On a special episode (first released on April 16, 2025) of The Excerpt podcast: The recent bankruptcy of genetic testing firm 23andMe has raised alarm bells for privacy advocates and consumers worried about their personal information. The data managed by 23andMe could eventually be used in any number of negative or nefarious ways, from discrimination to executing a sophisticated scam. And to be clear, this isn’t just a 23andMe problem. Bankruptcy and data theft are just as much a risk with other DNA testing firms. So, what should people know about privacy and genetic data security? Kayte Spector Bagdady, a member of the health law and bioethics faculty at the University of Michigan, joins The Excerpt to share a legal and medical perspective.
Hit play on the player below to hear the podcast and follow along with the transcript beneath it. This transcript was automatically generated, and then edited for clarity in its current form. There may be some differences between the audio and the text.
Podcasts: True crime, in-depth interviews and more USA TODAY podcasts right here
Dana Taylor:
Hello and welcome to The Excerpt. I’m Dana Taylor. Today is Wednesday, April 16th, 2025, and this is a special episode of The Excerpt. The recent bankruptcy of genetic testing firm, 23andMe has raised alarm bells for privacy advocates and consumers worried about their personal information. That data managed by 23andMe could eventually be used to discriminate against a consumer trying to buy life insurance, or it could be combined with a publicly available dating profile to target someone for a sophisticated scam. The possibilities for abuse are endless, and to be clear, this isn’t just a 23andMe problem. Bankruptcy and data theft are just as much a risk with other DNA testing firms. So what should people know about privacy and genetic data security? For more on that, I’m now joined by Kayte Spector-Bagdady, a member of the health, law and bioethics faculty at the University of Michigan. Thanks for joining me, Kayte.
Kayte Spector-Bagdady:
Thanks. It’s great to be here.
Dana Taylor:
Let’s start with the basics on the privacy issues here first. There’s the privacy policy that consumers agree to at the time of purchase. There’s also personal information 23andMe subsequently collected from many users via surveys. That’s a massive amount of highly sensitive consumer data that’s highly valuable to a host of different players. What happens if this data is sold during bankruptcy?
Kayte Spector-Bagdady:
So 23andMe has always been very clear in its terms and conditions and notice of privacy practices that in case of bankruptcy, those data may be sold or shared with other companies external to 23andMe. One of the challenges, however, is that people are extremely unlikely to actually read any of those terms and conditions or access or even understand them if they do read them.
The other problem that you brought forward is what happens when those data are shared external to 23andMe. One potential thing that people might be concerned about is potential law enforcement use of those data. For example, I don’t know if you’ve heard of the Golden State Killer case in California. The Golden State Killer was a murder case and they’ve been looking for him for decades, and actually police ended up re-identifying him by using GEDmatch, which was another direct to consumer genetic testing company. So that’s one potential concern.
Dana Taylor:
Let’s talk about the risks one by one, starting with how the data could be used to discriminate against a consumer.
Kayte Spector-Bagdady:
Yeah, so there is a law called the Genetic Information Nondiscrimination Act that’s been around since the 1990s when they first sequenced the genome, and the intent is to protect against discrimination from your employer or from your health insurance. So under this law, your employer or your health insurer is not allowed to use your genomic information to discriminate against you in your employment or getting health insurance. However, it leaves a lot of gaps, like for example, it doesn’t protect you from discrimination for long-term health insurance, which is a big concern of people as well as life insurance.
Dana Taylor:
Data is always at risk of being hacked and then exploited by nefarious players. Does bankruptcy make this data less safe? And if so, how?
Kayte Spector-Bagdady:
It’s a complicated question. 23andMe has been very clear that in the interim, while bankruptcy is pending, they’re applying the same safeguards to the data that they always have. However, just a few years ago, there was already a breach of the 23andMe data and almost 7 million users got hacked and had their data shared across the internet in ways that we don’t fully understand. And so this is a limitation as well on people who are deleting their own 23andMe data right now because data that’s already escaped and has already been breached, cannot be deleted.
Dana Taylor:
What are some ways that this data can be utilized that concern you the most? Is there anything that keeps you up at night?
Kayte Spector-Bagdady:
Even though everybody’s talking about the genomic information, we have some protections against that in the law. The thing that really keeps me up at night is actually the survey information that people had been filling out. So 23andMe not only has 15 million people represented in its phenotypic or its genetic database. It also has over 4 billion data points about, they call it phenotypic data, about other information about you like your health behaviors or your health outcomes. And it’s this kind of information, information about how much you drink, information about mental health diagnoses, information about your childhood that I think people really consider much more private and also is potentially more valuable to advertisers or other people who are trying to incentivize or discourage certain behaviors.
