It took a surprising amount of spit to hit the fill line on the 23andMe DNA sample kit — I kept having to swish my tongue around and create more and more saliva until I finally hit the line. And to be honest, I’ve never even been all that interested in my heritage, but I did want to find out what exactly happens to someone’s DNA when they send it to one of these companies, and more importantly, if getting a sample back from them is possible. (Also, I guess I was a little curious as to whether I actually had that 1/16 Cherokee Indian in me that I’d always heard about.) Anyway, this being the only real way in, I spat myself dry, sealed the tube shut, sent it to 23andMe and waited.
Less than two weeks later my results were ready — way faster than the six weeks they’d promised. I took a look at my profile and found predictably boring results: 40.4 percent British and Irish; 22.8 percent French and German; 17 percent Scandinavian; 16.8 percent “broadly Northwestern European,” whatever that means; and 0.8 percent Southern European. Basically, all kinds of white, plus not even a hint of Native American. Big whoop.
Now that it was all processed came the ultimate test: trying to get them to delete my information and send me back my vile of fluid. My confidence going into this venture wasn’t very high, as some of what I’d read online was really troubling — say, how the FBI may have seized one woman’s DNA from a similar firm to investigate the agency, and how these organizations tend to be just barely compliant with the GDPR (the General Data Protection Regulation). Then there was the case of the Golden State Killer, who was caught because a relative of his had submitted his DNA to a genetics research organization (of course I’m glad that guy was caught, but I imagine Thanksgiving dinners have gotten way more uncomfortable for the one who submitted his DNA, and I just don’t want to be in that position).
Not only that, but I found that the results you get back aren’t even that accurate, with some people receiving different results from different companies. Some have even tested identical twin DNA and got back differing results. Why this happens is a bit technical, but it basically boils down to the fact that DNA testing isn’t an exact science, which is unsettling for a whole bunch of reasons.
I certainly questioned my reported heritage after seeing that my half-sister, who’s also taken the test, only shared 18 percent of my DNA — shouldn’t it be 50? I’m sure a scientist will eventually tell me I’m a moron for asking this, but come on, it sounds reasonable enough. Apart from anything else, while I get that we each got different stuff from our dad, our ancestry is the same on that side, and isn’t that what this is supposed to measure?
Anyway, it was time to get my spit back, so I reached out to 23andMe via their customer service page:
This was the message I sent to 23andMe after thinking about it for a few days (yes, I spelled “received” wrong, I know that now). While I recognize that I had the option to have them destroy my sample, I didn’t really trust them to actually destroy it, so I asked for them to return it to me outright — just seal it back up and give me my spit back, thank you very much.
After a few days, I heard back from Henry at 23andMe.
Hello Brian,
Thank you for contacting the 23andMe Team. I apologize for the delayed response. I understand that you are requesting that your saliva sample be returned to you. Unfortunately, per our Terms of Service, we are unable return samples to customers once samples have been sent to our laboratory and processed. I apologize for any inconvenience.
Additionally, providing each and every one of our customers with accurate data is a top priority for 23andMe. We have several quality control steps during the processing and loading of genetic data. I understand that you may have questions about our interpretation of your data, and I would be happy to assist you.
In order to best assist you, please provide me with more information in regards to your concern.
I will await your reply.
Best regards,
Henry
Of course, I found that reply far from satisfying. I don’t give a shit about their terms of service: this is my DNA, and I should be entitled to it. I asked exactly why I couldn’t have it, and Henry predictably replied with a quote from their terms of service: “Your saliva sample, once submitted to and analyzed by us, is processed in an irreversible manner and cannot be returned to you,” which only raised more questions in my head.
Naturally, I replied.
Thank you Henry, but I am very concerned about this phrase: ‘Your saliva sample, once submitted to and analyzed by us, is processed in an irreversible manner and cannot be returned to you.’
What precisely was done? I understand it was ‘processed’ but what does that mean? Is it still spit? And where geographically speaking is my DNA? Is it at your headquarters in California? May I come by and pick it up?
