Update: May 25, 2018 – Please note that with the advent of the GDPR legislation in Europe, this article is no longer current. Please read each company’s current statements about privacy and terms of service to understand their policies.
_____
Are you aware that when you purchase a DNA kit for genealogy testing through either 23andMe or Ancestry that you are literally giving these companies carte blanche to your DNA, the rights to your DNA information, including for medical utilization meaning sales to Big Pharm, and there is absolutely no opt-out, meaning they can in essence do anything they want with your anonymized data?

Both companies also have a higher research participation level that you can choose to participate in, or opt out of, that grants them permission to sell or otherwise utilize your non-anonymized data, meaning your identity is attached to that information.

However, opting out of his higher level DOES NOT stop the company from utilizing, sharing or selling your anonymized DNA and data.  Anonymized data means your identity and what they consider identifying information has been removed.

Many people think that if you opt-out, your DNA and data is never shared or sold, but according to 23andMe and Ancestry’s own documentation, that’s not true. Opt-out is not truly opt-out.  It’s only opting out of them sharing your non-anonymized data – meaning just the higher level of participation only.  They still share your anonymized data in aggregated fashion.

Some people are fine with this. Some aren’t.  Many people don’t really understand the situation.  I didn’t initially.  I’m very uncomfortable with this situation, and here’s why.

First, let me say very clearly that I’m not opposed to WHAT either 23andMe or Ancestry is doing, I’m very concerned with HOW, meaning their methodology for obtaining consent.

I feel like a consumer should receive what they pay for and not have their DNA data co-opted, often without their knowledge, explicit permission or full situational understanding, for other purposes.

There should also be no coercion involved – meaning the customer should not be required to participate in medical research as a condition of obtaining a genealogy test.  Most people have no idea this is happening.  I certainly didn’t.

How could a consumer not know, you ask?

Because these companies don’t make their policies and intentions clear.  Their language, in multiple documents that refer back and forth to each other, is extremely confusing.

Neither company explains what they are going to (or can) do with your DNA in plain English, before the end of the purchase process, so that the customer clearly understands what they are doing (or authorizing) IN ADDITION to what they intended to do. Obtaining customer permission in this fashion is hardly “informed consent” which is a prerequisite for a subject’s participation in research.

The University of Southern California has prepared this document describing the different aspects of informed consent for research.  If you read this document, then look at the consent, privacy and terms and conditions documents of both Ancestry and 23andMe, you will notice significant differences.

While 23andMe has clearly been affiliated with the medical community for some time, Ancestry historically has not and there is absolutely no reason for an Ancestry customer to suspect that Ancestry is doing something else with their DNA. After all, Ancestry is a genealogy company, not a medical genetics company.  Aren’t they???

Let’s look at each of these two companies Individually.

23andMe

At 23andMe, when you purchase a kit, you see the following final purchase screen.

On the very last review page, after the “order total” is the tiny “I accept the terms of service” checkbox, just above the large grey “submit order” box. That’s the first and only time this box appears.  By this time, the consumer has already made their purchase decision, has already entered their credit card number and is simply doing a final review and approval.

In the 23andMe Terms of Service, we find this:

Waiver of Property Rights: You understand that by providing any sample, having your Genetic Information processed, accessing your Genetic Information, or providing Self-Reported Information, you acquire no rights in any research or commercial products that may be developed by 23andMe or its collaborating partners. You specifically understand that you will not receive compensation for any research or commercial products that include or result from your Genetic Information or Self-Reported Information.

You understand that you should not expect any financial benefit from 23andMe as a result of having your Genetic Information processed; made available to you; or, as provided in our Privacy Statement and Terms of Service, shared with or included in Aggregated Genetic and Self-Reported Information shared with research partners, including commercial partners.

Clicking on the privacy policy showed me the following information in their privacy highlights document:

1. We may share anonymized and aggregate information with third parties; anonymized and aggregate information is any information that has been stripped of your name and contact information and aggregated with information of others or anonymized so that you cannot reasonably be identified as an individual.

In their full Privacy statement, we find this:

By using our Services, you agree to all of the policies and procedures described in the foregoing documents.

Under the Withdrawing Consent paragraph:

If you withdraw your consent for research your Genetic Information and Self-Reported Information may still be used by us and shared with our third-party service providers to provide and improve our Services (as described in Section 4.a), and shared as Aggregate Information that does not identify you as an individual (as described in Section 4.d).

And in their “What Happens if you do NOT consent to 23andMe Research” section:

If you do not complete a Consent Document or any additional consent agreement with 23andMe, your information will not be used for 23andMe Research. However, your Genetic Information and Self-Reported Information may still be used by us and shared with our third-party service providers to provide and improve our Services (as described in Section 4.a), and shared as Aggregate or Anonymous Information that does not reasonably identify you as an individual (as described in Section 4.d).

If you don’t like these terms, here’s what you can do about it:

If you want to terminate your legal agreement with 23andMe, you may do so by notifying 23andMe at any time in writing, which will entail closing your accounts for all of the Services that you use.

You can read the 23andMe full privacy statement here.

You can read the 23andMe Terms of Service here.

You can read the Consent document here.

Ancestry

Ancestry recently jumped into the medical research arena, forming an alliance with Calico to provide them with DNA information – that would be Ancestry’s customer DNA information – meaning your DNA if you’re an AncestryDNA customer. You can read about this here, here and here.

When you purchase an AncestryDNA kit, you are asked the following, also at the very end of the purchase process.  If you don’t click, you receive an error message, shown below.

Here are the Ancestry Terms and Conditions.

Here is the Ancestry Privacy Statement.

From Ancestry’s Terms and Conditions, here’s what you are authorizing:

By submitting DNA to AncestryDNA, you grant AncestryDNA and the Ancestry Group Companies a perpetual, royalty-free, world-wide, transferable license to use your DNA, and any DNA you submit for any person from whom you obtained legal authorization as described in this Agreement, and to use, host, sublicense and distribute the resulting analysis to the extent and in the form or context we deem appropriate on or through any media or medium and with any technology or devices now known or hereafter developed or discovered. You hereby release AncestryDNA from any and all claims, liens, demands, actions or suits in connection with the DNA sample, the test or results thereof, including, without limitation, errors, omissions, claims for defamation, invasion of privacy, right of publicity, emotional distress or economic loss. This license continues even if you stop using the Website or the Service.

From their Privacy Statement, here’s what Ancestry says they are doing with your DNA:

vi) To perform research: AncestryDNA will internally analyze Users’ results to make discoveries in the study of genealogy, anthropology, evolution, languages, cultures, medicine, and other topics.

The is no complete opt-out at Ancestry either.

Now What?

So, how many of you read the Terms and Conditions and Privacy Statements at either 23andMe or Ancestry and understood that you were in essence giving them carte blanche with your anonymized data when you purchased your tests from them?

Is this what you intended to do?

How many of you understood that the ONLY way to obtain your genealogy information, ethnicity and matching is to grant 23andMe and Ancestry authorization to use your DNA for other purposes?

How many of you understood you could never entirely opt-out?

Where is your DNA?

Who has it?

What are they doing with it?

How much did or will Ancestry or 23andMe, or Big Pharm make from it?

Why would they want to obtain your DNA in this manner, instead of being entirely transparent and forthright and obtaining a typical informed consent?

Are they or their partners utilizing your DNA to design high end drugs and services that you as a consumer will never be able to afford?

Are they using your DNA to design gene manipulation techniques that you might personally be opposed to?

Do you care?

Personally, I was done participating in research when 23andMe patented their Designer Baby technology, and I’ve never changed my mind since.  There is a vast difference between research to cure Parkinson’s and cancer and focusing your research efforts on creating designer children.

People who do want medical information (such as from 23andMe) should be allowed to receive that, personally, for their own use – but no one’s DNA should be co-opted for something other than what they had intended when they made the purchase without a very explicit, separate, opt-in for any other usage of their DNA, including anonymized data.

Period.

People who purchase these services for genealogy information shouldn’t have to worry about their DNA being utilized for anything else if that’s not their specific and direct choice.

