SA Forum is an invited essay from experts on topical issues in scientific discipline and technology.

If there's a gene for hubris, the 23andMe crew has certainly got it. Last Friday the U.S. Nutrient and Drug Administration (FDA) ordered the genetic-testing company immediately to stop selling its flagship product, its $99 "Personal Genome Service" kit. In response, the company cooed that its "relationship with the FDA is extremely important to us" and continued hawking its wares as if nothing had happened. Although the agency is right to sound a warning well-nigh 23andMe, information technology's doing so for the wrong reasons.

Since late 2007, 23andMe has been known for offering cut-rate genetic testing. Spit in a vial, ship it in, and the company volition look at thousands of regions in your DNA that are known to vary from human to human—and which are responsible for some of our traits. For example a site in your genome named rs4481887 can come up in three varieties. If you happen to have what is known every bit the GG variant, there is a good probability that you lot are unable to smell asparagus in your urine; those blest with the GA or AG varieties are much more likely to be repulsed by their ain pee after having a few spears at Spargelfest.

At start, 23andMe seemed to bending its kit equally a fun mode to acquire a little genetics using yourself as a exam subject area. ("Our goal is to connect you lot to the 23 paired volumes of your own genetic blueprint... bringing you personal insight into beginnings, genealogy, and inherited traits," read the visitor's website.) The FDA had footling problem with the company telling you why you had dry ear wax (rs17822931) or whether you're likely to sneeze when you lot wait at a bright light (rs10427255).

That phase didn't last for long, because there is much more interesting stuff in your genome than novelty items. Certain regions betoken an increased adventure of breast cancer, the impending onset of metabolic diseases, and sensitivity to medications. 23andMe—as well equally a number of other companies—edged closer and closer to marketing their services every bit a way of predicting and fifty-fifty preventing health problems. And any kit intended to cure, mitigate, treat, preclude, or diagnose a disease is, co-ordinate to federal constabulary, a "medical device" that needs to exist deemed safe and effective by the FDA. Since mid-2009, 23andMe has been negotiating with the bureau, and in July 2012, the company finally began the process of getting clearance from the FDA to sell the kit that information technology had already been selling for five years.

Everything seemed rosy until, in what a veteran Forbes reporter calls "the single dumbest regulatory strategy [he had] seen in 13 years of covering the Nutrient and Drug Administration," 23andMe changed its strategy. Information technology obviously blew through its FDA deadlines, finer annulling the clearance process, and abruptly cutting off contact with the bureau in May. Calculation insult to injury the company started an aggressive advert entrada ("Know more about your health!"), leaving trivial doubt about the underlying medical purpose of 23andMe'south Personal Genome Service. This left the bureau with niggling alternative but to have activeness. "Every bit function of our interactions with you, including more than 14 face-to-confront and teleconference meetings, hundreds of email exchanges, and dozens of written communications," the agency complained, "we provided you lot with… statistical advice, and discussed potential risk mitigation strategies." It is the tone of a spurned spouse, exasperated and aroused that 23andMe is putting no endeavour into salvaging their relationship.

But as the FDA frets almost the accuracy of 23andMe'due south tests, it is missing their true function, and consequently the agency has no clue virtually the real dangers they pose. The Personal Genome Service isn't primarily intended to exist a medical device. It is a mechanism meant to be a front end for a massive data-gathering operation against an unwitting public.

Sound paranoid? Consider the example of Google. (One of the founders of 23andMe, Anne Wojcicki, is presently married to Sergei Brin, the founder of Google.) When it first launched, Google billed itself as a faithful servant of the consumer, a company devoted only to building the best tool to help us satisfy our cravings for information on the web. And Google'south search engine did but that. But as we now know, the cardinal purpose of the company wasn't to assist us search, simply to hoard information. Every search query entered into its computers is stored indefinitely. Joined with information gleaned from cookies that Google plants in our browsers, along with personally identifiable data that dribbles from our computer hardware and from our networks, and with the amazing volumes of data that we always seem willing to share with perfect strangers—even corporate ones—that data shop has get Google's real asset. Past parceling out that information to help advertisers target you, with or without your consent, Google makes more than $10 billion every quarter.

