Genetic testing firms including Ancestry and 23andMe pledge to be upfront when they share users' DNA data with 3rd parties, but the new guidelines are voluntary
Context & Ripple Effects
Two months after reporting flagged how sites like Ancestry.com were amassing the most sensitive data of millions while quietly changing their terms of service, the industry's answer is a set of voluntary guidelines: be upfront when sharing user DNA with third parties. The pledge lands on a database that had already swelled past 26 million consumers across four leading services by early 2019, making consent practices a mass-market issue rather than a niche one.
What came after is the reason this matters: within months, FamilyTreeDNA was found to have given the FBI access to its profiles without telling users, and only then added opt-out controls. By 2025, twenty-seven states and DC were suing 23andMe to block the sale of customer DNA without direct consent — the endpoint of a consent regime that started as a promise.
First-order effects
- Users of Ancestry and 23andMe get disclosure of third-party DNA sharing rather than any restriction on it — the guidelines change what companies must say, not what they may do.
- For the named firms, the pledge is reputational cover at a moment when breach and ToS-change fears are already documented in press coverage.
Second-order effects
- FamilyTreeDNA's subsequent FBI arrangement showed where 'being upfront' actually breaks: law enforcement access became the flashpoint, forcing rivals to ship opt-out controls and auto-opt-outs for EU users just to keep customers.
- Consent settings turn into competitive differentiation — firms that can advertise user-controlled law-enforcement blocks gain ground against those relying on voluntary promises.
Third-order effects
- If the pattern holds, voluntary transparency gives way to binding legal limits: the state lawsuit against 23andMe's asset sale treats genetic data as property that cannot change hands without direct consent, a standard no 2018-era pledge anticipated.
- Genetic databases drift toward being regulated like financial or health records — with the burden shifting from companies disclosing to regulators enforcing.
The trend: Consumer genomics is moving from self-regulated transparency pledges toward legally enforced consent boundaries as DNA databases become assets that can be sold, searched, and subpoenaed.