By Andelka M. Phillips, Jan Charbonneau

from GeneWatch 28-3 | Oct-Dec 2015

With traditional genetic testing, doctors collect DNA samples, explain test results and advise patients on treatment options. With direct-to-consumer (DTC) genetic testing, private companies provide genetic tests and results in commercial transactions. Consumers provide DNA samples directly to DTC genetic testing companies, with results provided back directly to consumers, typically online and usually without involving doctors.[1] Direct-to-consumer genetic tests range from health-related tests with significant healthcare implications (e.g. disease predisposition) to the so-called recreational genomics with no discernible implications (e.g. earwax consistency).[2]

Of particular concern has been the offering of health-related tests outside the traditional medico-legal environment. Questions have been raised about the quality of health-related direct-to-consumer genetic tests and whether results are understandable by the average consumer. Concern has also been expressed about the appropriate regulation of the DTC genetic testing industry; at present DTC genetic testing purchases are normally governed by corporate contract and privacy policies. It is questionable whether consumers are giving valid consent for the tests and participation in DTC genetic testing research. Finally, there is a consensus that consumers often have insufficient understanding that the terms and conditions they agree to on DTC genetic testing websites (when they click "I agree") are legally binding agreements.

While debatable, let's assume health-related DTC genetic testing tests are accurate and valid, meaning laboratories conducting tests are accredited and tests identify genetic variations with scientifically established links to health-related conditions. For tests to provide personal utility - information someone can do something with - consumers must be able to first understand their test results.

Direct-to-consumer genetic tests are not medical tests, with the industry emphasizing they are for 'research, information and education' only and not to be considered as a diagnosis. Interpretation of DTC genetic testing results, presented by companies in standardized numeric form, and their use in healthcare decision-making is left to consumers. While many companies actively suggest consumers consult their doctors or genetic counselors, that also is left to the consumer.

DTC genetic testing results for disease predisposition are essentially two numbers: the consumer's own personal lifetime risk of developing a given disease and the average person's lifetime risk of developing that same disease. So ... it seems that it should be straightforward for a consumer to compare two numbers objectively and determine if their lifetime risk is higher or lower than the average and then, based on this interpretation, make appropriate healthcare decisions.

In 2015, three thousand potential and actual DTC genetic testing consumers in the United States, Australia and the United Kingdom were asked to interpret sample DTC genetic testing disease pre-disposition results. Analysis revealed that for some consumers, interpretation of these two numbers is anything but objective. Some consumers presented with a personal lifetime risk numerically lower than the average person's believed their risk was actually higher or much higher; some presented with numerically higher than average risk believed their risk was actually lower or much lower. Others presented with a personal lifetime risk significantly higher than the average felt their risk was 'about the same' as the average person's. This diversity of interpretation was driven by a range of factors, including the individual's assessment of their own health and lifestyle, family disease history, general health numeracy skills and even their beliefs about the role genes play in disease.[3]

Does this matter? How the numbers are interpreted was found to have an impact on consumers' emotional states and behavioral intentions. For example, worry and anxiety increased if personal risk was interpreted by the consumer as higher, with relief increasing if personal risk was interpreted as lower than the average - perfectly normal responses if tests and interpretation are accurate but capable of generating unnecessary stress or a false sense of security if not. With regard to what consumers might do, those interpreting their disease risk as higher than average, regardless of the actual numbers, were more likely to, for example, monitor their health more closely, change their diet and visit their doctors - all positive health behaviors regardless of actual results. Of course, those interpreting their risk as lower, again regardless of the actual numbers, were less likely to make such positive health-related changes.

At its core, consumer genomics is about consumer empowerment - allowing consumers to access their own genetic information and use that information in health related decision-making. However, for DTC genetic testing offerings to deliver on this, consumers must be able to accurately interpret test results and make appropriate decisions. This research suggests that DTC genetic testing companies' assumption of 'objective interpretation' of results may not be the case, suggesting the 'one size' approach to returning results may not 'fit all.'

How should we regulate the industry? At present, DTC genetic testing sits outside existing regulation. Several areas of law have relevance (medical devices regulation, consumer protection, and privacy), but specific regulation is needed in the U.S., where many of these companies are based. The FDA's renewed interest in DTC genetic testing as of November 2015[4] also may we hope lead to more specific industry guidance being developed.

Moving DNA testing away from the clinic means that many of the traditional safeguards that might apply in a medical setting are not present in the DTC genetic testing context. With the direct-to-consumer model, genetic testing has moved outside the doctor-patient relationship to that of a relationship between a consumer and company. In lieu of specific regulation, companies rely on the terms of service, terms of use and privacy policies that appear on their websites to govern transactions.

