Transparency, consent and trust in the use of customers' data by an online genetic testing company: an Exploratory survey among 23andMe users

Abstract

23andMe not only sells genetic testing but also uses customer data in its R&D activities and commercial partnerships. This raises questions about transparency and informed consent. Based on a online survey conducted in 2017–18, we examine attitudes of 368 customers of 23andMe toward the company's use of their data. Our findings point at divides in the context of customers' awareness of the two-sided business model of DTC genetics and their attitudes toward consent. While most of our respondents (68%) were aware that 23andMe could store their data and use it for certain purposes without their consent, over 40% were not aware that using and sharing customer data was part of the business model. Views were also divided regarding what type of consent was most appropriate. We explore the implications of these divides for participatory research and for the importance of transparency and trust in commercially-driven scientific knowledge production.

Keywords:

• genetic testing
• direct-to-consumer
• participatory science
• transparency
• 23andMe

Introduction

Direct-to-consumer (DTC) personal genetic testing (PGT) has become a global business. Previous studies on customers of DTC PGT companies explored the characteristics of customers, their motivations, understanding and use of the results (see below). Yet some DTC PGT companies also use their customers' data for research and development purposes, both alone and in collaboration with partners from the healthcare and pharmaceutical industry. Following the announcement that the pharmaceutical giant GlaxoSmithKline acquired a $300 million stake in 23andMe in 2018, blogs and magazine articles provided guidance to 23andMe customers as to how to delete their data, suggesting that not all customers may have been aware of the possibility of such a commercial partnership when they signed up (e.g. Brodwin 2018). However, there is no empirical evidence to date as to how the customers of DTC PGT enterprises view the ways in which companies use their data for business purposes. This is the focus of this study.

The well-known DTC PGT company 23andMe runs an interactive web-based system that supports enrollment, participation and ongoing engagement in 23andMe’s genome testing business and research. On its website, the company encourages people to “unlock the secrets of your own DNA” and “shed new light on yourself” by buying a DNA test kit.¹ After signing up to 23andMe via the company’s website and placing an order, customers receive a collection kit for their saliva samples by mail. Logging in with a personal online account, including the unique barcode number of the collection kit, customers need to accept the company’s Terms of Service, which set out the contractual basis for the genotyping services offered. The Terms of Service cover the extraction and analysis of DNA and the uploading of a digital version of the individual’s genetic information on the customer’s private account on 23andMe’s website. Customers can also opt into 23andMe’s research activities as well as into their DNA and other data being retained for biobanking. Those who opt into 23andMe’s research are informed that they can withdraw their consent at any time, and that such withdrawal does not affect access to their genetic information or new reports. At the same time, however, customers are told that even if they do not give consent for their information to be used in research, their “genetic and/or self-reported information” may “still be used by us and shared with our third-party service providers to provide and improve our Services and shared as Aggregate Information that does not identify you as an individual”.²

The practices of DTC PGT companies such as 23andMe raise complex ethical, legal and social issues around participatory science, patient empowerment and personalized medicine. It is questionable how informed consent can be when the data that people are contributing will be used for unspecified and yet unforeseen purposes in the future (Skolbekken et al. 2005; Metcalf and Crawford 2016; Prainsack 2017; Nerlich et al. 2018; Parasidis, Pike, and McGraw 2019). While possibilities for greater user engagement are welcomed by many people, the company’s rhetoric around making science “open” and “democratic” can conceal strategic commercial interests. 23andMe, like many DTC companies, have two different kinds of customers: people who seek access to their personal genetic information, and pharmaceutical companies who want access to big datasets of genetic, phenotypic, lifestyle-related, and other self-reported information (Stoeklé et al. 2016). 23andMe is an example of a company with such a two-sided business model, whereby companies extract value not only from selling DNA testing services but also from selling access to customer data. Digital online health platforms, apps and self-tracking devices encouraging individuals to enhance their health and wellbeing are also entering this burgeoning field that is characterized by a complex business landscape (Saukko 2018; Thiebes et al. 2020).

23andMe has a research arm (formerly known as 23andWe) that conducts research on genetic data derived from sequencing customer DNA samples coupled with follow-on surveys about health and lifestyle (Tobin et al. 2012). Besides selling their DNA test kits to “regular” customers, 23andMe has also given away free test kits to people suffering from diseases that the company had a research interest in, for example Parkinson’s Disease, sarcoma, and myeloproliferative neoplasms. 23andMe has also used DNA and other data from customers to apply for patents (Sterckx et al. 2013a,b), to develop drugs and diagnostic tests alone or in partnership with pharmaceutical companies, as well as selling this data to pharma for independent research (Regalado 2016). In theory, customers could have seen this information as part of the company’s Terms of Service. But it is well known that few users of online services – including genetic testing ones – read these terms in full before formally accepting them (Obar and Oeldorf-Hirsch 2018); and researchers also found that the Terms of Service of many DTC companies were also worded in ways that were “problematic from a consumer protection standpoint” (Phillips 2019, 78; see also Phillips 2017). In the case of 23andMe, some of these practices, past or present – such as using user data for certain purposes even without their consent, or applying for patents – may go against what users expect in light of the company’s strong rhetoric of openness and trying to serve the public good (Sterckx et al. 2013a). Finally, customers coming to 23andMe’s testing service with a health-related question may falsely assume that confidentiality standards governing physician–patient interactions apply to DTC personal genetic testing companies as well (Caulfield and McGuire 2012).