Dana Taylor:
You mentioned DNA data and law enforcement. How does law enforcement capitalize on these databases?
Kayte Spector-Bagdady:
It’s a little complicated. So law enforcement is supposed to get some sort of access, some sort of court authorized access to require a genetic sample from somebody, and some states like Maryland have specifically outlawed law enforcement use of genetic data that have been collected under other auspices in this way. Law enforcement also has their own genetic database that they keep, and so you can imagine if you combine the law enforcement database that they keep along with some of this other information. It can be very identifying for people and people can get very uncomfortable with that concept, people who are used to a lot of civil liberty protections against intrusive behavior from law enforcement.
Dana Taylor:
Kayte, medical research using these databases is an incredibly promising field. This could involve anything from knowing you’re at a higher risk for getting a certain disease or condition to helping scientists customize your treatment. What’s the status of this work, not just with 23andMe data, but with other genetic testing firms?
Kayte Spector-Bagdady:
So genetic testing is a wonderful thing. It’s something that allows us to diagnose and predict certain health outcomes and associate diseases and disorders with certain genetic variation such that we might be able to intervene with things that can help people before the problem starts, or we might be able to prepare people later for something that they’re going to face. I do genetic research myself. I think it’s very promising, but also we need to be considerate of the people that genetic information comes from, and it’s a balance, and actually that’s why GINA or the Genetic Information Nondiscrimination Act was passed in the first place to make sure that people felt comfortable taking a genetic test to help their healthcare by knowing that there were some protections against discrimination. So I think it’s an incredibly promising field.
Dana Taylor:
Can you imagine other areas where this genetic data can be used in a beneficial way that have yet to be fully explored?
Kayte Spector-Bagdady:
Yeah, that’s the amazing thing about science is that we can’t always anticipate the different things that we’re going to be able to do with genetic data or other kinds of information in the future. So for example, generative AI or generative artificial intelligence has been applied in genetics just recently and has made amazing progress because it can analyze massive amounts of data at the same time and start to associate variants in genes with health outcomes in ways that we never could have done before. But the fact that we also can’t predict exactly how people are going to use genetic data in the future also makes it hard to make sure people are consenting and fully understand what’s going on.
Dana Taylor:
Finally, Kayte, for people who are listening or watching who’ve used the services of 23andMe in the past, what should they do to protect their data going forward?
Kayte Spector-Bagdady:
So I had also used 23andMe in the past, mostly because I teach about it, and so I wanted to know more about how the system worked, and so I did go in and delete my own genetic information. I think that people can do that right now, and 23andMe is honoring it as best they can. But I guess my big warning would be for the future when people are putting private information, health information, as you said in the beginning, dating profile information, any sort of data, those data are valuable to more people than just yourself. And every time you’re putting it into a commercial platform, it is not protected by our health privacy laws. And I don’t think that people really understand that. So anytime a commercial platform is asking you personal questions like, “When did you get your last period?” Or “How much alcohol do you drink?” I would like people to be really cautious moving forward about what they’re actually doing with that information.
Dana Taylor:
And what if members of your family have submitted DNA to these testing firms? Is there potentially a direct link to you?
Kayte Spector-Bagdady:
Yeah, that’s a great point because one of the other things that makes genetic data so unique is that not only does it completely uniquely identify you as a person and it cannot be changed, but it also identifies your blood relatives. And this is sometimes a challenge with families in the clinic that I work sometimes in the hospital at the University of Michigan, that families face is that one member of the family would like to be tested for an invasive genetic disease that might not have a treatment and the other family members don’t want to know. So this is a tension that happens both at the clinic and in databases because that’s exactly how they re-identified the Golden Stake Killer was actually by identifying his relatives. He never did ancestry testing himself, but because people are inherently linked by blood, it can reveal information about each other.
Dana Taylor:
Kayte, thank you so much for being on The Excerpt.
Kayte Spector-Bagdady:
Thank you for having me.
Dana Taylor:
Thanks to our senior producers, Shannon Rae Green and Kaely Monahan for their production assistance, our executive producer is Laura Beatty. Let us know what you think of this episode by sending a note to podcasts@usatoday.com. Thanks for listening. I’m Dana Taylor. Taylor Wilson will be back tomorrow morning with another episode of The Excerpt.
