23andMe: a salutary tale

If you opened the 23andMe website a little while ago, you would have found a special Mother's Day offer of 45 percent off a 23andMe+ premium subscription. This was being promoted during the week in which the company confirmed that it had finally filed a chapter 11 bankruptcy petition (see BioNews 1283).

When 23andMe co-founder and resigning CEO, Anne Wojcicki, relayed the news on LinkedIn, she affirmed the intention to continue her fight to take over the company. She drew attention to the achievements of the company in advancing biomedical research while at the same time positioning the company as a champion of the personalised health movement:

'We fought for consumers to have direct access to their information and for them to have choice and transparency with respect to their personal data.'

Those data are now under the control of the court and many people are fearful about where they might end up. But will there be any data left? Commentators – from bioethicists such as Professor Arthur Caplan to the Attorney General of California, Rob Bonta – have, for some time, been recommending that 23andMe customers download the data in their accounts and demand their removal from the company's records and the destruction of their samples.

Established in 2007, 23andMe peaked with about 15 million customers before its fortunes suffered a dramatic shock as the result of a well-publicised data breach in 2023 (see BioNews 1211). This led to the final plunge into bankruptcy from a peak enterprise valuation of US$6 billion.

Data are 23andMe's essential asset base, largely comprising the results of genetic tests and the continuing stream of lifestyle data provided by customers (estimated at two million additional question responses per week). It is now possible that 23andMe could be undone by the first notable run on a genomic data bank.

From the outset, opinions have divided over the benefits of the tests offered by 23andMe to consumers. Some of the trait reports seem inane ('eye colour', 'red hair'), others inexplicable ('fear of public speaking', 'ice cream flavour preference'). I recall Sir John Sulston, vice-chair of the Human Genetics Commission, when 23andMe launched, referring to it as 'recreational genetics', mostly harmless. While the clinical utility of many of the tests may have been questionable, the pitch was always that they were meant to empower the individual: the reports were only intended as background for a conversation with a registered medical practitioner.

The company uneasily played both sides of the health v lifestyle test classification until it ran afoul of the US Food and Drug Administration, which issued a cease-and-desist direction relating to 23andMe's Personal Genome Service in November 2013. Following this, the company was more scrupulous in seeking authorisation for tests that provided medically relevant information including, for example, the option of a limited selection of BRCA1 and 2 variants for breast and ovarian cancer risk.

But the 23andMe project also contained an implicit promise about the future of genomic health care: take one simple test and future research (in which customers can take pride as coincidental contributors) will reveal its implications with improving clarity and certainty. Biology, alas, is no respecter of ambition and we continue to learn how carefully and selectively predictive genetic tests need to be handled to offer genuine clinical utility.

A second ambiguity on which 23andMe played was that between their role as a personal health/lifestyle information service and a disruptive innovator in biomedical research. The business model was orientated by this latter aim from the outset and 23andMe was successful in getting over 12 million customers to opt-in to the use of individual-level data and samples in research.

At first blush, the proposition is a sound one. Biomedical and, particularly, genomics research benefits from large sample sizes, which enable the detection of effects in complex data and the correlation of those data with contextual information (which, in the case of 23andMe, is self-reported through questionnaires). If properly governed, using individual-level data in this way should be a win-win, possibly benefitting the individual but also generating benefits for science and medicine.

Through large-scale genome-wide association studies, 23andMe has helped to identify genetic variants implicated in diseases such as Parkinson's and inflammatory bowel disease. To establish itself in biomedical R&D, it set up a therapeutics division in 2015 and is reported to have made at least 30 deals with pharmaceutical and biotech companies. The most salient of these was with GSK, which invested over $350 million from 2018-23 in a drug development collaboration. This produced an immuno-oncology antibody that reached Phase I trials before the collaboration ended in 2023.

Along with personal genetics customers and recruited patients, 23andMe’s database was boosted by a third facet of the operation, which serviced popular enthusiasm for genetic ancestry testing, bundled together with health and lifestyle tests. It is notable, though, that uncertainties persist about how customers really understood their involvement with 23andMe. The company's vaulting research ambitions may have made it slow to adopt industry standard approaches like two-factor authentication, which could have impeded the 2023 data breach. But as a market shaper in a new and substantially unregulated field, 23andMe was both free to, and forced to, make up the rules. When these failed, the company was holed below the waterline.

The ways in which the data breach will matter in the final account are hard to assess, as many consequences may go undetected or unreported, while those that emerge will likely do so anecdotally. But one clear concern is the chilling effect it may have on research participation. If people take care of their health and participate in research for the benefit of others, this generates both public and private benefits. 23andMe drove that principle forward using their commercial agility to dance around ambiguities of purpose, lack of regulation, and shifting understandings of genetic variation.

A new generation of large-scale, nationally organised and often government-backed genomic health initiatives has now entered the field through which 23andMe cut a swathe. Their size and importance mean that they are, in effect, policy makers rather than suppliants. These must be institutions in which the ambiguities that 23andMe has exploited are clarified, in which personal, commercial and public interests are properly balanced, that are based on sound and sober science, and that are subject to fair, robust and effective governance.