While 23andMe is not the only DTC service on the market (Niemiec, Kalokairinou, and Howard 2017), it is globally very well known, and in terms of the number of DNA samples it has collected, it is the biggest such to date. In 2012, five years after the company started offering their DTC services to the public, 23andMe reported having DNA data of approximately 200,000 customers (with nearly 90% having opted in to participate in research), and millions of individual survey responses or “phenotypic data points”.³ In early 2019, the company reported over 10 million customers, of which about 80% reportedly opted into participating in 23andMe’s research (23andMe 2019a; see also DNAGeek 2019). If these numbers are accurate, this represents by far the largest collection of gene-linked health data anywhere in the world, boasting over 130 publications in scientific journals (23andMe 2019c) and a range of partnerships with pharmaceutical firms (Hayden 2017; 23andMe 2019d).

In 2018, when we collected the data that were analysed for this paper, 23andMe’s Terms of Service stated that customers' “genetic and/or self-reported information” may “still be used by us and shared with our third-party service providers to provide and improve our Services and shared as Aggregate Information that does not identify you as an individual.” In 2019 the company changed their privacy statement to inform customers that if they did not consent to 23andMe Research, “your Personal Information will not be used for 23andMe Research. However, your Genetic Information and Self-Reported Information may still be used by us and shared with our third party service providers to as outlined in this Privacy Statement.” (23andMe 2019b). In January 2020, the privacy statement was changed again to read that “23andMe will not sell, lease, or rent your individual-level information to a third party for research purposes without your explicit consent” (23andMe 2020), meaning that the company can still sell, lease, or rent aggregate data without people’s consent.

The possibility of making customer data available to third parties without consent raises questions about the awareness of customers of this provision, and about the validity of people’s consent.⁴ While it could be argued that the use of anonymised data – and only in that form had 23andMe reserved the right to use customer data for the aforementioned purposes – does not require the consent of data subjects in many jurisdictions,⁵ genetic information could be seen as information that defies true anonymization (Gymrek et al. 2013; Erlich et al. 2014). Genetic information would therefore, at least in the context of the European Union’s General Data Protection Regulation [GDPR], count as personal information nevertheless, which would also apply to companies outside of the EU processing data of EU citizens. But the question about meaningful and valid consent is relevant beyond legal compliance; there is a moral dimension to whether or not people are asked to agree to something that they are unlikely to have read, and that – as the results of our survey show – may not have expected. Especially with 23andMe's interactive, web-based and dynamic consent (Kaye et al. 2015), the critical issue here is the extent to which the company assures – or should be required to assure – that its customers are aware of how exactly their data is being used.

DTC PGT as a site for Exploring users' views of, and trust in, participatory research

Recent studies have examined why consumers undertake DTC PGT, what impact it has on their lives and identities, and how satisfied they are with the results and the process of consent (for an overview, see Turrini and Prainsack 2016; Gollust et al. 2017; Roberts et al. 2017). In particular, the National Institutes of Health (NIH)-funded Impact of Personal Genomics (PGen) Study⁶ analysed data from a cohort of about 1,500 consumers of two U.S. companies that provide personal genetic testing—23andMe and Pathway Genomics. The study sought to determine consumers' characteristics, motivations, and reactions to genetic risk information, including psychological impact, risk perceptions and comprehension, and the personal utility of health services. In this study we seek to complement this work by focusing on how customers view the use of their data by a specific DTC company, 23andMe. As scholars already observed, 23andMe provides an example of “framing its service using participatory rhetoric of ‘open access', ‘community', and ‘reading'

genomes, whilst extracting ‘unpaid labour' from its consumers by selling their data” (Saukko 2018, 1316; cf Harris, Kelly, and Wyatt 2016; Van Dijck and Poell 2016). The use of customer data by 23andMe has attracted criticism (Sterckx et al. 2013a,b), and the commercial interests of DTC PGT have been discussed as impacting trust and trustworthiness (Howard et al. 2015; Niemiec and Howard 2016; Phillips 2017). Yet, there is very little empirical evidence on the perceptions of customers concerning how the company uses their data.

