The Future of DTC Genomics and the Law

The LawSeq project’s mission was both to lay out the law of genomics as it exists today and to suggest the shapes it may take.¹ Today, with only a few exceptions, DTC is effectively, in law, a consumer service, with little regulation beyond the potential for claims based on false advertising, contract, or tort liability. Much good work has been done, inside and outside LawSeq, about the legal issues DTC genomics raises and whether its current treatment is appropriate.²

This article asks a different question: What will DTC genomics and its legal issues look like in ten to twenty years? Its speculation about the future starts with a look at the five current uses of DTC genomics: ethnic and family information, traits, medical information, “wellness,” and other. It then identifies three current legal issues — medical uses, privacy of genomic information, and privacy in collection and analysis of human DNA — before concluding the first two will become less important in coming decades, while the third will be increasingly significant.

Current Uses of DTC Genomics

November 19, 2007 can be called the effective beginning of DTC genomics, although a few firms offered some services earlier. That day the industry flagship — 23andMe — began offering genetic tests to the public without requiring any medical approval.³ Originally 23andMe focused exclusively on non-medical uses of their customers’ genotypes, things that customers would find informative and entertaining. These were largely ethnic or family information but also some traits, like a genetic prediction of ear wax type. Eventually 23andMe moved into the medical end of the market, particularly after its two medical use competitors, Navigenics and deCODEme, left the field in 2012.⁴ Meanwhile, other companies entered the market, in various ways, for different uses, and without significant regulatory scrutiny.

Ethnic and Family Information

People most commonly use DTC genomics for ethnic and family information. Of the three biggest DTC genomics companies in the U.S., two of them to date provide only ethnic and family information: Ancestry and Family Tree DNA. The third, 23andMe, provides ethnic and family information, but also medical, wellness, and trait information. Ancestry has about 15 million customers, 23andMe about 9 million, and Family Tree about 2 million, while other firms have much smaller markets.⁵

The big firms’ offerings in this area provide two services, which I call ethnicity information and family information. Ethnicity information tells people what ethnic groups their ancestors came from, by percentage. Thus, Ancestry DNA thinks my ancestors are 61 percent from England, Wales, and Northwestern Europe (which includes the Low Countries and the western parts of Germany), 28 percent from Ireland or Scotland, 4 percent from Norway, 3 percent from France, 3 percent from Sweden, and 1 percent from “Germanic Europe.” The Ancestry assessment does not match exactly with my family history but is fairly close. Sometimes, though, ancestry information does provide family surprises. Some people end up with ethnic backgrounds that shock them — African-Americans with unexpected European ancestry, white nationalists with African ancestry, anti-Semites with Jewish ancestry, and so on.

Family information may be the most popular DTC use. The three big firms allow their customers the choice to have their DNA analysis included in a big database, matching them with other consenting customers to see whose DNA suggests likely genetic relationships. Customers who opt in can see customers they match with, listed by names or handles, and can communicate with them through the firm. Typically, the firms will show relatives by degree of closeness, picking out parents, siblings, aunts and uncles, first cousins, second cousins, and so on. In my case it successfully identified my mother, an aunt, a first cousin, and a variety of second cousins. At third cousins and beyond, false positives are common. I have discovered a few relatives I had not known but all on branches of my family I knew about; thus far, I have not had any real surprises.

This is not the universal experience. Some people discover that the man they thought of as their father was not their genetic father, because of an unknown adoption, an undisclosed infidelity or rape, and sometimes an anonymous sperm donor. Others learn they have half-siblings from undisclosed (to them) children born to one of their known genetic parents or previously unknown cousins as a result of undiscussed and unacknowledged matings by more distant relatives. And some find tens or scores of half-siblings as a result of having a popular sperm donor as their genetic fathers. Discovering that a long dead uncle had an illegitimate child 70 years ago, producing a newly discovered half first cousin, is unlikely to be deeply disturbing. Learning that you have 100 half siblings as a result of a sperm donor or that you have a half-sib from an unknown liaison may be more upsetting or may also be exciting and positive.⁶

Paternity testing firms provide a third kind of ethnic and family information testing. These firms and their services are common but little discussed.⁷ Conventional wisdom says their customers are men, who were told they are a child’s genetic father (and may be liable for child support as a result), who want some scientific evidence on the question, and who may surreptitiously take samples that contain DNA. At least one firm advertises that it will analyze DNA from everything from a used band aid, to a facial tissue, chewing gum (sugar free only), a toothbrush, or a pacifier, providing success probabilities for each type — 90% for the used tissue, 75% for the chewing gum, and 40% for the pacifier.⁸ Firms willing to test unconventional samples for paternity could well be willing to test surreptitious samples for other ends.

