California Attorney General issues consumer alert for 23andMe customers

I am adopted. I spent most of my life having absolutely no idea whatsoever where I was from, or what biological risk factors I might have. 23andme was valuable to me on many levels, and even with the state the company currently finds itself in, it is not a decision I regret.

My wife also did 23andme some years ago, through which she discovered she had Factor V Leiden—a fact which became extremely important very soon after her discovering it, leading directly to changes in her treatment and how closely they monitored her for blood clots (she had a PFO and some other stuff going on that was already compounding her risk of clotting and stroke), and very possibly may have saved her life.

I’m supposed to go in and delete every trace of it out of fear of what the down-on-their-luck company might, or simply could, do?

While I know that my experience might be rare, I would regardless suggest that you reserve your skepticism, because you aren’t really in a position to assess who did or did not derive a justifiable amount of value from it or how informed of a human being they are

I agree most folks aren't aware of the risks. But I'm guessing for the vast majority of people that are aware of the risks, the thought process is basically along the lines of:

1. I'm simply not that important. There are millions of other people who have given this data to 23 and me and the like, and I'm just some rando peon - nobody is going to be specifically searching for my DNA.

2. The "worst case scenarios", e.g. getting health insurance denied because you have some gene, still seem implausible to me. Granted, there is a ton of stuff I thought would be implausible 5-10 years ago that is now happening, but something like this feels like it would be pushed back against from all sides of the political spectrum, even in our highly polarized world.

3. I haven't murdered anyone, so I'm not worried about getting caught up in a DNA dragnet. Sure, there can be false positives, but to get on in life you pretty much have to ignore events with low statistical probability (or otherwise nobody would even get in a car on the road, and that has a much higher statistical probability of doing you harm).

I think most people do the cost benefit analysis in a much more empirical manner than your theoretical framework. Most everybody has a justifiable reinforced belief that trading data for value is worth it, since the vast majority of people don't feel like they've been on the losing side when they participated in these transactions before.

One can argue that these people may not have understood that a transaction was occurring. I would argue that this is beside the point. Their intuition is hard to discredit in the face of their lived experience. Aside from the marketing spam, most people are probably right in thinking that they've been better off with Google/<alternative> than without.

We can pontificate that people should know more about what they agreed to, and so on, if only they knew better, etc. But this rings hollow and very hypothetical to the vast majority of us. It's worrisome in thought exercises, but not validated in real life.

Ever make bug because you wrote code thinking about how you wanted it to work and forgot to consider how it could go wrong off of that happy path? I think things like this are basically the same problem: when someone is focused on the good outcome it’s just not the right context for most people to carefully evaluate possible negative events, especially low-probability ones. They’re thinking it’d be cool to get an ancestry report, maybe lifesaving to get notice of genetic problem, perhaps the excitement of a unknown relative, and unless there’s a neutral party involved the positives are probably going to win.

In my experience, even if people knew, they just don't care.

Most people I talk to about this, tech and non-tech folk have an attitude with a.mix of "you can't escape this anyway, so might as well embrace it" and "misuse scenarios you are describing are pretty far-fetched".

You don't need to know the license terms to know what is happening. Just observe that you get ads based on browsing and searching behavior. Most people can see that it's happening and don't care. Or at least not enough to give up the value they get in exchange.

People who were struck by lightning know not to go out of the house in rain. People who got hit by a falling brick on the sidewalk know to wear a hard hat when out and about.

These horror stories are so rare that the vast majority of people has never personally met anyone who personally knew anyone who had it happen. So it's all entirely theoretical and speculative for people who are busy and have social life goals. It's rightfully seen in similar light as the pepper hobby or extreme zero waste green philosophy. Worrying about it is basically a hobby, an identity, a community, an esthetic. Most people have some other hobby and identity and don't need this one.

Which Google product out of the many[0] do you know that doesn't scrape data?

I think Google profits massively off of the ignorance of its users and is reliant on their unawareness that they're producers of actual relevant data.

[0]: https://en.wikipedia.org/wiki/List_of_Google_products

Google the search engine could exist without being a privacy pest. But once Google bought DoubleClick in 2002 and made their ad delivery platform their own, going down the panopticon path became inevitable.

Google makes about $3 per user per month in ad revenue[0]. With VAT and transfer costs that makes a equivalent subscription maybe $5 per month?

(Too much for my taste.)

Then you have to factor in that (far) fewer users are going to use/pay for their products if it's a subscription.

It's a though calculation for sure.

[0] https://thenextweb.com/news/heres-how-much-money-you-made-go...

Your comment made me think of other companies we view as (mostly) “good” today.

E.g. tons of people take Uber/Lyft with no consideration about how those companies can take your travel history and daily schedule to monetize or sell to 3rd parties.

DoorDash - what if they start selling my order history to insurance companies as a variable to predict obesity/mortality?

HN/Reddit - what if some LLM scrapes all my comments, de-anonymizes me, and sells that info to a data broker?

Visa/Mastercard - what if 100% of my credit card history is sold to data brokers? (Spoiler, it already often is!)

Just trying to illustrate that even in 2025, we pick and choose what to view through rose colored glasses and what to frown upon.

In the example of Uber/Lyft, I willingly give up my home address and even let me know every time I’m out of town! (Trips to airport) yet that seemingly doesn’t cross my mind when requesting a ride.

I don’t disagree with your comment, but IMO what was true in 2000’s is still true today: people overlook risks of things when the benefits are substantial enough. That’s human nature

I lived through the early 2000s and it was already pretty easy to see how 23andme could go wrong. Unlike data that could leak from a company like Google or Facebook, your DNA is forever associated with you and can't be changed or obfuscated. IIRC, many on HN made the same point at the time.