Our impetus to explore and fill this gap is located in a broader context of looking at users’ perspectives on and trust in alleged participatory research. Previous studies have highlighted the importance for DTC PGT companies of creating and maintaining trust by users (Wyatt et al. 2013; Sterckx et al. 2013a; Saukko 2018; Schaper, Wöhlke, and Schicktanz 2019). Following Rousseau et al. (1998), we consider users' trust as the willingness of users to participate while concurrently expecting that the organization will fulfil its obligations, irrespective of user ability to monitor or control the organization's actions. It is a relational, moral and emotional attitude, future-oriented but building on past experiences. Trustworthiness is the complementary notion that refers to how institutions are perceived and of what they do to fulfil their promises and do what is right and beneficial for the people they serve (Hardin 2002). A trust evaluation depends on assessments of trustworthiness in terms of institutional intentions, performance, competence, and procedural justice (Goold 2001; Cook, Hardin, and Levi 2005).

The emphasis on users' perspectives (including trust) is both part of an important research tradition in science and technology studies (Oudshoorn and Pinch 2003) and a further development from the more recent socio-ethical study of lay moralities and expertize (Raz and Schicktanz 2016). An examination of users' attitudes, (dis)satisfaction and (mis)trust in policies of DTC PGT brings together the research agendas of STS and recent social and political studies (Gad and Jensen 2016). Users of DTC PGT provide a unique viewpoint into the actual implications of participatory research and how they are seen by citizens. Expert discourse is replete with characterizations of the publics' deficit knowledges of genetics and genomics (for a critical discussion see Wynne 2005). DTC PGT is different in that its users have been portrayed as educated and active participants in “citizen science” (e.g. Angrist 2009). Moreover, DTC PGT reflects “the comingling of the ideologies of the “new genetics” with the “democratic” user-driven ethos of the Internet and its developers (perhaps best exemplified by Google, a significant sponsor of 23andMe)” (McGowan, Fishman, and Lambrix 2010, 286). Users' views hence provide an important insight into these seeming contradictions between passive objects of exploitation and false consciousness on the one hand, and educated elites that break new ground in the “participatory turn” (Prainsack 2011) in disease research, on the other. How users view the dual business model of 23andMe could become a critical juncture in the de-scripting of this technology, since the ways in which consumers use and make sense of an emergent technology are not fixed and are likely open to reinterpretation, re-invention, or resistance (Akrich 1992).

Methods

In August 2017, after obtaining research ethics approval, we invited 23andMe customers to fill out an online questionnaire on google.forms. To recruit participants, we posted a link to the survey in various popular science portals and Facebook groups of genealogy forums (such as DNA.land, Living DNA users, International Society of Genetic Genealogy), genetics associations and DTC genetic testing forums, such as openSNP. Since these forums are in English the links posted about the study were likely to reach U.S. as well as English-speaking European audiences. The survey (see appendix 1) included 18 questions about reasons for taking the 23andMe test, what was learned from taking the test, views concerning informed consent, as well as knowledge of and attitudes concerning 23andMe’s use of genetic information and other data from customers to apply for patents and develop drugs and diagnostic tests (the full survey can be accessed at the link below). The survey also included requests for socio-demographic information such as age range and country of residence when taking the test, but no names or other directly identifying personal details were recorded. Questions were developed collaboratively among all authors, based on our own longstanding experience with research on DTC genetics; preliminary sets of questions were tested in several rounds with volunteers before the survey was released. The questionnaires were analysed using SPSS version 22.

Respondents’ characteristics and motivations for taking the test

59 per cent⁷ of our respondents resided in the United States at the time of participating in the survey, 4% in Canada, and 20% in Europe (see Table 1). 65 per cent were between 30 and 59 years old, with the group of 30–39 being the largest (25%). 59 per cent had 15 years or more of formal education. Just over half (52%) were male. The majority had their genome test done in the last four years. 72 per cent were customers who had ordered and paid for the test online, and 22% were customers who opted in to participate in the company's research initiatives (often with a reduced or waived fee).

Table 1. Respondents' Demographic Details (N=368).

	n (%)
Number of years in formal education
15-	218 (59.4%)
12–15	106 (28.9%)
6–12	25 (6.8%)
Age
18–30	32 (8.7%)
30–39	92 (25.1%)
40–49	73 (19.9%)
50–59	74 (20.4%)
60–69	61 (16.6%)
Gender
Male	191 (52%)
Female	161 (46%)
Other	8 (2%)
Country of residence when ordering the test
US	218 (59%)
UK	25 (6.8%)
Canada	16 (4.3%)
Other European countries
(<5% each)	51 (13.2%)
Other (Australia, Israel)	8 (2.1%)

To understand what had motivated our respondents to take on online genetics test – which in turn is relevant for our understanding of their views on the companýs data use – we asked about their motivations to take the test, as well as their views of what they learned (i.e. the perceived personal utility of the test). Most customers said they took the test both to learn more about genetic ancestry, and to learn about the risk of disease (even if one of the two was more important to them). Respondents did not fall into two distinct categories of those motivated by health testing or ancestry testing. Correspondingly, we did not find statistical associations between ancestry or health testing and specific views on data use. When asked for the two most important reasons for taking the test, learning more about genetic ancestry (72%) and about genetic disease risk (48%) were the most frequently chosen answers. 45% of our respondents said they had taken the test out of curiosity, 23% said they did it to help science, and 13% said they did it for fun. Table 2.

