Consumer-level commercial testing has been a booming market over the past 18 years.
This is the idea that you can buy a (relatively cheap) testing kit online or in a shop, spit into a tube, post it off and then receive information about your ancestry and – potentially – any medical conditions you may be genetically predisposed to have.
23andMe has been a pioneer in this field – leading the market following its creation in 2006.
And it was very much build on optimism around the health benefits of this service.
The idea was that people might be able to identify issues before they became a problem for them, and could then take preventative action.
Perhaps, its early backers supposed, all of that DNA data could eventually be combined to create a database that would help development of new treatments for serious health conditions.
And that promise helped 23andMe become very valuable indeed.
To date the company has conducted tests for somewhere in the region of 15 million customers.
When it floated on the stock exchange back in 2021, it was valued at $3.5 billion–that’s despite the fact that it was absolutely haemorrhaging money at the time.
In the year after it floated, it posted a loss of close to $220m.
But backers did that classic Silicon Valley thing of believing that the growth it had seen up until that point would continue, and eventually it would find a way to turn that into a healthy profit.
Really the jewel in its crown was the data it was gathering.
The reckoning was that if you have millions of customers handing over their genetic data, as well as some of their other personal information then there eventually has to be a way to make money from that.
So what’s gone wrong?
Getting 15 million customers is a great achievement – but the problem is, for the most part, they’re not repeat customers.
For most people, this is a one and done kind of thing.
Someone might pay for their test and get their result – maybe they find out they’re 20% Scandinavian, or they have a long lost cousin in France - and that’s it.
They probably don’t need to get a second test done.
And it turns out that the number of people in the world who are curious enough about their DNA to get a test – or the number of people who are willing or able to spend money on this kind of thing – is relatively limited.
So rather than seeing their sales continue to climb, 23andMe are now selling fewer kits than before.
In the six months to the end of September, their revenues had fallen by nearly a quarter compared to the same period a year before.
But while the underlying business was already facing challenges, a real disaster struck just over a year ago when it was targeted by hackers.
And a significant amount of user data was stolen.
In the end the company revealed that the data of around 6.9 customers was stolen by hackers –that’s about half the company’s user base at the time.
And the hackers targeted customers who had opted to share their DNA matches – perhaps in the hope that they could connect with distant relatives.
So that meant their profiles could include the user’s name, year of birth, location, ethnicity and profile photo. But it could also, potentially, include details of where their grandparents were from, their wider family tree, as well as some DNA data.
That meant that really detailed, really personal stuff got into the hands of hackers – and there were reports of some of it ending up for sale on the black market shortly afterwards.
This was obviously a hugely damaging moment for 23andMe’s reputation – which has a knock-on effect on its business.
There’s also a direct hit to its bottom line – because the breach led to a class action against the company. It’s now decided to settle that, which will cost it $30m.
And all of that combined has seen the value of the company plummet.
Having been worth $3.5 billion just three years ago, today, based on its stock price, it’s valued at less than $83m.
If people aren’t buying tests anymore, have they tried to find any other way to make money?
Yes – they joined pretty much every company in the world in launching a subscription service – which they hope will help turn those one-off customers into a repeat revenue stream.
The idea of the subscription service is that you do the test, get a genetic profile, and then the subscription service gives you diet and exercise recommendations that are built around your genetic disposition.
This service costs around $70 a year – and so far it’s not done too badly. As of March of last year it had 640,000 users - though it’s not clear if all of those hundreds of thousands of customers were paying full price, or whether they there on a reduced rate or even a free trial.
But really the big hope for the company all along, even in the early days, was around leveraging that growing bank of user data for medical research purposes.
Back in 2018, drugmaker GSK made a $300m investment in 23andMe as part of a deal that would give it exclusive access to the DNA data it was collecting.
That deal ended last year and there was a $20m extension agreed, but it was non-exclusive. That means the company could start offering to sell that data or some form of a collaboration with other firms.
It also began their own research projects for new treatments, based on some of the data it had gathered through all those DNA tests.
