Privacy Fragility in Direct-to-Consumer Genetic Testing: Lessons from the 23andMe Journey

This study investigates how structural, legal, and organizational dynamics erode user privacy in Direct-to-Consumer Genetic Testing (DTC-GT), using 23andMe as a critical case. We categorize privacy risks into three harm types: knowledge harms, autonomy and trust harms, and data misuse harms. Our analysis focuses on 23andMe’s 2023 cyberattack, data-sharing practices that changed over time, and the privacy consequences of its 2025 bankruptcy and sale. The breach exposed 6.9 million genetic profiles, many of which were later sold on illicit forums. These privacy risks stem from opaque consent mechanisms, affiliate transfers, and the sale of genetic data in bankruptcy. Regulatory gaps and permissive contracts further enable third-party access, often contradicting consumer-facing assurances. To explain how such vulnerabilities accumulate, we introduce the construct of privacy fragility, which captures how delayed breach responses, irrevocable data permissions, and commercial failure interact to undermine institutional safeguards. We argue these are not isolated failures but interconnected conditions that systematically weaken privacy protections. Our findings support a roadmap of legal, technical, and behavioral mitigations tailored to high-risk platforms. By tracing how privacy protections deteriorate amid shifting business and regulatory pressures, we contribute a scalable framework for evaluating privacy risk in consumer data ecosystems. This framework underscores the urgent need for adaptive governance, particularly in underregulated markets like DTC-GT where data sensitivity is high and user protections remain weak.