Table 2. Awareness of 23andMe’s two-sided business model

Response	N (%)
I was aware, when taking the test, that 23andMe keeps my DNA and other personal health and background information and could use it without asking me.	253 (68%)
I was not aware of this.	52 (14%)
I am aware of it now. But when I took the test I was not aware that I agreed to this.	40 (10%)
I was aware, and I opted out	16 (4%)
I was aware, when taking the test, that 23andMe uses DNA and other data from customers to apply for patents, and to develop drugs and diagnostic tests alone or in partnership with pharmaceutical companies, and that it may share my DNA and other data with these and other companies.	191 (52%)
I was not aware of this.	81 (22%)
I am aware of it now. But when I took the test I was not aware that I agreed to this.	71 (19%)
I was aware, and I opted out	16 (4.3%)

Consumers’ perceptions of how 23andMe uses genetic data

At the point of taking the test, most of the respondents to our survey (68%) were aware that 23andMe could store their DNA data and other personal health and background information and could use it without asking them (Q6; see Table 3). Almost half (48%) hoped that their DNA and other data would also do something good for society. Three quarters of our respondents (74%) had opted into participating in 23andMe research, which is a bit lower than the figure given by the company on their overall opt-in rate of 80% (23andMe 2019a). Slightly more than half (53%) of our respondents thought that 23andMe using DNA and other data from customers to apply for patents and develop drugs and diagnostic tests was a good development. 30% had mixed feelings about this and 10% did not agree with this approach.

Table 3. Linear regression describing the relationship between customers’ feelings about the two-sided business model of 23andMe and relevant variables (R=.406; F=8.005).

Model	Unstandardized Coefficients		Standardized Coefficients
	B	Std. Error	Beta	t	Sig.
(Constant)	.322	.156		2.066	.040
Q6 Awareness	.197	.083	.176	2.370	.018
Q7 Awareness	.239	.073	.239	3.258	.001
Female	.026	.056	.026	.467	.641
From the US	.090	.058	.086	1.553	.121
General customer	.027	.062	.024	.430	.667
Education years	−.023	.008	−.155	−2.799	.005
Age	.003	.002	.101	1.774	.077

When asked more specifically about their awareness of the company’s two-sided business model (Q7), respondents' opinions were divided (see Table 3). Just over half (52%) said that when they took the test, they were aware that 23andMe uses DNA and other data from customers to apply for patents, and to develop drugs and diagnostic tests alone or in partnership with pharmaceutical companies. 19% of our respondents indicated that it did not matter to them that the company used their data for drug developments, patents, and diagnostic test development. 16 respondents (4%) were aware of this and opted out as a result. Almost three quarters (74%) said that if they had been aware that 23andMe could use their DNA and other data in this way, they would still have taken the test (note that all respondents were asked this question, including those who were aware of the company using their data in this manner). 7% said they would not have taken the test if they had been aware, and 16% said that they were unsure.

Altogether, about two in five respondents (41%) were not aware of the company’s two-sided business model at the time they took the test. When we explored how such awareness correlated with approval of 23andMe’s data policies, we found that of those who were not aware of the company’s use of customer data, 64% said they do not agree with, or have mixed feelings about, 23andMe using DNA and other data from customers to apply for patents and develop drugs and diagnostic tests. The same significant statistical relationship (χ²<.0 and Cramer's V=.2) was found between the “satisfaction” variable (Q9: “How do you feel about 23andMe using DNA- and other data from customers to apply for patents and develop drugs and diagnostic tests”) and the two “awareness” variables (Q6 and Q7).

To examine what influences customers' positive or negative feelings about the two-sided business model of 23andMe, we carried out linear regression analysis. For the purpose of this analysis, the categorical “satisfaction” variable (Q9) was dummy coded to create a dichotomous variable. We found two significant predictors of customers' views towards 23andMe’s data policies: awareness and education. Awareness of the two-sided business model was significantly (.001) positively correlated with customers' positive feelings about it. Customers' education level was, in contrast, found to be a significant negative predictor (.005) of customers' satisfaction with the company's two-sided business model (see Table 4). The following variables did not have any significant prediction value: Awareness that 23andMe stores data and could use it without asking customers (Q6), gender, location in the United States and Europe respectively, being a general customer vs. having been recruited via 23andMe’s research collaboration projects, and age (see Table 4).

Table 4. “If 23andMe is going to use your DNA and other data to apply for patents and to develop drugs, do you think they should ask your consent for that?”.

Response	N (%)
Just once in the beginning	124 (33.7%)
Yes, they should ask every time my data is to be used, and give me a detailed description of what it is being used for and why my data is shared with pharmaceutical companies	149 (40.5%)
No, It doesn't matter to me how many times or for what reasons they use my DNA for research with pharmaceutical companies	71 (19.3%)

Views on Consent

The question of what uses of their data by a company are considered acceptable or even desired by their customers is closely connected to appropriate forms of consent. Participants in our survey were divided in terms of what kind of consent they thought should be required from new users (see Table 4). 34% thought that 23andMe should only need to ask for consent once, in the beginning. 41% thought that the company should ask customers every time it is using their data and give a detailed description of what they were using the data for. One respondent commented that “[w]hat is required and what is preferred from a participant's viewpoint are two separate questions. Moreover, my personal preference might be distinct from what is in the best interests of science and societal benefit. Consent obtained once at the beginning is sufficient, although I would like to see more companies and research teams move toward participant-centred, dynamic consent options.”

78% were satisfied with the company’s policy that customers can withdraw consent from having their data used; 14% were not satisfied. Among those that were not satisfied, the largest group (31%) said that 23andMe should offer the option to opt-out each time they were using customer data available for a new project. 27% of those who were unsatisfied with current policies thought that “customers should be asked to give their consent before their data is used every time.” Respondents also commented in this context that “23andMe […] should point out that data that have been released cannot be ‘erased' or ‘forgotten'”. Several respondents noted that they did not trust that such withdrawal would be effectively implemented.

Discussion

To our knowledge, our study is the first that specifically examines the views and attitudes of customers of 23andMe regarding how the company uses their data. Our findings raise issues related to the lack of awareness in a significant proportion of the respondents about 23andMe’s handling of their data. They also indicate several divides in the respondents' attitudes to such practices. More than a decade ago, early users of DTC PGT often characterized the future of participatory genomic research in positive terms that echoed the marketing rhetoric of PGT companies (McGowan, Fishman, and Lambrix 2010). Our findings demonstrate that this is no longer true.

In terms of the limitations of this study while the demographics of our respondents largely correspond with what we know about the customer base of 23andMe in terms of country, age distribution and high levels of education (Tung et al. 2011; Aicardi et al. 2016), the exact demographics of 23andMe’s customer base, unfortunately, cannot be established as the company does not disclose these data. According to Alexa, the Amazon.com-based internet traffic analysis platform, at the time of carrying out our survey, 83% of the visitors of the 23andMe site were based in the United States. This is in line with the high number of our respondents who reside in the United States (59%). We treated a-contextually responses from the United States, Europe, and elsewhere because country designation was based on the question “In which country were you when you ordered the test?.” It is possible that the respondent moved to another country later on, which is why we could not assess if the data speaks to any regional differences – such as those with/without access to free healthcare, something that future studies could look at. Finally, as in all surveys, respondents' interpretations of certain words could vary. In connection with the phrase “good for society”, for example, it is impossible to know what specific respondents subsumed under it, including moral, economic, and health benefits.

Our findings point at divides in the context of customers' awareness of the two-sided business model of DTC genetics and their attitudes toward meaningful consent. A majority (68%) of our respondents was generally aware of 23andMe’s two-sided business model when they took the test. But only about half (52%) were aware, when taking the test, that 23andMe reserved the right to use their DNA and other data to apply for patents, and to develop drugs and diagnostic tests alone or in partnership with pharmaceutical companies. Given the importance of transparency recommended by guidelines (Knoppers 2014) in such activities involving consumers' health-related data, it is concerning that around half of the respondents, who are consumers of the leading DTC GT company, were not aware of company’s DNA data “monetizing” activities – especially in connection with the company's rhetoric around participatory research and empowered customers, could be seen as drawing public attention away from the commercial interest of the enterprise. Although about half of our respondents supported the company’s use of customer data to apply for patents and develop drugs and diagnostic tests, hearing and considering the concerns of those who are sceptical can help to ensure that research participants are respected in their involvements in science, and that the rules of such engagements are transparent (see also Sterckx et al. 2013a,b). The importance of adequate information about commercial activities involving research participants' data is further highlighted because such information may influence decisions to participate in research (Gaskell et al. 2012). The lack of transparency with regard to handling of consumers' data in the conduct of big consumer genomics company may be seen as a factor that may affect public perception of scientific research in general.

