Our bodies, their drugs: The state of open DNA in closed hands

In exchange for health indicators and colourful pie charts of genetic lineage, millions of people are willing to submit unique bodily information into an abyss of company databases. Since 2007 Consumer DNA testing kits have reunited families and provided critical information about our genes. By 2019, according to MIT Technology Review, more than 26 million consumers added DNA to the four leading commercial ancestry and health databases. Ancestry.com and 23andMe now hold some of the world’s largest DNA collections. 

With their treasure troves of genetic information, you’d suspect DNA testing companies to be faring well. Not exactly. 

The current stock for 23andMe, once valued at $6 billion USD, could be delisted by NASDAQ because it now goes for less than one dollar. In September, all its independent directors resigned from its board after CEO Anne Wojcicki sought to take it private. In 2023, Google’s parent company Alphabet reduced its stake by selling off 6,7 million shares. In recent years, private equity has entered the market, with Blackstone acquiring Ancestry.com in December 2020. 

What’s going wrong? 

To start, there are only so many spitters and swabbers; the ancestry trend is insufficient to sustain DNA testing companies forever, especially with few innovative product line extensions to carry consumer engagement. As the fever cools, and celebrity spit parties wane, several companies found new avenues for monetising harboured genetic data, via various health offerings and opt-in research partnerships. By all appearances, this is still not enough.

What does this mean for the genetic data these companies hold?

Altruism narratives and donated DNA

In 2015, 23andMe created a therapeutics group to discover novel treatments through human genetics. (According to an August 8 regulatory filing, it has since shuttered one of its segments, Therapeutics Discovery.) For research, it collaborates with pharmaceutical firms and academic institutions, nonprofits, and organisations like the US National Institutes of Health.

Peppered with phrases like “become part of something bigger” and “The future of medicine. Powered by you,” 23andMe offers customers an opt-in way to share genetic data by answering online surveys for researchers who study ancestry, traits, and disease. Participants are told their contributions “help drive scientific discoveries.” The company also collaborated with research entities who provide opportunities to participate in clinical trials that evaluate treatments “for diseases they care about,” including drug company-run studies for specific maladies. 

According to 23andMe, 80 percent of customers elect to share their data. Each, on average, contributes to over 230 studies on Parkinson's disease, Lupus, asthma and more. All genetic information is stripped of identifiers (name or email) to include only what is needed for analysis (date of birth), then it’s put into a separate database and linked to a randomly-assigned research ID before it is shared with partners. The Institutional Review Board (IRB), an independent ethics panel for government and ethical guidelines, reviews all research activities. 

These activities have yielded boast-worthy results, especially for underserved populations: four grants from the US National Institutes of Health led to identifying hundreds of new genetic associations, publications in peer-reviewed scientific journals with the University of Chicago, Stanford University, Pfizer, and the National Parkinson Foundation; and the largest-ever study cohorts on depression/bipolar disorder and Parkinson’s disease. Its therapeutics team discovered 1500+ genes, and published over 250 papers in its heydays.

However, a 2017-2018 online university research survey found that over 40 percent of customers polled were unaware that using and sharing customer data was part of 23andMe’s business model. 

Near the 2017 introduction of the pangenome, a comprehensive DNA sequence comprised of 47 people with diverse ancestries, 23andMe received a $1,7 million grant from the National Institutes of Health to sequence the genomes of hundreds of thousands of African-American customers using its standard product, creating a sequencing panel as a reference dataset for health research—a game-changing move, considering that over 90 percent of genetic disease research features people with European ancestry.

Similarly, Ancestry.com’s Ancestry Human Diversity Project allows customers, via informed consent, to use their DNA to participate in research ”to understand history and migration, improve and learn more about human health, explore connection between genetics and human traits, and to develop diagnostic tools and therapies to treat diseases…” The research is conducted by multiple entities: scientists from AncestryDNA, academic institutions, government institutions and non-profit businesses, in hopes it “may lead to commercial developments of new products.” 

According to a company representative, the project does not have any partnerships with private drug companies.

In 2018, 23andMe inked a partnership with GlaxoSmithKline (GSK), affording it exclusive collaboration rights for novel drug target discovery. In exchange for the latter’s ability to use 5 million consenting customers’ test results, 23andMe received a $300 million investment. (Novel drug targets are specific molecules or proteins in the body closely linked to a particular disease. They can be influenced by a drug to produce a desired therapeutic outcome.) 

The partnership received two extensions—in January 2022, with an additional $50 million investment after a clinical trial on a joint asset co-developed by the companies for cancer treatment; and in October 2023, when they entered a one-year non-exclusive data licensing agreement for $20 million, giving GSK sole ownership of any new drug discovery programs, and leaving 23andMe eligible for downstream royalties under certain database use cases.

This relationship raises ethical questions about whether customers who “donate” DNA indeed contribute to a “greater good,” especially after US Senator Elizabeth Warren slammed GSK for a price-gouging strategy that risked millions of children losing access to one of few drugs available to treat asthma and allergies in early 2024. An earlier report detailed how the manufacturer blocks competition and keeps drug prices high for asthma, lupus, and HIV—diseases that affect over 28,6 million people in the US.

He went on, “Ultimately, we are committed to discovering and developing novel therapies to improve patient lives by studying human genetics. We are working on therapies for serious unmet medical needs, including various forms of cancer, which, if successful, could help many patients suffering from disease.”

Kill says the company does not have a drug on the market that stems from their collaboration with GSK, but has two cancer drug programs in clinical trials. “If and when [commercialisation] occurs we have stated we are committed to working on the best way to make our therapies accessible.”

Upholding the promise of its altruism narratives implies that any medicines ultimately developed will be affordable and available to those in need. It wouldn’t be a leap to suggest that most opt-in donors of DNA data may consider this part of the social pact they make with the company.

Closed loops of economic interests

Historical precedent for how bodily material underwrites breakthroughs contains a number of exploitative use cases. 

Henrietta Lacks was the great-great-granddaughter of a slave and tobacco farmer whose family remained poor throughout her life. While she lay dying of cervical cancer in 1951, doctors at Johns Hopkins Hospital biopsied tissues from her cervix and gave the sample to a Johns Hopkins University researcher without her consent, compensation, or knowledge.

This led to a world-changing discovery: The cells thrived and multiplied in the laboratory, doubling every 24 hours until they grew outside the human body for more than 36 hours. Having reproduced billions of times, the cell line named for her, HeLa, has since underwritten nearly 75.000 studies. These paved the way for the HPV vaccine, medications used to help patients with HIV and AIDS, haemophilia, herpes, influenza, leukaemia, and Parkinson’s disease; not to mention the polio vaccine, the cancer drug tamoxifen, chemotherapy, gene mapping, and in-vitro fertilisation. 

After seeing thousands of patents that involved her cells, yielding millions of dollars in profits to the patent-holders, Lacks’ family filed a lawsuit against Thermo Fischer Scientific. They accused it of selling the cells and attempting to secure intellectual property rights on products the cells helped develop without compensating them or requesting approval. The suit eventually settled out of court. 

Experts assert we should have legal property rights over products developed using our genetic information and bodily components. In 1997, the United Nations released the Universal Declaration on the Human Genome and Human Rights, best known for its statement against human cloning and abuse of the genome in the interest of preserving human dignity. According to the National Conference of State Legislatures, five US states—Alaska, Colorado, Florida, Georgia, and Louisiana—explicitly define genetic information as personal property.

In 1994, Myriad Genetics was the first company to discover the precise location and sequence of the BRCA1 and BRCA2 genes (linked to breast cancer), allowing it to determine their typical nucleotide sequence despite a variety of other publicly funded research efforts. Myriad obtained a patent, allowing the company to exercise a monopoly on the genes in the United States, preventing other labs from offering testing or second opinions and increasing the price to thousands of dollars per test, according to the American Civil Liberties Union (ACLU). 

The ACLU, alongside the Public Patent Foundation, filed a lawsuit in 2009 that landed in the Supreme Court of the United States “on behalf of 20 researchers, genetic counsellors, women patients, cancer survivors, breast cancer and women’s health groups, and scientific associations representing 150,000 geneticists, pathologists, and laboratory professionals.” It argued that human genes are products of nature, even when isolated. 

Plaintiff and breast cancer survivor Lisbeth Ceriani was informed that the BRCA genetic test she needed was inaccessible because the gene associated with her cancer and the test was under patent. In 2013, the Supreme Court ruled genes cannot be patented because they are products of nature. The case remains a reminder of how average citizens can be shut out of accessing healthcare when bodily material is exploited for profit.

Patents incentivise innovators to spend money doing work in hopes of ultimately recouping expenses, says Jorge Contreras, professor and author of The Genome Defense: Inside the Epic Legal Battle to Determine Who Owns Your DNA. Thus they give owners the exclusive right to make, use and sell a novel invention throughout the country.

Up to the 1990s, it was possible under the US Patent and Trademark Office (PTO) to patent human genes as they were discovered. Most gene research in the US came from universities funded by National Institutes of Health grants, enabled by the Bayh-Dole Act of 1980. When University of Michigan researchers first isolated and sequenced the CFTR gene associated with Cystic Fibrosis, they made the patent broadly available to any clinic or lab that wanted to test for mutations. In a similar case, the National Institutes of Health first discovered the X-ray gene related to Tay-Sachs disease, and made it available to testing clinics.

“Myriad was the first instance where the owner of one of these gene patents tried to exploit not just to recoup its patenting costs but to gain exclusivity in a market,” Contreras told L’Atelier. “In doing so, it charged a price that it deemed profitable but higher than many could afford. It also blocked academic laboratories and clinics from running the tests.”

Since 2013, the absence of patents on genes in the United States led to a significant price decrease for genetic testing, especially for BRCA, allowing consumer DNA testing companies to provide affordable expanded gene-related healthcare offerings.

A 2019 bipartisan bill, to reform Section 101 of the Patent Act, by US Senators Chris Coons and Thom Tillis, aims to override the Myriad Supreme Court precedent and other decisions that restrict the ability to patent natural phenomena. The bill is opposed by a kaleidoscope of consumer advocacy groups and scientists, including the ACLU. The two senators and their supporters issued a formal call for public comment that received over 100 responses, culminating in a 2022 report for the United States Congress that ensures the push will continue. Coons and Tillis also support the Patent Eligibility Restoration Act of 2023, which eliminates all judicially-created exceptions to US patent eligibility law, except in instances of “an unmodified human gene, as that gene exists in the human body.”

Contreras finds that venture capital funding is part of the motivation for this legislation since, under the current environment, the genetic diagnostics space does not promise the patent-driven profits that venture capitalists seek.  

Rumoured pasts, whispered algorithms

Writer George Estreich likened consumer DNA kits to Hans Christian Andersen’s 19th-century fable “The Emperor’s New Clothes,” calling them “genetic gossip: a rumored past that, like most rumors, is at least partly true,” and that “begins with a test tube of spit and ends with fractional estimates: a story whispered by an algorithm in the language of information.”

He writes on, “The promises of discovering the identity and the genealogical past are a misdirection: the real exchange takes place offstage, with drug companies and others paying for access to the data that customers pay to give. Once it’s given, customers are vulnerable to future data breaches … and they aren’t guaranteed compensation for any profits the data might lead to.”

The destiny of data is a question that often arises in the realm of DNA testing companies since they are, after all, tech companies. The infamous Cambridge Analytica scandal demonstrated our data, and its interconnectedness, has an exploitable intrinsic value. After 23andMe’s 2023 data breach, compromising the data of more than 6,9 million users and exposing it to over 30 lawsuits and a class action (the company agreed to settle for $30 million), and MyHeritage’s 2018 breach, where 92 million account details were found on a private server, it seems as though our DNA is about as safe as our 2008 party photos on Facebook. We don't just share our own genetic fragments but those correlated with ours: parents, distant cousins, children, brothers, sisters, grandparents, and even unborn babies.

Cofone argues that privacy law is grounded on concepts from contract law. The latter sets the rules for voluntary agreements, placing the burden of data privacy on the consumer, who must accept certain terms to use a service. (For example, online you may often see a window at the bottom of a webpage asking for consent to have “cookies” collected, with an explainer most people don’t read.) 

Cofone observes it would be better to base such interactions on tort law, which sets the rules for harm caused to others. Consent to share data is our choice, but only some of us will read and understand an entire legal agreement’s terms before clicking “accept.”

“Privacy law relies so much on individual consent across jurisdictions because we have this idea that if we give people enough information, we give them choices. They can make decisions that minimise the risk. However, the predictions about the consequences of their data decisions are impossible,” explained Cofone.  “For a genetics company, under tort law, the company would have a duty to act reasonably and keep information safe in ways independent of what the consumer agreed on. They can share the information but must be mindful of the consequences because they would be responsible.”

In an email exchange, Kill of 23andMe maintains that the company already does much of what Cofone suggests. It only possesses data on customers who submitted DNA samples in an information security management system certified under three ISO certifications, awarded after extensive audits by an independent third party. 

As far as its relationships with drug companies, he says they don’t sell individual customer information or include any customer data in their research program without an individual’s voluntary and informed consent.

“There are oversight and legal agreements in place to ensure the data is being utilised in an ethically agreed-upon manner and that no unauthorised data usage occurs by collaborators,” says Kill.

23andMe, Ancestry and MyHeritage offer users ways to request sample destruction after analyses are complete, and to choose to share data with third parties, participate in research, delete their accounts, revoke consent, or choose to be listed as a DNA match.

An uncertain future

Since history remains rife with examples of genetic exploitation, it is crucial that consumers who opt-in to donate DNA for drug development advocate for affordable patient end results. Perhaps they should expect to receive progress reports of drug development from the DNA companies themselves? In a few months, however, this may be a moot point.

As the industry flounders, the fate of existing genetic data companies, namely 23andMe, remains in the balance. New entrants to the market could give it the reboot it needs—a hopeful outlook that offers little comfort for existing personal data concerns. In the ether of company acquisitions and possible dissolutions, it remains uncertain where customer DNA data will end up. That uncertainty may be a problem for future generations to inherit.