After a couple of days, Henry finally replied with some details:
Hello Brian,
Thank you for your reply. All of the laboratory testing for 23andMe is done in a CLIA-certified laboratory. Once our lab receives your sample, DNA is extracted from cells preserved in your saliva. The lab then copies the DNA many times — a process called amplification — growing the tiny amount extracted from your saliva until there is enough to be genotyped. In order to be genotyped, the amplified DNA is ‘cut’ into smaller pieces, which are then applied to our DNA chip (also known as a microarray), a small glass slide with millions of microscopic ‘beads’ on its surface. Each bead is attached to a ‘probe,’ a bit of DNA that matches one of the genetic variants that we test. The cut pieces of your DNA stick to the matching DNA probes. A fluorescent signal on each probe provides information that can tell us which version of that genetic variant your DNA corresponds to.
You may review more information in regards to sample processing here: https://customercare.23andme.com/hc/en-us/articles/202904590-What-happens-to-my-sample-at-the-laboratory-
As your saliva sample has gone through the processing steps mentioned above, we are unable to return saliva samples back to customers.
As you have opted in to store your sample during registration, any remaining saliva sample is stored at our contracted third-party laboratory facility. This facility is separate from our corporate headquarters located in Sunnyvale, CA.
Please let me know if I can be of further assistance.
Best regards,
Henry
The 23andMe Team
Finally, some details! So, Henry explained how they grow my DNA, slice it up and flash some lights on it. Cool! But I still want my stuff back, so I pressed Henry on where my DNA is, since he never answered that question, and I also expressed my concerns about it being used for law enforcement purposes, etc. But after this email, Henry stopped replying. After a few unanswered follow-ups — including one where I requested a picture of my sample — I decided to call 23andMe and go from there.
While I knew I wasn’t going to get my sample back by now, I still wanted to know exactly what was going on with my DNA. I had chosen to “biobank” my sample in case I desired further testing, like the “health risks” assessment they offer, so I wanted to understand what exactly that meant, and what provisions were taken to protect that physical sample. Additionally, I wanted to understand what was happening with my actual genetic information. Was it accessible to law enforcement? Who can see it?
I called them up and was eventually put in touch with Gemma, who told me she couldn’t disclose precisely where my DNA was, but she was able to tell me that they have two U.S. labs, one in L.A. and the other in Burlington, North Carolina. She also kindly provided a video that went into a bit more detail as to their laboratory procedures.
As for the biobanking, I was surprised to find out that my stuff isn’t frozen: Instead, it’s just stored with a preservative in it to keep it viable, then secured at one of their labs for one to ten years. Naturally, I was worried about the access they had to this sample for the next decade, so Gemma assured me that no further testing could be done without my consent.
When it comes to law enforcement, Gemma explained, “For 23andMe, we use all legal measures to resist any of those requests,” further confiding that they’ve received many requests from governmental and foreign entities, and that they successfully challenged all of those requests.
Overall, I was fairly satisfied with Gemma’s answers. While still a bit skeptical, it did seem as though things were on the up-and-up with 23andMe. But I still couldn’t quite scratch that itch of discomfort. This big company had my DNA — that alone is concerning, no matter their safeguards. With that in mind, I decided to find an expert on the subject to see if my fears were at all founded and — as it turned out — yeah, they totally were.
Joel Winston, an attorney who specializes in privacy law and co-founder of Special Scores — not to mention being a former Deputy Attorney General of the state of New Jersey — explains to me that one of the concerns about 23andMe, as well as other DNA testing services like Ancestry and My Heritage, is that they’re not the ones directly processing your sample. Instead, it goes through a third-party laboratory, and the concern there is that it’s hard to be sure about the privacy measures taken by that lab. In the event of a breach or some sort of hack, you may not realize that the obscure laboratory that just got hacked was actually working with 23andMe and has your sample.
Additionally, if they do mishandle your sample in some way, you cannot sue them, because you’ve already signed this right away in the terms of service — you can’t take 23andMe to court for the mishandling of your data and/or sample. Instead, it’s sent to arbitration, which Winston explains “is a private venue to resolve disputes, that doesn’t contain the same protections you’d get in court.” (For example, there may not be the disclosure of documents to both sides.) Also, arbitration is usually paid for and selected by the company you’re going against, and while most of these DNA-testing companies are all the same for the most part, Winston says that when it comes to arbitration, 23andMe goes a bit further than other companies in that there’s a “fee-shifting provision,” meaning that if you bring them to arbitration and lose, you’ve got to pay their legal bills. Yeah, you read that right.