For those who opted into 23andMe’s research activities to help promote science, transparency about how their data are used, and who benefits, may be a key concern. It may also be in the companies' own interest to be proactively transparent about these questions: Our findings show that those customers who said they had not been aware, when taking the test, of the company’s two-sided business model, were much more likely to disagree or have mixed feelings about these strategies as compared to customers who were aware of it when taking the test (56% vs. 33%, respectively; almost twice). In the regression analysis, awareness of the two-sided business model was, as expected, found to be significantly (.001) positively correlated with customers' positive feeling about this model. However, with more education (many of the customers in our survey having more than 15 years of education) came more criticism: The number of years of education was found to be a significant negative predictor (.005) of customers' satisfaction with 23andMe's two-sided business model.

Over three quarters of our respondents believed that the company should ask consent for usage of DNA and other data for patent applications and drug development (Table 4). This stance is congruent with expert guidelines and many academic publications asserting the importance of informed consent for usage of health-related data and criticising lack thereof or inadequate informed consent in the context of direct-to consumer genetic testing (Knoppers 2014; Niemiec and Howard 2016; Phillips 2017; ESHG Guideline on DTC GT). Our respondents were, however, divided in terms of what kind of consent should be required – one-off consent (34%) or dynamic forms of consent (40%). This suggests that, at least from the users' perspectives, the online implementation of consent should be dynamic and include multiple options to cater for different user preferences. Furthermore, the majority of customers expressed satisfaction with 23andMe’s policy allowing customers to withdraw their consent for the use of data in research, which similarly has been supported in various guidelines (McGuire and Beskow 2010). Yet, a small proportion of respondents indicated that improvements should be made, such as offering the possibility to opt-out of, or opt-into, each specific new project. These suggestions, that go beyond most of the current designs of consent, should be taken into consideration by researchers, companies and public institutions when designing policies regarding research participants' data sharing.

As explained in the recent analysis of Philips, “under the GDPR, a high standard of consent is required for data processing, and it is not going to be acceptable to bury consent in a lengthy contract or to only make company policies accessible after a consumer has registered for a service” (Phillips 2019, 7). Indeed the requirements set by GDPR may address some of the concerns indicated in our study by setting the requirement for explicit and informed consent.⁸

Although the argument that people may not know what they are consenting to is not, as such, novel (Dixon-Woods et al. 2006), because of the economic value that the combination of genomic, phenotypic and behavioral information has, it raises particularly pressing questions in the context of DTC PGT. Combining economic value and moral worth (in the sense of expressed commitment to participatory research) has a disruptive force (Turrini 2018). The divided views of our respondents problematize this disruptiveness, especially because they can be seen as the vanguard of technology users.

An important question raised by our findings is the nature and role of trust (Erlich et al. 2014). Scholars have previously noted that

in order to secure its profits, the company potentially jeopardizes its trust relations with consumers, as highlighted when the company announced its first novel genetic association patent on its blog […] the reaction from consumers was largely hostile, many considering that they had been “duped” into participating in this revenue-generating venture disguised as a participatory patient-led initiative. (Wyatt et al. 2013, 40)

As Sterckx et al. (2013a, 5) suggested, “what undermined trust was not so much the profit motive but rather the fact that the company did not provide any clear indication to consumers that it was seeking patents on its discoveries.” Indeed, as internet users become increasingly aware of the business practices behind sites, maintaining trust and reputation becomes an increasingly important part of the business of digital media companies.

The lack of awareness (reported by 41% of the respondents) regarding the company’s two-sided business model at the time of taking the test was positively correlated with disagreement or having mixed feelings about 23andMe policies. The interesting finding that the more educated a customer is, the unhappier they are with the company’s use of their data, highlights broader debates about the deficit model in the field of public understanding of science (PUS), and the role of educated user groups in the adoption of technology. Overall, the link between lack of awareness, high education, and dissatisfaction with the company’s policy, as expressed by a considerable number of our respondents, also point to potentially unmet needs of transparency and trust.

The dissatisfaction expressed by about half of our respondents arguably reflects a broader disenchantment with the rhetoric of the supposed “user-drivennees” of participatory research. In contrast to this script, 23andMe and other DTC PGT companies inevitably constrain the extent to which consumers can make autonomous use of the technology through the ways in which they package and portray information on their websites. This company-facilitated access, when combined with the two-sided business model, may compromise the trust-based rhetoric of “user-driven” and “participatory” research, which may explain the divided and circumscribed perspectives of our respondents.

