Consumer DNA tests after 23andMe: what a saliva kit reads, and who keeps the data

A customer spits into a plastic tube, posts it, and a few weeks later receives a report: estimated ancestry by region, and, depending on the product and the country, genetic predispositions to conditions such as breast cancer or Parkinson's disease. Information once confined to research laboratories and hospital genetics departments is sold online, often discounted around the holidays.

The company that did most to make this ordinary was 23andMe, co-founded in 2006 by Anne Wojcicki. The name refers to the 23 pairs of human chromosomes. The Human Genome Project had been declared complete three years earlier, and the founding idea was that people should have direct access to their own genetic information. The first test, in 2007, cost about $1,000. The price later fell to $99, low enough for an impulse purchase or a gift.

The company's trajectory, from cultural phenomenon to regulatory clash, public listing, data breach and bankruptcy, is the subject of a French-language episode of Tech Anatomy's ERROR 404 series.

The FDA letter and the road back

On 22 November 2013, the US Food and Drug Administration sent 23andMe a warning letter ordering it to stop marketing its Personal Genome Service until it obtained authorisation. The agency treated health risk reports as medical devices that had to demonstrate reliability before sale. The letter named the concern directly: a false positive on a BRCA cancer risk result could lead someone to "undergo prophylactic surgery", while a false negative could hide a real risk. In early December 2013, the company stopped providing health reports to new customers.

The episode presents the dispute as two defensible positions. For the regulator, someone reading a high cancer risk on a screen, with no clinician to interpret it, could act on a misunderstood result. For the company, this was the customer's own biological information, and restricting access slowed innovation and treated adults as unable to handle facts about themselves.

23andMe chose to work through the regulatory process. In April 2017, the FDA authorised its genetic risk reports for ten conditions, including Parkinson's disease, a first for direct-to-consumer tests. On 6 March 2018, it authorised the first direct-to-consumer test reporting on cancer risk, covering three variants in the BRCA1 and BRCA2 genes. In 2021, it went public through a merger with a listed shell company sponsored by Richard Branson, at a valuation of $3.5 billion.

What the kit actually reads

The episode's central technical point is that a consumer DNA test does not sequence the genome's roughly three billion letters. It uses SNP genotyping. A SNP, or single nucleotide polymorphism, is a position in the DNA where the letter commonly differs from one person to another. A genotyping chip, a small glass slide carrying microscopic probes, checks a preselected list of these positions in one pass. A 2021 survey found that most consumer products read 600,000 to 800,000 SNPs.

The episode compares this to reading only the pre-highlighted words of a book. The three BRCA variants authorised in 2018 are most common in people of Ashkenazi Jewish descent and much rarer in other populations, while many other harmful variants exist in the same genes. As the company's own announcement stated, a negative result does not rule out other cancer-related variants.

Ancestry estimates work by comparison. The customer's SNPs are matched against reference panels of people with documented geographic origins, and the software calculates which populations each segment most resembles. The percentages can change as the panels grow, though the DNA does not. Risk results describe probabilities observed in populations. The FDA's 2017 authorisation stated that the tests "cannot determine a person's overall risk of developing a disease", because environment and lifestyle also contribute.

The business model, the breach and the sale

A DNA test is usually bought once, so growth depended on new customers or on the database's value for research and drug development. In October 2023, 23andMe disclosed a data breach. According to the company, attackers used credential stuffing, trying email and password pairs leaked elsewhere, and entered about 14,000 accounts. Through the DNA Relatives feature, which links users to genetic relatives who have opted in, those accounts exposed information on about 6.9 million people, a figure the company confirmed in December 2023.

The episode connects this to an older case. In April 2018, California investigators identified Joseph James DeAngelo, the Golden State Killer, by uploading crime-scene DNA to GEDmatch, a public genealogy database, and building family trees from distant relatives who matched. He had never submitted his own DNA.

In March 2025, 23andMe filed for Chapter 11 bankruptcy protection, and the data of more than 15 million customers became part of the assets for sale. Regeneron Pharmaceuticals won an initial auction in May with a $256 million bid. After several US states raised concerns about the transfer, bidding was reopened, and on 30 June 2025 a judge approved a $305 million sale to TTAM Research Institute, a nonprofit created by Anne Wojcicki. The transaction closed in July 2025. TTAM committed to keeping 23andMe's existing privacy policies "in perpetuity" and to letting customers change whether their data are used for research.

Two readings of the same history

One reading treats 23andMe as a pioneer that ran into regulation, economics and security in turn, on ground no one had mapped. It normalised the idea that individuals can access their own genome, and that idea survived the bankruptcy. The episode closes in this spirit, observing (translated from French) that "technology has settled the question of access; the question of responsibility remains largely open".

A second reading focuses on what makes genetic data different from other personal data. A password can be changed and a card replaced, but a genome cannot be reset, and it is partly shared: a person shares about half of their DNA with each parent and child. In this view, the consent model of consumer services, where each individual decides alone, does not fit data that describe relatives who never signed up.

What the story does not settle

The breach and the bankruptcy show that the data were exposed and transferable. They do not show how often consumer genetic data have been misused. Nor does the story say whether customers acted on risk results in harmful ways, which was the FDA's original concern.

National rules also differ sharply. In France, the civil code limits the examination of a person's genetic characteristics to medical purposes or scientific research, and the penal code punishes requesting such a test outside those conditions with a fine of 3,750 euros. Recreational tests are therefore banned. In July 2026, Parliament passed a law allowing investigators to compare DNA against foreign genetic databases, including those of consumer companies. On 23 July 2026, the Conseil constitutionnel struck that provision down, holding that the legislature had not set its conditions itself and had not balanced crime-solving against the right to privacy.

What to watch

The indicators worth following are whether TTAM's privacy commitments hold over the coming years, whether US states or Congress adopt rules specific to genetic data in bankruptcy and sale, and whether France returns to forensic genetic genealogy in a revised text. Each bears on who is expected to keep this information, and none has been answered yet.

Listen to the episode

ERROR 404 - La folle histoire des tests ADN

Listen · 16 min