What the search engine is to Google, the Personal Genome Service is to 23andMe. The visitor is non exactly hiding its ambitions. "The long game here is not to make money selling kits, although the kits are essential to get the base level information," Patrick Chung, a 23andMe board member, told FastCompany terminal month. "One time y'all accept the information, [the company] does actually become the Google of personalized wellness care." The visitor has lowered the toll of the kit again and again, most recently from $299 to a mere $99, practically making it a stocking-stuffer. All the better to induce volunteers to give 23andMe the data it so badly wants. (Currently, the database contains the genetic information of some one-half a million people, a number Wojcicki reportedly wants to double by twelvemonth cease.)

What does 23andMe want to do with all that data? Right at present the talk is all about medical enquiry—and, in fact, the company is doing some interesting work. Information technology has been sifting through its genomic database, which is combined with data that volunteers submit about themselves, to find possible genetic links to people's traits. (The brilliant-calorie-free/sneeze genetic tag is a 23andMe discovery.) More promising are 23andMe's attempts to recruit people who suffer from certain diseases, such every bit Parkinson'due south and a few types of cancer. Simply through brute-force pattern matching, the company has a gamble of finding genetic causes of these ailments, which could lead to a way to combat them. (And mayhap a blockbuster patent or three.)

That's only the starting time, though. 23andMe reserves the right to use your personal information—including your genome—to inform you lot almost events and to try to sell you products and services. There is a much more than lucrative market place waiting in the wings, as well. One could hands imagine how insurance companies and pharmaceutical firms might be interested in getting their hands on your genetic data, the amend to sell you lot products (or deny them to you lot). According to 23andMe'south privacy policy, that wouldn't be an acceptable use of the database. Although 23andMe admits that it volition share aggregate information about users genomes to third parties, it doggedly insists that it volition not sell your personal genetic information without your explicit consent.

We've heard that one before. Dorsum when Google was beginning launched, the founders insisted that the company would never sell you out to advertisers. The company admitted that it would share aggregate information about users' behavior with anyone who ponied up enough money, but the company'south privacy policy promised that "[i]ndividually identifiable information about you lot is not willfully disclosed to whatever third political party without offset receiving your permission." A decade and a half later, afterwards countless minuscule frog-in-boiling-water changes, Google'due south privacy policy is craftily worded, diluting the word "consent" so that it's implicit in most cases. (There are a few exceptions; the company has graciously agreed not to reveal that you are a homosexual or that you have heart illness unless y'all explicitly opt in. Just in matters not related to your medical weather, race, ethnicity, sexuality, or your political or religious beliefs, in that location is no such guarantee.) Not that your consent really matters, implicit or explicit. Google has repeatedly proven that it is more willing to break its promises and ignore its own privacy rules when it suits.

Why should we believe that 23andMe's promises are any more binding? Early signs certainly aren't encouraging. Even though 23andMe currently asks permission to use your genetic data for scientific enquiry, the company has explicitly stated that its database-sifting scientific piece of work "does non constitute enquiry on human subjects," meaning that information technology is not subject to the rules and regulations that are supposed to protect experimental subjects' privacy and welfare.

Those of the states who accept non volunteered to be a part of the grand experiment take fifty-fifty less protection. Even if 23andMe keeps your genome confidential confronting hackers, corporate takeovers, and the temptations of filthy lucre forever and ever, at that place is plenty of evidence that there is no such matter as an "bearding" genome anymore. It is possible to use the internet to identify the possessor of a snippet of genetic data and it is getting easier day by day.

This becomes a particularly acute problem once you realize that every one of your relatives who spits in a 23andMe vial is giving the company a non-inconsiderable chip of your own genetic information to the company along with their ain. If you have several shut relatives who are already in 23andMe's database, the company already essentially has all that it needs to know about you lot. It is doubtful that 23andMe would be able to protect that information even if information technology were then inclined.

While the FDA concentrates on the question of whether 23andMe'due south kit is a condom and effective medical device, it is failing to address the real result: what 23andMe should be allowed to practice with the data it collects. For 23andMe'due south Personal Genome Service is much more than a medical device; it is a ane-way portal into a world where corporations have admission to the innermost contents of your cells and where insurers and pharmaceutical firms and marketers might know more about your torso than you know yourself. And as 23andMe warns on its website, "Genetic Information that you share with others could exist used against your interests. You lot should be conscientious most sharing your Genetic Information with others."

Present visitor excepted, of course.