The personal genetics testing company 23andMe is reversing plans to make a major change to its privacy settings, after a Vox story raised concerns about the move.
On September 9, we published a feature about some of the pitfalls of personal DNA testing, with a focus on 23andMe, a leading company in the field. We talked to some people who used 23andMe and ended up unexpectedly finding close family members they didn't know they had. In one case, a professor's parents divorced after the site revealed that his father had a child before he was married.
We reported that 23andMe was planning to alter its user settings in a way that could make these unexpected reunions happen more frequently:
23andMe is actually moving toward giving people fewer warnings about the secrets they may unlock in their DNA. Before Pearl and Schwartzman found each other, they had to consent to allow 23andMe to reveal close DNA relatives - by clicking "yes" on a message that asked them if they wanted to find their closest relationships. But as of September 12, 2014, new customers will automatically be opted into the service. (Existing members will be made aware of the change and given a chance to opt out.) This means anyone who signs up for 23andMe could now make an accidental discovery with no warning at all.
But, because of concerns raised by the Vox story, the company reversed its decision to make those changes. It is also going to hire a Chief Privacy Officer.
23andMe CEO Anne Wojcicki posted this update to the service's community forum over the weekend:
We made a change from what we promised and I want to apologize. We promised that the roughly 350,000 customers that had not consented to see Close Relatives in our DNA Relatives feature would be automatically opted in at the end of a 30 day notification period. I understand that that was extremely exciting for many of you to have so much data potentially come your way. It was unfortunately a mistake that we promised that.
I do not think it was ever the right call to promise that we would automatically opt-in those customers. Core to our philosophy is customer choice and empowerment through data. The Close Relatives features can potentially give a customer life changing information, like the existence of an unknown sibling or the knowledge that a relative is not biologically related to them. Customers need to make their own deliberate and informed decision if they want this information. It is 23andMe's responsibility to make sure our customers have a choice and that they understand the potential implications.
The timing of the change is unfortunate and I apologize the announcement came late on a Friday night at the end of the 30 day period. The article in Vox made me and others look into the language in the consent form and that is when I learned about the proposed changes coming to the DNA Relatives community. As 23andMe has moved from being a start up to a bigger and more mature company, I am not involved in every decision. This is a decision that should have come to my attention but it did not. We will learn from that. 23andMe is hiring a Chief Privacy Officer and that too will help us avoid these types of mistakes in the future. We are also already planning to evolve the consent process to make it simpler and more clear for customers.
Going forward, we will continue to prompt the customers that have not made a choice about Close Relatives to make a choice. We understand how important that is to you. We will do a mix of emails to these customers and pop-up prompts at login to get customers to make a choice.
I apologize again for the disappointment and for not having clearly communicated the reason for reversing course. 23andMe continues to grow and pioneer the way we think about consumers exploring their DNA. While we continue to innovate we may also err along the way. We can only promise that we will always listen to and do right by you, our customer, and will never fear having to redirect our course when it is the right thing to do.