I shouldn’t have to opt-out of something I didn’t want and didn’t know I was signing up for in the first place – a type of usage that wouldn’t be something one would normally expect when purchasing a genealogy product. Furthermore, if I opt out, I should be able to opt out entirely.  You only discover opt-out isn’t truly opt-out by reading lots of fine print, or asking an attorney.  And yes, I still had to ask an attorney, to be certain, even after reading all the fine print.

Why did I ask a legal expert?  Because I was just sure I was wrong – that I was missing something in the confusing spaghetti verbiage.  I couldn’t believe these companies could actually do this.  I couldn’t believe I had been that naïve and gullible, or didn’t read thoroughly enough.  Well, guess what – I was naïve and gullible and the companies can and do utilize our DNA in this manner.

Besides that, “everyone knows” that companies can’t just do what they want with your DNA without an informed consent.  Right?  Anyone dealing with medicine knows that – and it’s widely believed within the genetic genealogy community.  And it’s wrong.

It seems that 23andMe and Ancestry have borrowed a page from the side of medical research where “discarded” tissues are used routinely for research without informed consent of the person from whom they originated.  This article in the New York Times details the practice, an excerpt given below:

Tissues from millions of Americans are used in research without their knowledge. These “clinical biospecimens” are leftovers from blood tests, biopsies and surgeries. If your identity is removed, scientists don’t have to ask your permission to use them. How people feel about this varies depending on everything from their relationship to their DNA to how they define life and death. Many bioethicists aren’t bothered by the research being done with those samples — without it we wouldn’t have some of our most important medical advances. What concerns them is that people don’t know they’re participating, or have a choice. This may be about to change.

Change is Needed

The 23andMe and Ancestry process of consent needs to change too.

I would feel a lot better about the 23andMe and Ancestry practices if both companies simply said, before purchase, in plain transparent normal-human-without-a-law-degree understandable language, the following type of statement:

“If you purchase this product, you cannot opt out of research and we will sell or utilize your anonymized results, including any information submitted to us (trees, surveys, etc.) for unspecified medical and pharmaceutical research of our choosing from which we and our partners intend to profit financially.”

If I am wrong and there is a way to opt out of research entirely, including anonymized aggregated data, while still retaining all of the genealogy services paid for from the vendor, I’ll be more than happy to publish that verbiage and clarification.

Today, the details are buried in layers of verbiage and the bottom-line meaning certainly is not clear. And it’s very easy to just “click through” because you have no choice if you want to order the test for your genealogy. You cannot place an order without agreeing and clicking the box.

This less-than-forthright technique of obtaining “consent” may be legal, and it’s certainly effective for the companies, guaranteeing them 100% participation, but it just isn’t morally or ethically right.

Shame on us, the consumers, for not reading the fine print, assuming everyone could understand it.

But shame on both companies for burying that verbiage and taking advantage of the genealogists’ zeal, knowing full well, under the current setup, we must authorize, without fully informed consent, their use of our DNA in order to test in their systems to obtain our genealogy information.  They know full well that people will simply click through without understanding the fine print, which is why the “I accept” box is positioned where it is in the sales process, and the companies are likely depending on that “click through” behavior.

Shame on them for being less than forthright, providing no entire opt-out, or better yet, requiring a fully informed-consent intentional opt-in.

Furthermore, these two large companies are likely only the tip of the iceberg – leading the charge as it were. I don’t know of any other DNA testing companies that are selling your DNA data today – at least not yet.  And just because I don’t know about it doesn’t mean it isn’t happening.

Other Companies

Family Tree DNA, the third of the three big autosomal DNA testing companies, has not and is not participating in selling or otherwise providing customer DNA or data for medical or third party research or utilization.  I confirmed this with the owners, this week.

Surely, if Ancestry and 23andMe continue to get away with this less than forthright technique, more companies will follow suit.  It’s clearly very profitable.

Today, DNA.Land, a new site, offers genetic genealogists “value” in exchange for the use of their DNA data.  However, DNA.Land is not charging the consumer for testing services nor obtaining consent in a surreptitious way.  They do utilize your DNA, but that is the entire purpose of this organization.  (This is not an endorsement of their organization or services – just a comment.)

GedMatch, a third party site utilized heavily by genetic genealogists states their data sharing or selling policy clearly.