Traits

23andMe also offers trait testing. It uses this term for genetic conditions that are not (clearly) medically significant. It currently provides reports for 33 such traits, from “ability to match musical pitch” to “cilantro taste aversion” to “earwax type” to “misophonia” (hatred of the sound of chewing) to hair color to “unibrow.”⁹ It is not clear why people are interested. Presumably, they already know whether they have a unibrow, hate cilantro, or have wet or dry earwax. What value comes from knowing whether your genes do, or do not, predict your actual traits?

Other firms provide more nebulous, and less easily evaluated, trait information, from what kinds of wine you’ll like to whom you should date. These have much less scientific evidence behind their predictions.

Medical Information

23andMe is the only firm offering what is clearly medical information on what is a clearly DTC basis in the United States, but its offerings have had a troubled course. After a slow start, by October 2013, it was providing 254 health related tests. All had some peer reviewed publications supporting their findings although most of the evidence was very limited. In that month, FDA sent a letter to 23andMe, warning that it appeared to be introducing a “medical device” into interstate commerce without the necessary FDA approval or clearance and telling it to stop.¹⁰ It did. It continued to sell its genealogical, ancestry, and trait services in the U.S. (and its health-related services in some foreign countries), but it stopped offering health information in the U.S. Over the next several years, it worked with FDA to get approval for some medical tests, with some success. Although genetic testing is a large and fast-growing part of medicine, as of late September 2019, 23andMe remains the only DTC genomics firm that has FDA approval for any DTC medical tests.¹¹

Traditionally, laboratories or firms have offered genetic testing for medical purposes only through health care providers — the tests are ordered by physicians (or the fairly uncommon medical geneticists) and the results are delivered to providers.¹² Several other firms, such as MyHeritage,¹³ Color,¹⁴ and recently Ancestry, offer an intermediate model, providing medically relevant genetic information but with more physician interaction required than by 23andMe.

Other

Some DTC genomics companies have other interesting niches, focusing on more sophisticated consumers. A few firms, perhaps worried about the FDA’s regulation of medical tests, have provided raw genomic data but no analysis.²⁰ Their hope may be that without any medical analysis, FDA will not consider them a regulated “medical device.” At the same time, other companies do not genotype, sequence, or otherwise analyze any DNA, but provide interpretations for genetic information that is submitted to them.²¹ When the information is medical, these firms, too, hope to avoid FDA regulation. So far FDA seems to have ignored both groups.²²

23andMe now offers four kinds of medical tests: for carrier screening, for genetic disease risks, for pharmacogenomic tests (assessing the effects of a person’s genomic variations on their reactions to various prescription drugs), and for “polygenic risk factors.”¹⁵ (It now lumps the last three into what it calls a “health predisposition report.”) Since February 2015, the first three have obtained some FDA approvals; the fourth, recently introduced, has neither sought nor received FDA approval. (FDA has recently strongly discouraged other DTC firms from providing pharmacogenomic information, a position attracting some controversy.¹⁶)

“Wellness”

More recently 23andMe has begun offering “wellness reports.”¹⁷ Currently, the firm offers tests for alcohol flush reaction, caffeine consumption, deep sleep, genetic weight, lactose intolerance, muscle composition, saturated fat and weight, and sleep movement. FDA has not asserted pre-market approval jurisdiction over these tests, apparently because it views them as low risk.¹⁸ This is consistent with FDA’s general hesitancy about the extent to which it wants to try to regulate “wellness” products, genetic or not.¹⁹

Three Current Legal Issues

With one big, and several small, exceptions, DTC genomic testing is subject to little specific regulation in the United States. Like any other consumer product, the firms are subject to general rules about false advertising, fraud, and so on. They may be subject to potential liability for harm done, although whether based on a negligence standard or on a product liability standard is unclear.²³ But DTC genomics does raise three special kinds of legal problems: regulation of its medical uses, disclosure and use of a person’s genetic information, and issues around unauthorized collection and analysis of a person’s DNA. This section identifies the issues; it does not attempt to solve them.

Regulation of Medical Uses

As a general matter, medical tests are classified as medical “devices,” subject to regulation by the FDA under 1939’s Federal Food, Drug, and Cosmetic Act and its Medical Device Amendments of 1976.²⁴ For medical devices, FDA often exercises, implicitly or explicitly, what it calls “enforcement discretion.” FDA uses this enforcement discretion to avoid treating most diagnostic tests as devices subject to its approval requirements. These have traditionally been tests ordered by a physician and performed by licensed clinical laboratories,²⁵ with the results sent back to the ordering physician. FDA calls such tests “laboratory developed tests” or “LDTs.”