The problem is, though, that drug development is an incredibly expensive – and usually quite a long-winded – process. And it’s a high risk venture too.
So there’s no guarantee those efforts will result in a real product for the company – and, even if it does, it could take many years before it starts making money for them.
So what are its prospects?
Its management did try to take the company private earlier this year – but this was rejected by the company’s oversight board.
Its subscription service has been a moderate success, but probably not enough to give it the kind of revenue it needs to keep its head above water.
And while the company is now making some deep cuts in order to try to reduce costs, there’s a feeling that ultimately it will need a significant investor to come along – or else it will need to be acquired by a bigger firm.
It’s probably the massive bank of DNA and personal data that would be of interest to any would-be buyer or investor. Which raises a serious question about these kinds of genetic testing businesses.
Because this is a relatively new industry, and one that doesn’t have decades of regulation behind it, the question becomes who ultimately owns the data – and what can they do with it?
Even before 23andMe’s issues, some had raised concerns about what happens to user data with these kinds of companies. There are some that question how fair it is that you pay a company for a test – and they then try to make a profit from the data you’ve given them.
But now there is now a very real prospect that the very personal data users handed over to the company will be bought by another company – one that they never agreed to deal with in the first place.
And they might try to utilise that data in a way that users never agreed to, or certainly didn’t realise it could be used for down the line.
Are there any protections for users’ data?
Well in the case of 23andMe, they say that the data they sell on to third parties is anonymised – so they’re not giving away personal information.
They also say that they only use the information of those that opted into having their data included in these kinds of research projects. But, as always with these things, there is a question about whether people actually knew what they were agreeing to when they ticked or unticked the relevant box.
But even with that in mind, there is a question about how legally robust those guarantees are – and whether they will have to be honoured by another company that buys up the data, should 23andMe sell up.
And the key thing to remember here is that 23andMe isn’t a medical company – it’s a technology company.
That means that there are much weaker protections around user data. There’s no doctor-patient confidentiality, there’s no Hippocratic oath that guarantees a patient’s privacy.
In fact there have even been cases in the past where 23andMe shared some of its user data with law enforcement.
They say they will only do that when there is a court order or search warrant. But that’s still bound to be a concern to users who just wanted to find out about their family tree.
And really this is something people should bear in mind when it comes to using any of these genetic testing services.
Most people probably see this as a bit of a novelty, and certainly nothing to get too concerned about.
But by using such a service, they are handing over some fairly significant data, and they can’t always be sure of what is happening to that data.
Even if the company itself is being upfront and trustworthy, there are other potential risks like hacking.
If a company’s security procedures aren’t strong enough, then a user’s data is absolutely vulnerable to a malicious actor.
In Europe we of course have GDPR – which sets a fairly high standard on how tech companies process user data, who they can and can’t share it with and so on. It also requires them to take extra steps to protect that data from outside forces.
And there’s a fairly severe punishment for companies that are found to be falling short of their requirements on that front, which, gives anyone who’s used the service here a bit more protection against their data being misused in some way.
But it’s not an absolute guarantee that the company is going to be doing right by your and your data – or protecting it as well as they should.
What about the other companies in this area?
This is another problem for 23andMe.
They might have been the first to popularise these kinds of tests, but lots of other companies have come after them, and are having more success.
In many cases it’s because they were able to wrap up the testing with other services.
Ancestry.com is probably the best example – it already existed as a way for people to try to find out more about their family tree, but then it added DNA testing to its service.
As of last year it had provided 25 million tests to users – so much more than 23andMe.
But it’s also done a better job of getting users to stay with the service, because of that huge archive of other information it has and its network of users.
That makes it easier for people to find distant relatives.
MyHeritage is another company providing these kinds of services – though it’s worth nothing that it also suffered from a data hack back in 2018.
And the thing to note about both of those is, at the moment at least, they’re offering tests at a far lower price than 23andMe. Probably because they don’t need to make money off the tests, when they can upsell you on all those other services.