Elsewhere in this discussion there are people talking about how "the common man" doesn't understand the risks of privacy loss. Well it really doesn't help that when those risks materialize you also have people claiming "well no one could have seen that coming".

(Nitpick: the "Like" button was invented by FriendFeed, which was acqui-hired by FB, and Facebook implemented the "Like" button in 2009.)

I remember 2008. It was the same thing as now. The majority of people just want what they want, useful or shiny, and don't care about the rest. Remember how many signed up for housing loans they couldn't pay back, knew they disn't have the money, but it was cool and everyone else was doing it? Same thing, roughly. Was the case then and will be now.

Meaning what?

Government funded research also has perverse incentives:

1. publish or perish, leading to lots of low quality papers

2. funding doesn't continue if one doesn't get results, leading to selection of "safe" research rather than risky research, and results that cannot be replicated

3. no funding for politically unpopular topics

and, of course, the reasons why people publish overtly fraudulent research papers.

For what it's worth, the ACA made it illegal to deny or charge more for health insurance for preexisting conditions.

I still largely agree that it's worth keeping your DNA out of the hands of data brokers for several reasons, but as laws exist today that would not be legal.

I considered this when I sent them my sample. For me the benefit outweighed the risk. I'm sure their DNA database have been sold or given to all kind of companies and agencies since then (many years ago). Asking them to delete my record now is pointless. Anyone who cared about it already has it.

It's funny because people are genuinely upset at others who do send their dna around; but assume that their own government might allow such a misuse of personal identifiable information. If your government allows that, the problem is the government, not the people who sent their dna to 23andme.

> Or when the government decides to start rounding people up based on ancestry

And you think that not having sent your dna to 23andme would be a good protection from that? Like, since you are among the smart ones who didn't send the dna, you can keep quietly minding your business while the government "rounds up" people on a racial basis?

https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrim...

I'm not really disagreeing with you, but it seems to me like the insurance company already has all those blood panels, etc that they paid for - they know what my issues are long before they get around to caring about what 23andMe might tell them. And this government will come after me for being a Democrat and my neighbors for being melanated long before they care about my DNA.

If any of that is happening, society is already a fascist dystopian hellhole and my 23andme DNA is least of my problems

With all due respect, that's baseless FUD.

Call me naive, but I believe insurance companies have more concrete battles to fight (e.g. confirmed preexisting conditions), than getting in a legal quagmire with insurees just because "you have 2.7% risk of having early onset of X, instead of the 1.35% of the average population".

I understand the allure of painting everything with dystopian Orwellian colors and "but-what-if-they-do" thing, but the fact that 23andme is going bankrupt and others are not much better (Ancestry was acquired by a PE firm in 2020, and is increasingly pivoting away from DNA) is a great indicator that DNA data is commercially worthless.

If anything, the biggest risk is your data being used for ads. I bet some pharma companies would love to use your DNA data to enhance their 1PD propensity models.

This makes a lot of sense if you subscribe to the libertarian view that corporations should have unchecked power and the governments is out to get you.

I paid them a lot more than $119 to have my DNA sample.

I am also fortunate enough to just not care about $120. That’s not true of everyone though.

The scenario is not occurring, and anyway... if you had information about an increased risk, you can use that information to mitigate the risk and avoid the harm. Even if you think insurance and doctors are good for you, efficient and help you feel better... they are much more effective if you as the patient have a pretty good idea of what might be going wrong.

> You will understand once DOGE starts ethnic cleansing

The administration's ethnic cleansing policy is already being executed, DOGE so far hasn't been particularly central to that aspect of the Administration's abuses.

Setting aside for a moment whether this is feasible, an effective preventative care program would make the insurance program more competitive, in cost or quality. You're assuming employers and patients are just along for whatever anticompetitive ride insurers take them on. That would be a departure from marketplace fundamentals. The ACA also has safe harbors for process improvements .

On the feasibility point, if this use case is entirely infeasible I don't know what all the hand-wringing on this board is about!

You don't need DNA for that though. Just hand out money and buy people.

Similar to November, a Musk funded group is currently offering $100 to registered voters in Wisconsin to sign a petition against “activist judges” with a not so subtle nudge to vote for the judge that will be favorable to the lawsuit he(musk) and Tesla are involved in within the state and who happens to be be part of the Trump gang having campaigned with junior.

None of those actions require the use of dna sequencing to happen.

If the US is 'at the stage of mass deportation' [of people here illegally in the first place] it's only because we've been wildly generous to that set of people for so long that there's a backlog of them. In most countries, doing crimes while there illegally is something you don't dare do, or deportation could be the least of your worries.

Why sign their limitation of liability?

excellent, i was giong to ask if you're going to test it anyway why not make it free. and now you have. nice. i'm really curious what the attack vector is here. i try to take privacy guys seriously but sometimes theres definitely just fearmongering

I read a book years ago that I can't remember the name that your comment reminded me of, although achieved a little differently.

In the book a global pandemic broke out but didn't effect Muslims. How was this possible? A in-world marketing campaign promoted "Mecca Water", in which the antidote / preventative was delivered and the Muslim world was made to believe it was holy / blessed / a pilgrimage experience to consume it.

I feel it might have been a product of the post-911 world but I did find it interesting and also fear the future as it seems possible today, I'm sure some are trying.

Does anyone under 40 have a non locked down or an undeleted Facebook account?