It takes a different position with respect to DTC tests. It has announced that it will not exercise enforcement discretion with them but will require the firms demonstrate to FDA that their tests are not only analytically valid, accurately identifying the genetic variations they claim to find, but also clinically valid, demonstrably related to the condition or the risk they purport to diagnose or identify.²⁶

The FDA’s role has sparked bitter disputes about DTC genomic tests. Some have argued that genetic information, even that with medical implications, should be available to all because it is, after all, the customer’s DNA.²⁷ Others argue, equally vehemently, that genetic information with medical implications should be delivered through a trained medical professional, for fear that customers will misinterpret the information to their own harm.²⁸

Within the medical realm this question is about the quality of care. No one should doubt that medical genomic information provided through a trained physician, medical geneticist, or qualified genetic counselor is usually better than information provided by email or the website of a DTC company. But the higher quality comes with a higher cost.

This issue is not new, but is a deep issue about American medicine generally. Licensed physicians, graduates of accredited medical schools who have met, and maintained, all the requirements for medical licensure, are expected to be better at medicine than less trained “practitioners” — but are also known to be more expensive. Some libertarian thinkers, dating back at least to Milton Friedman, have argued that medical practice should not be limited to licensed physicians but that people should be able to hold themselves out as “healers” of one kind or another, as long as they are honest about their training, skills, and certifications.²⁹

Today, the issue of medical information is not “DTC or nothing.” People who want sound genomic medical information can get it through medical practitioners, sometimes with, or sometimes without, insurance. The question is whether they should be required to pay two to five times as much for professional help as for DTC analysis. Still, there is a deep question about paternalism versus liberty. People who think they can usefully absorb the medical implications of their genetic information with no harm and some benefit to themselves ask why they cannot learn, without physician intermediation, this information about their own bodies. And if told it is because other people would not be able to interpret the information as well, they can ask, “why should we be held up by the limitations of others?”

Different countries and different people have different positions about DTC medical testing. The U.S. is unusually open to such tests; many other countries forbid them.³⁰ At the personal level, far more people have taken genetic genealogy tests than are taking medical DTC tests.

Protection and Use of Genomic Data

The second issue revolves around the protection and use of the data DTC consumers give the firms as well as the results of the firms’ analysis. This breaks down into three questions: the measures the firms will take to protect the information from unauthorized parties, the uses the firms will make of the information themselves, and with whom the firms will “share” the customers’ information.

For the most part, the protection and confidentiality of the materials consumers submit to DTC firms, and the data gleaned from them, are governed by the agreements between the parties. This is similar to how the law treats information you give — or unknowingly “give” — Facebook, Google, or your cell phone or credit card company. It presumes an entirely unrealistic degree of knowledge and intended “consent” on the part of the consumer. Many DTC companies do not have express privacy policies, and the policies of those that do vary somewhat from one to another.³¹ Few of the policies go into any detail about how they will keep a customer’s information secure from unauthorized users. And none, of course, can honestly promise that they will prevent hacking. At most, they can promise to try.

The firms generally state that they have the right to use the customers’ data for their own purposes. These may be quality assurance or may be further ethnicity or even medical research. More controversial is whether the firm may “share” those data, directly or indirectly, with others. This has recently attracted great attention in the forensic context. Some firms, or organizations, have allowed law enforcement officials to use their customer databases in an effort to solve crimes. In widely discussed cases, law enforcement was allowed to submit a DNA profile from a crime scene in order to look for the suspects’ relatives in the organization’s database. The so-called Golden State Killer was identified by matching his crime scene DNA to a third cousin in a service called GEDmatch, which allows people to upload their data from one of the ancestry firms to a database where it can be compared with data from people who used a different service. Since then, suspects in more than fifty cases have been identified by this kind of genealogical forensic testing.³²

Another conflict concerns the “sharing” of analyzed data for research purposes by that firm, usually for compensation, with pharmaceutical, biotechnology, or university researchers.³³ Presumably such sharing will improve public health in general. Some customers are eager to have their information used to advance medicine; some may object to the firms being paid for “selling” their customers’ DNA data; and others may just not want their data shared, period, whether from fear of privacy leakage or other reasons.³⁴

Note that the discussion is, thus far, purely a matter of either contract law or of the firms’ discretion. Five states do have specific genetic privacy statutes that give the sources a property right in their genetic information: Alaska, Colorado, Florida, Georgia, and Louisiana.³⁵ The meaning and limits of these statutes are not clear, although ongoing litigation is testing the limits of Alaska’s genetic privacy statute.³⁶ One might argue for stronger state or federal laws to require the DTC firms to protect consumer information and to require “better” authorization — specific, affirmative agreement by the consumer for specific kinds of uses, or even for uses by specific recipients. Or one might argue, as some did with the Genetic Information Non-Discrimination Act, that special treatment is needed to reassure people that getting genetic testing is a good thing,³⁷ but that argument works better when individuals are being asked to participate in either genetics research or their own health care — the social value of the DTC uses are much lower. There is Congressional interest in privacy legislation around DTC genomics with at least two bills in the works that address genetic information specifically, as well as a coalition of genomics firms — including Ancestry, 23andMe, and Helix — lobbying for legislation on the topic.³⁸

The underlying deep privacy issue may be as stark as whether we should, or can, try to preserve privacy. Scott McNealy said twenty years ago: “You have zero privacy anyway. Get over it.”³⁹ How much do we care about genetic privacy — and how much do we care about protecting people who do not care enough to protect that privacy themselves? In DTC genomics, this question is further exacerbated by the likelihood that, for most of us, our genomic information is less revealing than much of our other data that are fairly widely available, such as credit card expenditures, Google searches, or cell phone locations. This likelihood, however, is not widely appreciated by the public and, in any event, will not be true for the minority of people with a clear and strong genetic disease risk (or, perhaps, embarrassing ethnic or family connections).

Surreptitious Collection and Analysis of DNA

The third legal question concerns surreptitious collection and analysis of DNA. Should someone be able to collect and then analyze your DNA without your consent — or even knowledge? There are few cases about surreptitious DNA collection and analysis and almost all of those involve law enforcement. In all but a handful of states, existing doctrines about discarded or abandoned property make the most likely answer “yes.” If the DNA is collected from discarded materials — cigarette butts, drink containers, facial tissue, diapers — the law has largely treated it as “abandoned property,” available to any claimant.⁴⁰ In the criminal context where law enforcement surreptitiously collected and analyzed DNA samples, those actions have been universally upheld.

The collection and analysis by people other than law enforcement officials has yet to be fully tested in court in the private context, although one truly bizarre set of lawsuits is proceeding between two South Florida billionaire neighbors, Ike Perlmutter and Harold Peerenboom.⁴¹ Four of the state statutes — in Alabama, Colorado, Florida, and Georgia — proclaim that a person’s “DNA analysis” or “genetic information” is his or her “exclusive,” or “unique” property.⁴² These statutes may make that kind of unconsented and surreptitious DNA collection and analysis illegal. But we have no cases yet and the scope of these bans are not clear.

The Future

Within a few years, two of the three legal issues around DTC genomics — medical uses and the protection and sharing of customer data, should fade as an issue, as should those parts of the industry themselves. Surreptitious collection of DNA and its unconsented analysis will remain a potential and likely growing problem.

Future Regulation of Medical Uses

In the near term, it remains unclear what FDA will end up doing about DTC genomic testing, or even clinical laboratory genomic testing. Although some of the 23andMe approvals seemed to indicate significant FDA acceptance of such testing, in late August FDA pushed back against the use of DTC genomic testing for pharmacogenomics.⁴³ The future course, especially across presidential administrations, seems highly unpredictable.

But, looking 10 to 20 years away, whether it comes quickly or slowly, genomic information will become a part of normal health care. When people with health coverage routinely have their whole genomes sequenced and their doctors provided with assessments of their DNAs’ significance, what will be the market for medical DTC genomics? It will be hard to sell when doctors are using whole genome sequence information and are providing at least some medically useful information, especially if that is covered by health insurance. A market may still exist for “wellness” information and other more scientifically questionable health-related findings, but, even then, the companies will not be reading, collecting, and analyzing DNA, but just interpreting DNA results from their customers’ health providers. And while some Americans might still lack decent health coverage and health care in 10 to 20 years, they will not be people who can afford to support a robust medical DTC genomics industry.

Future Protection and Use of Genomic Data

Data protection and use issues are most strongly associated with the ethnicity and family information uses of DTC genomics, if only because they have been the most popular. They also are likely to fade away.

For one thing, even though genealogy is a huge interest, it is not an unlimited one. About 30 million Americans have gotten an ancestry/genealogy assessment today. That’s about 9 percent of the population and about 12 percent of the adult population. Many of the others will have no interest in these services; some others will have some interest but will learn enough from relatives who have been tested. After all, if my genetic sister knows her ancestral information and all her genetic second-cousins, I can learn all that from her. There may be a few small differences in our ethnic percentages, but will they be worth spending money to find out?

