,” said Westcott.

In this sense, this moment also represents a chance to establish a precedent of strong consumer protections around sales wrapped in sensitive biological data.

“Governments and regulators must now intervene – with clear protocols, independent surveillance and enforceable guarantees – before all data changes hands,” said Nicoletti. “Once this type of information is disclosed, it is there forever.

It is not much comforting to think about which of these buyers could possibly take possession of around 4.4% of the genetic information of Americans – and, by proxy, the genetic information of their loved ones. Many guides exist by informing customers how to delete their 23andme data before the company is sold (here is the most practical guide I found on how to purge your genetic information from its database.) But even for customers who do everything they can to protect themselves, they are always vulnerable.

“Although consumers can hope that genetic equipment is deleted and not preserved by 23andme, it would be naive,” warned point. “Once the information is in a database and is shared on servers or affiliates, it may exist in several locations.”

In Utah, Gray and his mother were one of the many users who opted for the data used for “research”, she said. “Unfortunately, for people like me and my family, the way the research contribution was represented is that it would benefit society as a whole,” she said. For users who have chosen to opt for research, the company was authorized to “analyze our disidentified data and possibly sell it to third parties,” said Gray.

In a message to customers, 23andme said that his leadership would approach the sales process and “seek to secure a partner that shares its commitment to customer data confidentiality and further will help people access, understand and benefit from the human genome”.

It doesn’t mean much, Westcott said. “23 & I publicly undertake to find a buyer who shares an interest in protecting the confidentiality of customer data, but it is only a declaration and does not in any way bind the potential buyer,” she said. A 23andm spokesperson would not comment on what the company could do with its data beyond the “general statements on its commitment to privacy”.

Surprisingly, the company always works as usual – and always welcomes you to put your personal data back. “23andme is still open to business,” he told customers in an open letter.