AncestryDNA’s pitch to consumers is simple enough. For $99, the company will analyze a sample of your saliva and then send back information about your “ethnic mix.” While that promise may be scientifically dubious, it’s a relatively clear-cut proposal. Some, however, worry that the service might raise significant privacy concerns.
After surveying AncestryDNA’s terms and conditions, consumer protection attorney Joel Winston found a few issues that troubled him. As he noted in a Medium post last week, the agreement asserts that it grants the company “a perpetual, royalty-free, world-wide, transferable license to use your DNA.” (The actual clause is considerably longer.) According to Winston, “With this single contractual provision, customers are granting Ancestry.com the broadest possible rights to own and exploit their genetic information.”
Winston also noted a handful of other issues that further complicate the question of ownership. Since we share much of our DNA with our relatives, he warned, “Even if you’ve never used Ancestry.com, but one of your genetic relatives has, the company may already own identifiable portions of your DNA.” Theoretically, that means information about your genetic makeup could make its way into the hands of insurers or other interested parties, whether or not you’ve sent the company your spit. (Maryam Zaringhalam explored some related risks in a recent Slate article.) Further, Winston notes that Ancestry’s customers waive their legal rights, meaning that they cannot sue the company if their information gets used against them in some way.
Over the weekend, Eric Heath, Ancestry’s chief privacy officer, responded to these concerns on the company’s own site. He claims that the transferable license is necessary for the company to provide its customers with the service that they’re paying for: “We need that license in order to move your data through our systems, render it around the globe, and to provide you with the results of our analysis work.” In other words, it allows them to send genetic samples to labs (Ancestry uses outside vendors), store the resulting data on servers, and furnish the company’s customers with the results of the study they’ve requested.
Speaking to me over the phone, Heath suggested that this license was akin to the ones that companies such as YouTube employ when users upload original content. It grants them the right to shift that data around and manipulate it in various ways, but isn’t an assertion of ownership. “We have committed to our users that their DNA data is theirs. They own their DNA,” he said.
In his blog post, Heath further insists that the company has “not sold or provided your genetic data to insurers, employers, or third-party marketers.” He does acknowledge that Ancestry could provide information to a law enforcement agency, if “compelled to by a valid legal process.” According to the company’s own transparency report, it received just nine such “valid” requests in 2016, all of them “related to investigations involving credit card misuse and identity theft,” and none for “information related to the health or genetic information of any Ancestry member.”
That said, there are still potential concerns about Ancestry’s handling of customer data. As Heath explains, “Because genetic information is potentially useful to help cure disease, extend life, and improve science, we ask if you want to take part in research that may be conducted by third parties.” When customers consent, the company can send anonymized versions of their genetic data to “research partners” at both academic institutions and “for-profit research companies that are doing things like trying to understand if there are genetic markers related to longevity.” Despite the altruistic framing, the company is compensated for this material in some cases, offering it a source of profit in addition to the fee that it already charges for sample analysis.
Even if Ancestry maintains its current commitment to protecting its customers’ data, its willingness to profit from that information may raise red flags for the future of consumer genetic testing. “Whether or not they’ve sold information in the past, they legally have claimed the right to do almost anything with it,” Winston told me. (He also stressed that he’s not alleging any wrongdoing on Ancestry’s point, only calling attention to the potentially problematic breadth of its terms and conditions.) Down the road, similar licenses could open the path for more pernicious and willful exploitation of the genetically curious.
For now, at least, the Genetic Information Nondiscrimination Act of 2008, which prevents insurers and employers from using our DNA to make many decisions, protects us in most cases. That law is, however, as vulnerable as any other, and could end up on the chopping block under future healthcare legislation, much as consumer data protections have already begun to erode. If it does, genetic tests could become flashpoints for larger privacy debates.
In response to the controversy, Ancestry updated its terms and conditions on Monday afternoon to more clearly indicate that its customers still own their genetic information. The section in question now includes the statement, “AncestryDNA does not claim any ownership rights in the DNA that is submitted for testing.” Privacy advocates may still have concerns, but it’s a start.
