Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I signed up for 23andme.com a few months ago, mainly because I'm adopted and I don't know anything about my family history, so I thought it would be neat to check out. The one and only thing that bothers me so far is their definition of privacy. Here's what I mean:

One of the features they provide is ancestry help. They compare your DNA with all other users' DNA and then give you a list of potential relatives. They say "hey, you guys share .6% of the same DNA, you might be 3rd to 5th cousins."

That's cool, right? Especially for someone who is adopted.

The problem is that it takes 2 weeks longer to do the ancestry stuff than it does to do the medical stuff. The medical results showed up in my account about 4 weeks after I sent off my spit-filled test tube. The ancestry results showed up a full month later. In the meantime, between medical results and ancestry results, I'm getting "friend requests" from other users. There are no messages attached to these users, but I presume they believe, somehow, that they are related to me.

How can this be? I hadn't yet received my own ancestry results.

I emailed 23andme.com support, and here's what they said:

> Thank you for contacting 23andMe.

> If you've been genotyped through our service, you can share your genome with other 23andMe users and compare yourself with them using our various features.

>This is of special interest to members who are interested in their family's data.

> Due to the way our computation process works, some of your relatives can actually see you appear in their list of DNA Relatives before all your results are uploaded.

Let me repeat that last part:

> Due to the way our computation process works, some of your relatives can actually see you appear in their list of DNA Relatives before all your results are uploaded.

So get this: my name and some level of my DNA results are shown to complete strangers, and not only that, but they are shown before I even get the information.

That bothers me. That bothers me a lot. I haven't yet decided what to do about it, but believe me, I've spent a great deal of time considering this since it happened.



So by default your name and DNA are not visible to anyone. You'd have to make your profile public in order for other people to see any information about you. All it shows in the relative finder is that there is a match. The person just follows the "contact" link and sends you a message. They don't really expire, so you can just sit on them until you feel like responding/granting access-- at which point they can then see your name. At that point they can't see your DNA either-- you have to go through another process to grant them access to your DNA. All in all it's a pretty good system.


Wow, that's insane. You make a great point about it being useful for persons who are adopted. I agree that it's useful to know more about yourself that way. However, the manner in which your data is handled BEFORE you even get it is FUBAR to me. Sorry you have to go through this, and I'm sure it'd bother me a lot too if I were in your shoes.


Also, Sense About Science had a great piece on the (lack of) accuracy of this kind of ancestry testing. http://www.senseaboutscience.org/data/files/resources/119/Se...


That's really interesting, I didn't realize they did that so blatently. It would definitely bother me. Let us know if you decide to do something about it!


I don't really understand your objection - what is it about a cousin, say, knowing they're your cousin a week or so before you know that troubles you so much?

Please note I'm not saying I disagree, I'm simply asking if you can elucidate the problem further.

The same sort of thing happens to non-adoptees all the time - one's cousins who do family history research may know decades before you that they are your [near] relative.

Aside, it's also interesting WRT privacy of sperm/egg donors. I recently commented in a thread (on Reddit I think) that an egg donor should be aware that it may be quite likely, even if not presently possible, for the child to trace them [the biological mother in that instance] in the future either due to tech or legal changes. This was flatly dismissed as an impossibility; little was I to know it might already be quite possible [in the sense of being attainable by the general public].


There are three major problems with it:

1) I don't even have access to my own information at this point. It's like if the doctor were to post a picture of your newborn baby on FB without your permission before you got to hold it.

2) The accuracy of 23andme's ancestry information is suspect. They think we might be related based on vague data. And again, the other people have this vague data before I do.

3) Finally, there is medical information attached to my account. For instance, maybe I have a normal risk of prostate cancer. Now 23andme decides that I'm related to Joe (true or not), and Joe has a super high risk of prostate cancer. What inferences can be drawn about that? What if this kind of data is shared with a third party -- again, without my knowledge -- and that third party can use that against me somehow? (Insurance, whatever.) I'm not okay with that.

In the end, it's the opaqueness of this process. If 23andme wants to say "Hey, we're not 100% done with your ancestry results, but we found a few people we think might be matches" at the same time they say the same thing to the other people, then that would be okay. But at the time, I was getting requests from alleged relatives that I had no way of knowing they were alleged relatives until 23andme gives me my results.

In other words, these other people -- strangers! -- knew something about me that I hadn't yet found out myself, when it should have been made available to me at the same time.


So get this: my name and some level of my DNA results are shown to complete strangers, and not only that, but they are shown before I even get the information.

This isn't true at all. Nobody sees your name unless you specifically set the privacy setting to that which I can't imagine anyone doing.

Nobody has ever seen my name on 23andme and I see maybe 1 out of 1,000 people's names when they say that they've found a possible relative. Those 1 out of 1,000 people have set their privacy settings to allow that for some weird reason.


Isn't the ancestry matching opt-in? At the very minimum, I'm pretty sure you can opt out when you give your sample.

In that case, if you do have a match, obviously both people will have to be notified of the other's identity. It sounds like you want to see whether you have relatives before the relatives get to see it. How is that fair?

Also are you sure these other people are getting your identity? How do you know it's not masking your identity to these only people which only gets unmasked if you accept/reply to the request?


I could opt out, but I really do want to know my ancestry information. My objection is them sharing my information before I even get a chance to look at it. It's like if you had a baby, but the nurse and doctor published your baby's photo on Facebook before handing you your baby. Why should anyone get to see my information before I do? And then they get to contact me before I even know why they're contacting me? That's bizarre to me.

At this point, I have my information and now that I have it, I'm okay with sharing it, because it's my information to do what I wish. But they were sharing it before they shared it with me, and that's not okay, imo.


But if the information is "here are other people you might be related to", it's not your information; it's both people's. I just don't understand how that can be revealed to you first without being unfair to the person on the other side of the coin, or why it's such a big deal if the reveal doesn't happen at exactly the same time.


Sure. The problem is that I'm getting _requests_ from people I don't know based on _information_ I don't have, and I don't like that _they_ have information about myself that I don't have. And since _they_ have the information, then there's absolutely no reason why _I_ can't have the same information at the same time.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: