SA Forum is an invited essay from experts on topical problems in science and technology.

If there's a factor for hubris, the 23andMe coiffure has certainly got it. Last Fri the U.South. Food and Drug Assistants (FDA) ordered the genetic-testing company immediately to stop selling its flagship production, its $99 "Personal Genome Service" kit. In response, the visitor cooed that its "relationship with the FDA is extremely of import to united states" and connected hawking its wares as if nothing had happened. Although the agency is right to sound a warning almost 23andMe, it's doing so for the wrong reasons.

Since late 2007, 23andMe has been known for offering cut-rate genetic testing. Spit in a vial, transport it in, and the company will wait at thousands of regions in your DNA that are known to vary from human to man—and which are responsible for some of our traits. For example a site in your genome named rs4481887 can come in 3 varieties. If you happen to have what is known equally the GG variant, there is a adept probability that you are unable to odor asparagus in your urine; those blessed with the GA or AG varieties are much more likely to be repulsed by their own pee after having a few spears at Spargelfest.

At starting time, 23andMe seemed to angle its kit as a fun way to learn a piffling genetics using yourself equally a examination subject area. ("Our goal is to connect you lot to the 23 paired volumes of your ain genetic blueprint... bringing you personal insight into ancestry, genealogy, and inherited traits," read the company'south website.) The FDA had footling problem with the company telling you why you had dry ear wax (rs17822931) or whether you lot're probable to sneeze when yous look at a bright light (rs10427255).

That phase didn't final for long, because there is much more than interesting stuff in your genome than novelty items. Certain regions indicate an increased hazard of breast cancer, the impending onset of metabolic diseases, and sensitivity to medications. 23andMe—likewise as a number of other companies—edged closer and closer to marketing their services as a way of predicting and even preventing health bug. And any kit intended to cure, mitigate, treat, prevent, or diagnose a illness is, according to federal law, a "medical device" that needs to be deemed safe and effective by the FDA. Since mid-2009, 23andMe has been negotiating with the agency, and in July 2012, the visitor finally began the process of getting clearance from the FDA to sell the kit that it had already been selling for v years.

Everything seemed rosy until, in what a veteran Forbes reporter calls "the single dumbest regulatory strategy [he had] seen in 13 years of roofing the Food and Drug Administration," 23andMe changed its strategy. It plainly blew through its FDA deadlines, effectively annulling the clearance procedure, and abruptly cut off contact with the agency in May. Adding insult to injury the visitor started an aggressive advertizing campaign ("Know more than about your health!"), leaving little doubt about the underlying medical purpose of 23andMe'due south Personal Genome Service. This left the bureau with piddling alternative but to have action. "As part of our interactions with y'all, including more than fourteen face up-to-face and teleconference meetings, hundreds of email exchanges, and dozens of written communications," the bureau complained, "we provided you with… statistical communication, and discussed potential risk mitigation strategies." It is the tone of a spurned spouse, exasperated and angry that 23andMe is putting no endeavour into salvaging their relationship.

But equally the FDA frets about the accuracy of 23andMe's tests, it is missing their truthful function, and consequently the agency has no clue virtually the real dangers they pose. The Personal Genome Service isn't primarily intended to be a medical device. It is a mechanism meant to be a front end terminate for a massive data-gathering performance against an unwitting public.

Sound paranoid? Consider the example of Google. (One of the founders of 23andMe, Anne Wojcicki, is presently married to Sergei Brin, the founder of Google.) When it first launched, Google billed itself as a faithful servant of the consumer, a company devoted only to building the best tool to help us satisfy our cravings for data on the spider web. And Google's search engine did simply that. Merely every bit we at present know, the central purpose of the company wasn't to help u.s.a. search, but to hoard information. Every search query entered into its computers is stored indefinitely. Joined with data gleaned from cookies that Google plants in our browsers, forth with personally identifiable data that dribbles from our computer hardware and from our networks, and with the amazing volumes of information that we always seem willing to share with perfect strangers—fifty-fifty corporate ones—that information store has become Google's real asset. By parceling out that information to help advertisers target yous, with or without your consent, Google makes more than $ten billion every quarter.