As the “participatory turn” (Prainsack 2011) in genomic research broadens, we need to consider the implications of the fragile trust relationships for research and knowledge production practices (Wyatt et al. 2013). The divided attitudes of our respondents carry important insights and implications for other large-scale DNA research initiatives drawing on public participation. Underlying these many initiatives (such as “All of Us” in the US, Genomics England, the Danish Genome Center, or Estonia's genome project) is a neoliberal narrative that combines “personal” health data and national solidarity (Juengst et al. 2016; Prainsack 2017). For example, the recent Danish National Strategy for personalized medicine exclaims that “The involvement of patients and the public is required, and information sharing, communication and involvement will be central action points.” (2017, 10). However, when the same initiative (as in the case of the Danish Genome Center and others, including in the UK) has a built-in element of joint venture with commercial companies, the impact on trust should become a matter of concern, as this study shows. This is not to say that if trust is maintained, then all is well. While trust is important, we still need to consider, additionally, the political economy of such initiatives more broadly.

Conclusions

In 2017, a “consumer guide” to DNA ancestry testing proclaimed that “These come-ons promise more than they can deliver, ignoring problems with accuracy while obscuring a business model in which customers pay for the privilege of giving away valuable information to venture capitalists who expect it will make them very, very rich” (Krimsky and Johnston 2017, 9). It is crucial to substantiate such claims with empirical evidence. Large-scale studies are now under way that create empirical evidence on the views and preferences of people across the globe on how their DNA and personal data should, or should not, be used for health research (Middleton et al. 2018). These studies will be an important guide for policy. Our own study seeks to complement this important work by drilling deeper into the specific questions of transparency and consent in data use by one specific type of commercial actor, DTC genetics. Given the size of the 23andMe database, and the strategic position that the company occupies for shaping perceptions (and possibly also policies) about user data from DTC genetics companies are and should be used, we consider the empirical exploration of their users' views and preferences particularly instructive.

Recently, Petersen (2019, 107) argued that when customers of digital health understand that the data they surrender may be far more valuable than what they obtain, this can be likened to a “Faustian bargain.” It is important to note that most of the respondents to our survey were happy with how the company was using their data, and the options they were given to opt out. The divisions and mixed feelings among roughly half of our respondents toward 23andMe’s use of customer data may be attributable in part to the hybrid nature of the company as being a DNA testing service on the one hand, and a bioresource and research entrepreneur on the other (see also Stoeklé et al. 2016). In 2013, five years after the company’s foundation, a 23andMe board member summed up its two-sided model by saying that “[t]he long game here is not to make money selling kits … Once you have the data, [the company] does actually become the Google of personalized health care” (Murphy 2013). It would be facetious to blame 23andMe for pursuing financial profits. The way in which commercial digital health has commodified participatory research is part of a broader trend (Saukko 2018). At the same time, 23andMe's communitarian rhetoric portrays the company as much more than a for-profit research enterprise. It presents itself to customers as a research partnership and a proponent of a healthcare revolution. It therefore poses if not a legal then at least a moral onus on the company to be particularly transparent about its stakes and interests. Lack of transparency, as this study shows, results in lack of trust for a considerable portion of the customers. In addition to having replaced the conventional one-off consent with a more suitable, dynamic and layered consent, the adoption of a recruitment and participation process that puts more emphasis on transparency about the commercial and other stakes and interests of the company should be advocated (Prainsack and Buyx 2017). Only if the company treats its customers as true partners will its research deserve to be called “participatory”.

Acknowledgments

We wish to thank all the survey participants for their time and effort. The contribution of EN and HCH has been supported by the SIENNA project (Stakeholder-informed ethics for new technologies with high socio-economic and human rights impact) - which has received funding under the European Union’s H2020 research and innovation program under grant agreement No 741716. This article and its contents reflect only the views of the authors and does not intend to reflect those of the European Commission. The European Commission is not responsible for any use that may be made of the information it contains.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Notes

1 23andMe official Web site, http://www.23andme.com (accessed January 18, 2019)

2 23andWe Research. Privacy highlights page. https://www.23andme.com/about/privacy/. Last accessed 2/1/2018. See also Wee, Henaghan, and Winship (2013).

3 23andMe 2011 State of the database address. http://blog.23andme.com/news/23andme-2011-state-of-the-database-address/. Last accessed 2.1.2018. See also Wee, Henaghan, and Winship (2013).

4 Regarding the question of consent to 23andMe’s services, see also Gibson and Copenhaver (2010); Sterckx et al. (2013a, 2013b).

5 The GDPR includes a research exemption from the prohibition to process sensitive data. Research is defined so widely that scholars have argued DTC companies could claim this exemption for the use of customer data as their operations would fall under the remit of research (Pormeister 2017).

6 For a full list of the accumulated PGen publications see https://www.genomes2people.org/research/pgen/publications/ (last accessed 22 September 2019).

7 Percentages showing in the text are rounded up or down.

8 GDPR defines consent as: “‘any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her” (see https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L:2016:119:FULL&from=EN; last accessed 22 September 2019).