Another cause for concern is that basically all of these companies work with pharmaceutical companies in one way or another. This means that my DNA has been sold to them if I consented to take part in their research, which, of course, I did, because it was a lot of words and I never read consents — no one does. “When you send them your DNA sample, you’re giving them ownership of your DNA, your sample and all of the data derived from it,” Winston confirms. “So they now own a piece of you, or a license to a piece of you.”
Winston has tangled with one of these companies before — Ancestry — over a piece he did on their terms of service and how they essentially “own” your sample. While Ancestry claimed, “You still own your DNA, we don’t take it from you,” Winston retorts, “Yeah, that’s true, because it’s in your body and Ancestry didn’t murder you, but now Ancestry also has it.”
Winston goes on to say that, with this data, they’re creating a mass database of information that they can now monetize by selling it to pharmaceutical companies and the like. While the companies say this is for genetic research — implying that it’s for the public good — this research goes on to create cures to be sold. Pharmaceutical companies are for-profit companies, after all, so indirectly, they’re making money off your DNA, and all you get in return is some results that say whether or not your Grandpappy really did have some Italian blood in him (which again, may not even be accurate). Try taking that to the bank.
I ask Winston if companies like this are basically a front for amassing genetic data to monetize, and while he stops short of calling them a “front,” he does say, “Clearly, their goal is to acquire this information for medical and pharmaceutical purposes.” As evidence of this, I find 23andMe’s constantly dropping prices compelling: It went from $799 when they first started in 2007 to $99 now, and while a price drop sounds nice, it kind of shows that it never cost $800 to test your DNA in the first place and — as a company worth $2.5 billion — they’re making way more money somewhere else.
But my data is aggregated, right? Like, they’re not selling just my data to Big Pharma, they’re selling aggregated data reflecting millions of clients?
Well, Winston says that depends: While they do send aggregated data, there have been cases where individual data has proven to be useful to big companies. One such case was a woman named Henrietta Lacks, a patient at one of the national institutes of health in the 1950s, whose cells were cultured without her knowledge and turned out to be extraordinary. As it turned out, they were perfect for reproducing in a laboratory setting, and to this very day, her DNA is still being utilized in thousands of labs worldwide. Thanks to her DNA, billions of dollars have been made to create cures and medicines, but Lacks remained unaware of this — her family only gained money decades later after a lawsuit. And while the Lacks case is rare and I doubt that my own DNA will prove to be all that special, it shows that an individual sample can have value — sometimes remarkable value.
And so, Winston reiterates that they’re not holding onto my sample for no reason: If it proves valuable to them to go back into it, they can. Worse yet, even though I remembered that Gemma told me they’d need further consent to go back into my sample, Winston counters by saying that I’ve already consented to them using it in this way, whether they go back to that spit or not. “They don’t call you back, they use the existing terms,” Winston says, though he does add that he’d be happy to be wrong about this, and that while he hopes they’d get further consent to go back into your sample, he hasn’t heard of any additional consents in his work. “They’re not pinging you individually each time,” he says.
In regards to law enforcement obtaining my sample, I tell Winston about Gemma’s reply, and her claim that they’ve countered all such requests, but he points out that if they receive an actual warrant, he doesn’t see how they could refuse. It was at that point that I realized how carefully worded Gemma’s reply was: “We use all legal measures to resist any of those requests.” Winston explains that they may have declined informal requests, but they likely haven’t yet received any such warrants, as law enforcement looking into these kinds of services is fairly new. That doesn’t mean, however, that they’d be permanently able to secure my sample from law enforcement, which is good/bad news if I happen to have any serial-killer uncles that I am unaware of.
