Three years ago, the DNA-testing firm 23andMe was a massive success, with a share price higher than Apple’s.
But, from those heady days of millions of people rushing to send it saliva samples in return for detailed reports about their ancestry, family connections and genetic make-up, it now finds itself fighting for its survival.
Its share price has plummeted and this week it narrowly avoided being delisted from the stock market.
And of course this is a company that holds the most sensitive data imaginable about its customers, raising troubling questions about what might happen to its huge – and extremely valuable – database of individual human DNA.
When contacted by the BBC, 23andMe was bullish about its prospects – and insistent it remained “committed to protecting customer data and consistently focused on maintaining the privacy of our customers.”
But how did what was once one of the most talked-about tech firms get to the position where it has to answer questions about its very survival?
DNA gold rush
Not so long ago, 23andMe was in the public eye for all the right reasons.
Its famous customers included Snoop Dogg, Oprah Winfrey, Eva Longoria and Warren Buffet – and millions of users were getting unexpected and life-changing results.
Some people discovered that their parents were not who they thought they were, or that they had a genetic pre-disposition to serious health conditions. Its share price rocketed to $321.
Fast forward three years and that price has slumped to just under $5 – and the company is worth 2% of what it once was.
What went wrong?
According to Professor Dimitris Andriosopoulos, founder of the Responsible Business Unit at Strathclyde University, the problem for 23andMe was twofold.
Firstly, it didn’t really have a continuing business model – once you’d paid for your DNA report, there was very little for you to return for.
Secondly, plans to use an anonymised version of the gathered DNA database for drug research took too long to become profitable, because the drug development process takes so many years.
That leads him to a blunt conclusion: “If I had a crystal ball, I’d say they will maybe last for a bit longer,” he told the BBC.
“But as it currently is, in my view, 23andMe is highly unlikely to survive.”
The problems at 23andMe are reflected in the turmoil in its leadership.
The board resigned in the summer and only the CEO and co-founder Anne Wojcicki – sister of the late YouTube boss Susan Wojcicki and ex-wife of Google co-founder Sergei Brin – remains from the original line-up.
Rumours have swirled that the firm will shortly either fold or be sold – claims that it rejects.
“23andMe’s co-founder and CEO Anne Wojcicki has publicly shared she intends to take the company private, and is not open to considering third party takeover proposals,” the company said in a statement.
But that hasn’t stopped the speculation, with rival firm Ancestry calling for US competition regulators to get involved if 23andMe does end up for sale.
What happens to the DNA?
Companies rising and falling is nothing new – especially in tech. But 23andMe is different.
“It’s worrying because of the sensitivity of the data,” says Carissa Veliz, author of Privacy is Power.
And that is not just for the individuals who have used the firm.
“If you gave your data to 23andMe, you also gave the genetic data of your parents, your siblings, your children, and even distant kin who did not consent to that,” she told the BBC.
David Stillwell, professor of computational social science at Cambridge Judge Business School, agrees the stakes are high.
“DNA data is different. If your bank account details are hacked, it will be disruptive but you can get a new bank account,” he explained.
“If your (non-identical) sibling has used it, they share 50% of your DNA, so their data can still be used to make health predictions about you.”
The company is adamant these kinds of concerns are without foundation.
“Any company that handles consumer information, including the type of data we collect, there are applicable data protections set out in law required to be followed as part of any future ownership change,” it said in its statement.
“The 23andMe terms of service and privacy statement would remain in place unless and until customers are presented with, and agree to, new terms and statements.”
There are also legal protections which apply in the UK under its version of the data protection law, GDPR, whether the firm goes bust or changes hands.
Even so, all companies can be hacked – as 23andMe was 12 months ago.
And Carissa Veliz remains uneasy – and says ultimately a much robust approach is needed if we want to keep our most personal information safe.
“The terms and conditions of these companies are typically incredibly inclusive; when you give out your personal data to them, you allow them to do pretty much anything they want with it,” she said.
“Until we ban the trade in personal data, we are not well protected enough.”