Appendix 1: The Survey (https://docs.google.com/forms/d/1Mp8WZsq-PQGpQO5S-aFwovnD03OKk1gRDqxUjKNgPN8)

*Required

1. Please choose the two most important reasons for you to take the 23andMe test (at the time when you decided to take it): *

To learn more about my genetic ancestry

To learn about my risk of disease

To learn about the disease risk of my children or other close relatives

To improve my health

Curiosity

Fun

To help science

To help others

Prefer not to say

Other:

2. What are the most important things that you learned from taking the test? Please choose the two answers that were most important to you *

Information about my ancestry that I did not expect

Information about my ancestry that I did expect

Information about disease risks that I did not expect

Information about disease risks that I did expect

Information related to drug sensitivity that I did not expect

Information related to drug sensitivity that I did expect

General information about the relationship between DNA and disease or traits

Prefer not to say

Other:

3. Was there something particularly positive about your test results that you had not expected?

Your answer

4. Was there something particularly negative about your test results that you had not expected?

Your answer

5. When you decided to take the 23andMe test, did you hope that your DNA- and other data would also do something good for society? *

No

Yes, but it was not an important consideration in deciding to take the test

Yes, and it was an important consideration in deciding to take the test

Prefer not to say

Other:

6. When you took the test, were you aware that 23andMe would keep your DNA (and other personal health/background) data and could use it without asking you? *

Yes, I was aware

I am aware of it now. But when I took the test I was not aware that I agreed to this

No, I was not aware

Yes I was aware, and I opted out

Prefer not to say

Other:

7. 23andMe uses DNA and other data from customers to apply for patents, and to develop drugs and diagnostic tests alone or in partnership with pharmaceutical companies. 23andMe may share your DNA and other data with these and other companies. Were you aware of this when you decided to take the test? *

Yes, I was aware

I am aware of it now. But when I took the test I was not aware that I agreed to this

No, I was not aware

Yes, and I opted out

Prefer not to say

Other:

8. If you had been aware that 23andMe could use DNA- and other data in this way, would you have taken the test?

Yes

No

Maybe

Prefer not to say

Other:

9. How do you feel about 23andMe using DNA- and other data from customers to apply for patents and develop drugs and diagnostic tests? *

I think it is great (it may advance science and/or lead to new treatments)

I have mixed feelings about it (please expand on this under “other” below)

I do not care

I do not agree to this

Prefer not to say

Other:

10. In which country were you when you ordered the test?

Your answer

11. Year in which you took the test:

Your answer

12. Type of enrollment: *

“general” customer

customer enrolled to participate in the company's research initiatives

Other:

13. In terms of its cost, my test was:

Free kit provided by the company

Gift

Reasonably priced

Expensive

Don't remember

Prefer not to say

Other:

14. If 23andMe is going to use your DNA and other data to apply for patents and to develop drugs, do you think they should ask your consent for that: *

Yes, they should ask every time my data is to be used, and give me a detailed description of what it is being used for and why my data is shared with pharmaceutical companies

Just once in the beginning

No, it doesn’t matter to me how many times or for what reasons they use my DNA for research with pharmaceutical companies

Prefer not to say

Other:

15. 23andMe informs their customers that, at any time, they may withdraw consent from having their data used in research. Are you: *

Satisfied with this

Not satisfied with this

Prefer not to say

Other:

16. If, to the last question, you said you are “not satisfied with this”, what should be changed?

Participation should be automatic with no opt out available

The option to opt out should be made more clear

The option to opt out should be offered whenever a new research project with the DNA- and/or other data is to be started or whenever a new company joins the project

Customers should be asked to give their consent before their data is used a first time

Customers should be asked to give their consent before their data is used every time

Customers' data should not be used for research at all

Prefer not to say

Other:

17. Have you personally opted into participating in 23andMe research? *

Yes, and I have never opted out

Yes, but I opted out later

Yes, but I am considering opting out (please explain why under “other” below)

No

I do not remember

Prefer not to say

Other:

18. Please choose the option that best reflects what you thought you signed up for at the time you became a customer of 23andMe: *

a. To learn more about my genetic ancestry

b. To learn about the relationship between my DNA and my health (in terms of diseases, diet, lifestyle and so on).

c. The above, in addition to granting 23andMe the use of my DNA for research in the future.

d. The above, in addition to being able to consent in the future that research is conducted on my DNA by 23andMe alone or in partnership with pharmaceutical companies.

e. The above, in addition to allowing 23andMe to use my DNA for various R&D purposes even if I did not opt in for DNA research or after I opted out of it.

Other:

My gender: *

Female

Male

Other

Prefer not to say

My age: *

0–17

18–30

30–39

40–49

50–59

60–69

older

prefer not to say

My number of years in formal education: *

0–6

6–12

12–15

15-

Prefer not to say

Thank You!