So is the worst thing that could happen not getting a cut of the profits from my spit? Nope! Winston adds that DNA holds valuable information for entities such as health insurance companies, life insurance companies and the like. While that data is presently protected to prevent it being used in this way, Winston says these laws “aren’t rock solid,” and that “in the past few years, a few Republican-led lawmakers have tried to remove some provisions from the Genetic Information Nondiscrimination Act, which is what largely prevents those insurance companies from outright buying that info.”
While life insurance companies can’t get that data yet, Winston says that they can ask if you’ve taken any such test, which might tell them if you’re predisposed to breast cancer or something like that. You can lie and say you didn’t take any such test, but if that lie is discovered, it would present the insurer with the grounds to terminate your insurance because you lied to them during the application.
Finally, although Winston says he has no reason to believe these companies don’t destroy your sample upon request, he does say he’s had clients who are skeptical of that promise, as it’s only verified via a one-sentence email.
Needless to say, after talking to Winston, I want the fuck out of this whole thing and decide to have my sample destroyed. So I call back 23andMe and — after a bit of shuffling around — I’m put in touch with none other than Henry, my original customer service rep! At first, Henry acts like he doesn’t remember me, but I can tell he does: No way he forgot the guy who requested a picture of his DNA. So I ask Henry about some of the stuff Winston told me about. That arbitration thing? Yup, that’s totally real, although he declines to give details over the phone, instead referring me to their terms of service, also known as their verbal chloroform.
Henry also says that the third-party lab that’s handling my information is LabCorp, which is the same service that many doctor’s offices use for testing blood samples and the like (I actually recognize the name, as my own lab results went through LabCorp before). Henry further explains that LabCorp is CLIA certified, which means that — while nothing is invulnerable to hackers — it’s pretty secure.
As for Big Pharma, Henry admits, “We do have a relationship with GSK,” which is the sixth largest pharmaceutical company in the world. He tells me that while my data was sent to them, it’s all de-identified (which I already knew), they only have information available to them in aggregate and GSK would in no way be able to single out my individual sample. I press Henry on this a few times, and he assures me repeatedly that my information is only in aggregate, and that no individual DNA info is provided. In other words, at least from this, there seems to be little danger of a Henrietta Lacks situation, where massive profits can be made off one person’s genetic code.
Henry then reminds me that I can opt out of 23andMe Research, which means my data can’t be sold to GSK, but that any of my info I’ve already provided can’t be pulled out of their data. In other words, my info is already among the millions of other people’s info, and there’s nothing I can do about it.
While it was slightly reassuring to hear that my singular data can’t be provided, I know far too much about this stuff now to be comfortable with it, so I still want out. I want my sample destroyed, and my information off of their system and site. I want it like I never dealt with 23andMe, which, as it turns out, is pretty much impossible — at least for the next decade.
Yep, the information really does remain in their system for the next 10 years. As Gemma details in a follow up email:
The federal Clinical Laboratory Improvement Amendments (CLIA) of 1988 and California laboratory regulations require our lab store your de-identified genotyping test results and to keep a minimal amount of test result or analysis information. CLIA was established to ensure labs meet to quality control and safety practices and sometimes require audit, inspection and validation oversight by federal and state agencies. As such, per laboratory regulations the lab cannot delete all information. Our laboratory will retain your genetic information and a randomized identifier on their secure servers for a limited period of time, 10 years pursuant to CLIA regulations.
So for the next 10 years, my info will still be in the system over at LabCorp and 23andMe. As for my sample, while I’m repeatedly assured it will be destroyed within the next 30 days, Henry and Gemma are both frustratingly vague as to how it’s destroyed. Is it dumped down a sink? Burned? Or is it even destroyed at all? Can LabCorp someday make little mutant clones of me? Who knows?
Finally, I pull the plug on all of this and opt out. I follow the instructions Henry sent me via email and at the end receive a simple, one-paragraph reply:
I guess that’s about as good as it’s going to get.
Brian VanHooker
Brian VanHooker is a staff writer at MEL specializing in pop culture, food (especially pizza) and long form oral histories. He is the co-creator of the comic book "Barnum & Elwood" and "The Tramp," a comedy pilot starring John O'Hurley. He also hosts a TMNT interview podcast called "Turtle Tracks" and was once called a "Good Guy" by Mr. T.