It is our policy to never provide your genealogy, DNA information, or email address to 3rd parties, except as noted above.

They further state:

We may use your data in our own research, to develop or improve applications.

Using data internally for application improvement for the intended use of the test is fully legitimate, can and should be expected of every vendor.

Bottom line – before you participate in DNA testing or usage of a third party site, read the fine print fully and understand that no matter how a vendor tries, your DNA can never be fully anonymized.

Call to Action

I would call on both 23andMe and Ancestry to make what they are doing, and intend to do, with their customers DNA much more transparent. Consumers have the right to clearly know before they purchase the product if they are required to sign an authorization such as this and what it actually means to them.

Furthermore, I would call on both companies to implement a plan whereby our DNA can never be used for anything other than to deliver to us, the consumers, the product(s) and services for which we’ve paid unless we sign, separately, and without coercion, a fully informed consent opt-in waiver that explains very specifically and clearly what will occur with our DNA.

These companies clearly don’t want to do this, because it would likely reduce their participation rate dramatically – from 100% today for anonymized aggregated data, because there is no opt-out at that level, to a rate significantly lower.

I’m reminded of when my children were teenagers.  One of them took the car someplace they knew they didn’t have permission to go.  I asked them why they didn’t ask permission first, and they rolled their eyes, looked at me like I was entirely stupid and said, “Because you would have said no.  At least I got to go this way.”  Yes, car privileges were removed and they were grounded.

Currently 23andMe reports an amazing 85-90% participation rate, which has to reflect their higher non-anonymized level of participation because their participation rate in the anonymized aggregated level is 100%, because it’s mandatory.  Their “consent” techniques have come under question by others in the field as well, according to this article.  Many people who do consent believe their participation is altruistic, meaning that only nonprofit organizations like the Michael J. Fox Foundation will benefit, not realizing the full scope of how their DNA data can be utilized.  That’s what I initially thought at 23andMe.  Did I ever feel stupid, and duped, when that designer baby patent was issued.

Lastly, I would call on both companies to obtain a fully informed consent for every person in their system today who has already purchased their product, and to discontinue using any of the data in any way for anyone who does not sign that fully informed consent. This includes internal use (aside from product improvement), not just third party data sharing or sales, given that 23andMe is planning on developing their own drugs.

If you support this call to action, let both companies know. Furthermore, vote with your money and consumer voice. I will be making sure that anyone who asks about testing firms is fully aware of this issue.  You can do the same thing by linking to this article.

Call them:

23andMe – 1-800-239-5230
Ancestry – 1-800-401-3193 or 1-800-262-3787 in the US. For other locations click here

Write them:

23andMe – customercare@23andme.com
Ancestry – Memberservices@ancestrydna.com

I genuinely hope these vendors make this change, and soon.

For additional information, Judy Russell and I have both written about this topic recently:

And Now Ancestry Health
http://dna-explained.com/2015/06/06/and-now-ancestry-health/

Opting Out
http://legalgenealogist.com/blog/2015/07/26/opting-out/

Ancestry Terms of Use Updated
http://legalgenealogist.com/blog/2015/07/07/ancestry-terms-of-use-updated/

AncestryDNA Doings
http://legalgenealogist.com/blog/2015/07/05/ancestrydna-doings/

Heads Up About the 23andMe Meltdown
http://dna-explained.com/2015/12/04/heads-up-about-the-23andme-meltdown/

______________________________________________________________

Disclosure

I receive a small contribution when you click on some of the links to vendors in my articles. This does NOT increase the price you pay but helps me to keep the lights on and this informational blog free for everyone. Please click on the links in the articles or to the vendors below if you are purchasing products or DNA testing.

Thank you so much.

DNA Purchases and Free Transfers

• Family Tree DNA
• MyHeritage DNA only
• MyHeritage DNA plus Health
• MyHeritage FREE DNA file upload
• AncestryDNA
• 23andMe Ancestry
• 23andMe Ancestry Plus Health
• LivingDNA

Genealogy Services

• MyHeritage FREE Tree Builder
• MyHeritage Subscription with Free Trial

Genealogy Research

• Legacy Tree Genealogists for genealogy research