What the search engine is to Google, the Personal Genome Service is to 23andMe. The visitor is non exactly hiding its ambitions. "The long game here is not to make coin selling kits, although the kits are essential to get the base of operations level data," Patrick Chung, a 23andMe board member, told FastCompany last month. "Once yous take the information, [the company] does really become the Google of personalized health intendance." The company has lowered the price of the kit again and again, most recently from $299 to a mere $99, practically making it a stocking-stuffer. All the better to induce volunteers to give 23andMe the data it so desperately wants. (Currently, the database contains the genetic information of some half a million people, a number Wojcicki reportedly wants to double by twelvemonth end.)

What does 23andMe desire to do with all that data? Right now the talk is all about medical research—and, in fact, the company is doing some interesting work. It has been sifting through its genomic database, which is combined with data that volunteers submit almost themselves, to find possible genetic links to people's traits. (The bright-light/sneeze genetic tag is a 23andMe discovery.) More promising are 23andMe's attempts to recruit people who suffer from certain diseases, such as Parkinson'south and a few types of cancer. Simply through animate being-force blueprint matching, the company has a take a chance of finding genetic causes of these ailments, which could lead to a way to gainsay them. (And possibly a blockbuster patent or three.)

That's just the beginning, though. 23andMe reserves the right to apply your personal information—including your genome—to inform you virtually events and to try to sell you products and services. There is a much more lucrative market waiting in the wings, too. One could hands imagine how insurance companies and pharmaceutical firms might be interested in getting their hands on your genetic data, the improve to sell you lot products (or deny them to you). According to 23andMe's privacy policy, that wouldn't be an acceptable employ of the database. Although 23andMe admits that it will share aggregate information nigh users genomes to tertiary parties, it adamantly insists that it volition not sell your personal genetic information without your explicit consent.

Nosotros've heard that one before. Back when Google was showtime launched, the founders insisted that the company would never sell you out to advertisers. The company admitted that it would share amass information near users' behavior with anyone who ponied up enough money, simply the company'southward privacy policy promised that "[i]ndividually identifiable information near you is non willfully disclosed to any third political party without first receiving your permission." A decade and a half later, after endless minuscule frog-in-boiling-water changes, Google's privacy policy is craftily worded, diluting the give-and-take "consent" then that it's implicit in most cases. (In that location are a few exceptions; the company has graciously agreed non to reveal that you are a homosexual or that you take heart affliction unless y'all explicitly opt in. Only in matters not related to your medical atmospheric condition, race, ethnicity, sexuality, or your political or religious behavior, there is no such guarantee.) Not that your consent really matters, implicit or explicit. Google has repeatedly proven that it is more than than willing to interruption its promises and ignore its ain privacy rules when it suits.

Why should we believe that 23andMe's promises are whatsoever more binding? Early signs certainly aren't encouraging. Even though 23andMe currently asks permission to utilise your genetic information for scientific research, the company has explicitly stated that its database-sifting scientific work "does not establish research on human subjects," meaning that it is not subject to the rules and regulations that are supposed to protect experimental subjects' privacy and welfare.

Those of us who have not volunteered to be a part of the grand experiment have even less protection. Even if 23andMe keeps your genome confidential against hackers, corporate takeovers, and the temptations of filthy lucre forever and ever, at that place is plenty of evidence that there is no such thing as an "bearding" genome anymore. Information technology is possible to use the cyberspace to identify the owner of a snippet of genetic information and information technology is getting easier day by day.

This becomes a particularly acute problem once you realize that every one of your relatives who spits in a 23andMe vial is giving the company a non-inconsiderable scrap of your own genetic data to the company forth with their own. If you lot have several close relatives who are already in 23andMe's database, the visitor already essentially has all that it needs to know about you. It is doubtful that 23andMe would exist able to protect that information even if it were so inclined.

While the FDA concentrates on the question of whether 23andMe's kit is a safe and constructive medical device, it is declining to address the real issue: what 23andMe should exist allowed to practice with the data it collects. For 23andMe'due south Personal Genome Service is much more than a medical device; it is a 1-fashion portal into a world where corporations have access to the innermost contents of your cells and where insurers and pharmaceutical firms and marketers might know more about your body than you know yourself. And every bit 23andMe warns on its website, "Genetic Information that you lot share with others could exist used against your interests. You should be careful about sharing your Genetic Information with others."

Present company excepted, of course.