23AndMe, the DIY DNA-sequencing service, wanted to make a change to its privacy settings. Since the Food and Drug Administration stopped the company from offering and marketing information about customers’ health and vulnerability to certain diseases and medications last year, the company has turned to marketing itself as a service to figure out your ethnic origins and find hidden distant relatives. That sounds fun…until it destroys your family, anyway.

When 23AndMe announced the planned change, which was supposed to go into effect a week ago on September 12, they framed it as an exciting way to match up more people with even more relatives. However, Vox pointed out that there are some really, really good reasons why you might not want to be matched up with your missing relatives.

What’s insidious about the change in privacy settings is that the company’s plan wasn’t to just opt in new members who signed up beginning on September 12. Nope: they planned to e-mail current customers who hadn’t chosen whether they wanted to be part of that program. These customers had 30 days to sign in and opt out: otherwise, they would be opted in. If you changed e-mail addresses or are offline for an extended period since signing up for 23AndMe, well, too bad.

Sure, people who are cautious about their privacy probably aren’t about to have their genomes sequenced and stored online by a company backed by Google in the first place, but matching people up with hidden relatives or bringing up other secrets hidden in our genetic code can have serious consequences. Vox interviewed one man, a reproductive biologist, who decided to sign up for 23AndMe. He was teaching a class about the genome, see, and thought it would be interesting to share some of the results with his students. He sent his parents test kits, too, which he thought would make the results more interesting.

They did, but by “interesting” I mean “destroyed his family relationships and led to his parents’ divorce.” Using the relative-finding service, the professor found a man who was flagged as being either his grandfather or his half-brother. It turned out that their father had a child before marrying, but hadn’t told anyone in his family about their missing relative, who had been given up for adoption. The revelation led to his parents’ divorce and general tumult in the family.

He turned to 23AndMe with his concerns. “I’m not sure all your customers realize that when they participate in your family finder program, they’re participating in what are essentially really advanced paternity test,” he recounts telling an employee. The company really didn’t have an answer for his complaint. He argues that simply warning customers that the relative-finding service needs a much stronger warning: the current notice that it could reveal “life-changing information” simply isn’t strong enough.

This isn’t just a matter for online genome-sequencing services, either. While performing blood or genetic testing for medical reasons, sometimes doctors discover that a patient’s genetic parents aren’t who they were previously assumed to be. Errors in in-vitro fertilization, for example, could mean that a couple raises a child that isn’t genetically theirs. Should physicians let patients know about that? Just a few months ago, an article in the Journal of Pediatrics proposed not telling families about an “incidental finding of nonparentage.”

Your genetic code isn’t just yours. Parts of it also belong to your genetic parents, grandparents, aunts, uncles, siblings, and cousins. Spitting into a tube to upload that information to the cloud can be really interesting and cool, but can also lead to unforeseen problems.

23AndMe probably took all of this into consideration after announcing the privacy settings change, and yesterday announced that they would not be opting existing users in automatically. “The Close Relatives features can potentially give a customer life changing information, like the existence of an unknown sibling or the knowledge that a relative is not biologically related to them,” CEO Wojcicki wrote in a letter to customers, apparently having just figured this out. The company’s logic in wanting to opt customers in (roughly half of its members had not chosen whether or not to participate in the program) was to provide more data to users. That makes sense: when the company is now forced to only promote itself as a service to find your ancestry and maybe uncover hidden relatives, they need as much data as possible.

Wojcicki also announced that 23AndMe would be hiring a chief privacy officer––hey, wait, this company has more than 650,000 sequenced human genomes on its servers and it didn’t already have a chief privacy officer?!

Genetic testing brings families together (And sometimes tears them apart) [Vox] (Thanks, Kelly and David!)
With genetic testing, I gave my parents the gift of divorce [Vox]
Incidental Findings of Nonparentage: A Case for Universal Nondisclosure [Pediatrics]

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.