Identity theft is a plague on society. It’s bad enough when your credit card or your Social Security number is stolen by hackers.

But at least those personal identifiers can be canceled and reissued. What if it’s your DNA?

23andMe officials on Friday confirmed that private data for some of its users is, in fact, up for sale. The cause of the leak, the officials said, is data scraping, a technique that essentially reassembles large amounts of data by systematically extracting smaller amounts of information available to individual users of a service. Attackers gained unauthorized access to the individual 23andMe accounts, all of which had been configured by the user to opt in to a DNA relative feature that allows them to find potential relatives.

…The data included profile and account ID numbers, display names, gender, birth year, maternal and paternal haplogroups, ancestral heritage results, and data on whether or not each user has opted in to 23andme’s health data. Some of this data is included only when users choose to share it.

Consumer genetics sites like 23andMe have become big business. You send in a DNA sample, and they analyze it and give you information about your ancestry, your distinctive traits, and potential health problems that you have genetic predispositions for. You can also opt in to find relatives who may be in the database. (One of the biggest sites, Ancestry.com, was founded by Mormons whose goal was to identify deceased relatives so they could be posthumously baptized.)

Like AI, this is an area where technology has raced ahead while society is still wrestling with the ethics. We haven’t come to terms with the implications of routine genetic testing.

No more blood secrets

For example, there’s no such thing as a closed adoption anymore. Any adoptee can use these databases to find their biological family, and vice versa. Likewise, anyone from a single-parent household can find their other parent, and anyone conceived by sperm or egg donation can know who their donors were.

This is a huge and underappreciated revolution. For the first time, everyone can have certainty about their paternity and their heritage. Blood ties that were concealed for generations are now illuminated. You can see the story of human history—the flows of migration, conquest and displacement—written in your DNA.

But the dark side of this knowledge is that some people will learn things they might not have wanted to know. Some people will find out that they’re the children of an extramarital affair, or worse, that they were conceived by rape or incest. And because of the relative search, other people can learn this too, whether you wanted them to or not.

Even an affair from generations ago can be seen in the data. It’s stamped for posterity in the DNA of your descendants. For example, genetic studies confirm that Thomas Jefferson fathered children with Sally Hemings, who he enslaved at his Monticello estate. Even further back, Genghis Khan’s Y chromosome is carried by almost 16 million men in Asia today, evidence of his campaign of rape and conquest.

Genetics and capitalism

Once you hand over your DNA to a private company, you give up control over what happens to it. This raises the specter of data leaks and data theft, as in the 23andMe story quoted earlier. It doesn’t appear that people’s actual DNA sequences were leaked on the internet—this time. But given how many other data repositories have been hacked, it’s only a matter of time.

Even if there are no leaks, there’s the matter of what the companies do with your DNA. For example, 23andMe makes money by selling users’ genetic data to medical research companies. They mine this data for correlations, looking for genes that are tied to disease or protective mutations they can mimic with drugs. They claim it’s anonymized, but DNA is the least anonymous thing imaginable. You can reconstruct someone’s sex, their ethnicity, even their appearance.

You might be fine with this. After all, it furthers the cause of science. By contributing your DNA, you’re helping to cure diseases and save lives. You might not even care about being compensated for any treasure troves they find in your genome. But even if you’re that selfless, it’s rational to distrust what else a for-profit business might do with this most personal of information.

In the name of making money, corporations have committed horrifying privacy violations. Who’s to say an ancestry site won’t start selling its users’ DNA to advertisers? Will they start showing me ads for drugs that treat diseases they predict I’m going to develop, based on my genetic profile? (It’s already happening.)

Although I love science and I’m intrigued by the possibility of finding out more about myself, I’ve never submitted my DNA to a genetics company, for just this reason.

My DNA is the most personal and intimate information about me that exists. It might reveal facts about my health or my body that I’d rather keep private. It could allow strangers to predict whether I’m susceptible to alcoholism, or dyslexia, or schizophrenia. I don’t want to give up control of that information, not without better legal protection for who can see it and what can be done with it.

Worse, this doesn’t line up neatly with the classical economic paradigm of rational individuals making choices for themselves—because genetic analysis casts a privacy shadow. Even if you don’t submit your DNA, your relatives might. And their DNA reveals information about yours, whether you want it to or not.

A genetic caste system?

The murky ethics of DNA testing come into sharp relief in the story of how police caught Joseph James DeAngelo Jr., better known as the Golden State Killer. He committed a spree of home invasions, rapes and murders in California in the 1970s and 80s, but evaded capture for decades.

They had a suspect’s DNA from a rape kit, but no leads. So, the FBI—rather than getting a search warrant or a subpoena—set up fake profiles with several consumer ancestry companies, posing as the person they sought, uploading his DNA, and claiming to be interested in finding relatives.

It worked:

What prosecutors did not disclose is that genetic material from the rape kit was first sent to FamilyTreeDNA, which created a DNA profile and allowed law enforcement to set up a fake account to search for matching customers. When that produced only distant leads, a civilian geneticist working with investigators uploaded the forensic profile to MyHeritage. It was the MyHeritage search that identified the close relative who helped break the case.

…A summary of the investigation written by the Ventura County district attorney’s office notes that this search violated MyHeritage’s privacy policies.

You could argue that this is a blessing. Genetic databases were used to identify a suspect in the University of Idaho murders in 2022. They’ve helped catch criminals in numerous cold cases, not just the Golden State Killer case. It’s a more precise and less biased way of identifying a person than eyewitness testimony, or even fingerprints.

On the other hand, you don’t have to be a hardcore civil libertarian to worry about abuses of power. The U.S. has a dark history of eugenics, sterilizing people without their consent because they were minorities, or immigrants, or poor, or simply undesirable.

If the government had everyone’s DNA, it’s all too plausible that this evil could return as a new caste system with a scientific veneer. If an ethnonationalist party wins power again, we could end up in a dystopia where people with the “right” DNA get privileged access to education, jobs and health care, while a genetically defined underclass is forced into subordination.

Between the risks of unfettered capitalism and unchecked government power, we shouldn’t be in a rush to hand over our DNA to unknown parties. We should slow down and think carefully before we give up that much of ourselves. We’ve already given away much of our privacy, but it’s not too late to reclaim it with better regulation.

Still, there’s an argument that the benefits of disclosure outweigh the risks in at least some cases. We already expect politicians to release their tax returns, under the theory that we should know who’s bankrolling them and who might be in a position to influence them. As an extension of that principle, I can imagine a future where office-seekers have to make their genomes public.

What if a candidate is susceptible to early dementia, or some other disease that might cut their life short or compromise their decision-making? Voters undeniably have an interest in knowing that information, but do they have a right to know it?

Our DNA is the deepest refuge of our selves, the sanctum sanctorum of our privacy. If we should be able to keep anything private, it’s this. On the other hand, the more we’re able to tell about people from their genes, the stronger the public-interest case is for disclosure. Whatever we choose, this is too momentous a decision to leave in the hands of profit-seeking private parties. We need a democratic consensus, backed by law, about what we should keep confidential and what should be revealed.