There already may be some evidence for this.⁴⁴ Illumina, the world’s largest provider of genomic analysis, announced in August 2019 that its revenues were going to be sharply lower, mainly because of greatly decreased sales of the SNP chips that feed the DTC market.⁴⁵ In May 2019, Helix, a company that intended to sequence DNA samples from customers and then let them choose what kinds of analysis they wanted through various “apps,” shifted its strategy away from DTC genomics to working with health care institutions; Color has similarly moved away from the DTC approach.⁴⁶ Gencove, another firm that provided DTC services, stopped offering them in May 2018.⁴⁷

It is also possible that sales have declined because of the publicity about the forensic genealogy searches. Even here, current market driven movements may make these issues less important.

Although the protection of company data is a significant issue, the most important of these issues come not from the existence of genomic data on people but the broad availability of that data. GEDmatch has been the prime source for forensic use of genetic genealogy, but after initially embracing police uses, at least in certain serious crimes, in June 2019, GEDmatch announced that it would allow family forensic genealogy searches only of data from participants who affirmatively opted in.⁴⁸ Data from those who did nothing — perhaps because they had forgotten they were GEDmatch members, they didn’t care, or they were dead — would be excluded. So far, only 163,000 of the more than 1.2 million GEDmatch members have opted to be available for such searches.⁴⁹ (On September 19, 2019, I received an email from GEDmatch encouraging me, as a member, to opt-in for forensic uses.)⁵⁰

Meanwhile, of the three main ethnicity and family information companies, Ancestry and 23andMe have said they will not voluntarily cooperate with law enforcement and will resist, in court, any subpoena or search warrant. Family Tree, on the other hand, has said that it will allow law enforcement to submit genetic profiles to its database (at least in serious cases).⁵¹ And in September 2019 a newly started DTC company, Nebula Genomics, announced that it would provide whole genome sequencing anonymously, without requiring customers to provide even their names, addresses, or credit card information.⁵² That same month the U.S. Department of Justice offered interim guidelines on when it would use these methods.⁵³

The availability of non-public databases for forensic searches or for other privacy invasions, either as a result of search warrants and subpoenas or from hacking, will remain possible but the large, and growing, majority of genomic databases will not be in DTC firms but growing medical and forensic databases. Issues of judicially enforced disclosure, or of leaked or hacked “disclosure” will require legal clarity, but they will not primarily issues of DTC genomics.

Future Surreptitious Collection and Analysis of DNA

Surreptitious collection, on the other hand, not only seems unlikely to go away but may accelerate. New methods are being developed to collect and rapidly analyze DNA samples for forensic purposes.⁵⁴ It is not clear how often someone will care, apart from paternity disputes and law enforcement uses, but as DNA analysis becomes cheaper and better, it will be done more often. Early adoption of rules requiring permission would be especially useful.

Beyond a few plausible exceptions — such as law enforcement uses, the collection of unidentified human DNA from the environment for research, or parents having the DNA of their minor children tested for medical purposes — there seems no good justification for unconsented, surreptitious DNA collection and analysis.

The circumstances under which this privacy right can be waived, in advance and in general, should also be clarified. Today, an employment contract cannot justify this conduct. Employers are already largely forbidden from collecting, analyzing, or using employees’ DNA even with their consent, as shown in the “Case of the Devious Defecator.”⁵⁵ There, a warehouse firm was plagued with human excrement; it suspected two employees, got them to consent to cheek swabs, and tested their DNA against DNA in the excrement. The DNA did not match — and then the employees successfully sued under the Genetic Information Nondiscrimination Act.

Current state genetic privacy laws might be useful models, although muddying a prohibition on unconsented or inappropriate collection and analysis of DNA with the language of “property” or “ownership” will likely cause confusion. Instead, one might just require that whoever analyzes a DNA sample must have good evidence that it was either collected consensually or under an applicable exception.

Conclusion

Twenty years ago, DTC genomics did not exist. Twenty years from now, it may once again not exist, or, at the least, be less common. How much effort should we put into regulating today’s problems when we think they will not be tomorrow’s? This is, to me, an example of the need for regulation that includes monitoring of the actual, changing realities and that modifies itself as those realities change. But it is always easier to find capital — either monetary or political — to start something than to monitor, maintain, and modify it over time. We should work hard to avoid that in the regulation of DTC genomic testing.