An in-depth review was conducted of the contracts of DTC genetic testing companies providing health testing[5] as well as the existing regulatory landscape. As with many web-based industries, DTC genetic testing contracts are often lengthy, complex documents. And the behavior of consumers in this context resembles their behavior regarding online contracting more generally. That is, it seems that consumers may not actually read the documents they have 'agreed' to when active online. We often tend to click 'I Agree' without considering the legal implications of this. In the DTC genetic testing context this raises questions regarding the validity of consumers' consent for genetic tests and for participation in research.

Even ignoring the non-reading problem, there is an issue of whether a person can ever really agree to terms that are not available at the time of entering into a contract. For instance, many contracts include a unilateral change of terms clause. Such clauses often allow companies to change their terms without direct notice to the consumer. And these contracts often deem consent to altered terms through continued use or visiting of a website, which is often possible without ever encountering terms. This is problematic as it may impact upon the purposes for which stored genetic data may be used. For example, an individual might agree to participate in research conducted by the DTC genetic testing company for certain purposes, but those purposes might change if the terms were subsequently altered.

These contracts often include broad indemnity and exemption clauses which consumers are not likely to expect or understand. For instance, it is common to include a clause disclaiming liability for fitness for purpose. It is possible that some of these terms could be deemed 'unfair terms' and unenforceable under UK and EU law. It may also be possible to challenge some of the terms under American or Australian law. For health related testing, tests really ought to be fit for their claimed purpose and there ought not to be a discrepancy between website claims and contract content.

DTC genetic testing contracts are also generally not industry specific, meaning that they resemble the wrap contracts used more generally by many online industries and large Internet Service Providers. Briefly, a wrap contract can be defined as 'a unilaterally imposed set of terms which the drafter purports to be legally binding.[6] The two most common forms used on the Internet are clickwrap and browsewrap. Clickwrap contracts are presented in a form where a person can scroll through terms and click "I Agree" at the end,[7] while browsewrap normally have terms available on a hyperlink,[8] so that it is possible to click "I Agree" without viewing the terms at all. In online contracting more generally, companies frequently borrow terms from each other,[9] which means there is much uniformity amongst them.

Why does this matter? It matters because DTC genetic testing companies are often not tailoring their contracts and privacy policies to address the specific issues raised by this industry. The two most pressing issues here are the related issues of privacy and information security.

Consumers need to be more aware that their stored sequenced DNA can be used to identify them and also their families. For example, an individual's sequenced genetic data can serve as a unique identifier for that individual and stored data will remain inherently identifiable. And as families share much of their DNA, an individual's stored data poses potential risks for their family, as it is possible to re-identify quite large family groups. Several studies have now indicated that complete anonymization is not possible - even if data is "de-identified," it is re-identifiable.[10]

Some sites offer social networking functions and consumers may also choose to engage with other online platforms that allow sharing of genetic test results and health information, such as CureTogether, owned by DTC genetic testing company 23andMe.[11] When consumers engage with either social networking on a company's website or on a sharing platform, they may also be agreeing to give the company a license to use user generated content. This is concerning, as in this context this content may include personal, lifestyle, and medical data that might normally be considered to be sensitive.

Genetics is a rapidly evolving field with each day bringing new insight into the role genes and their interaction with environmental factors play in disease predisposition and progression and the impact of the microbiome on human health. Even in clinical research there is debate over the role of particular genes and their association with disease.

Health-related genetic testing is complex in nature, even for medical professionals. DTC genetic testing adds additional layers of complexity. At present, many tests offered by companies have not been standardized and standards are not harmonized across the DTC genetic testing industry. The net result is that consumers choosing to purchase tests for the same conditions from different companies may get contradictory results.

Even assuming the tests are accurate, consumers are left to interpret results themselves and then decide what to do with that information, information that might have serious personal and family implications. Consumers may choose to take their DTC genetic testing results to their physicians; however, many general practitioners have indicated they are not yet confident in interpreting genetic tests. Consequently, if consumers are going to benefit from these services, it is vital that physicians have sufficient information to assist them in interpreting DTC genetic testing results.

Ultimately, when engaging with DTC genetic testing companies, consumers have to realize they are entering into legally binding contracts and agreeing to privacy policies involving the most intimate of personal and family information: their DNA.

It appears that with DTC genetic testing it is still very much a case of 'caveat emptor' - let the buyer beware.


Andelka M. Phillips, has recently passed her viva for the degree of doctor of philosophy in law in the Faculty of Law at the University of Oxford. Her research focuses on regulation of DTC genetic testing and the protection of consumers' rights in their genetic information in the context of DTC genetic testing.

Jan Charbonneau is a PhD candidate in Law at the Centre for Law and Genetics, Faculty of Law, University of Tasmania, Australia. Her research takes an evidence-based approach to consumer protection in DTC genetic testing, with a particular focus on the potential for consumer detriment.



[1] The DTC genetic testing industry has been evolving in terms of business models and modes of distribution. Some companies now require, or offer the option, of return of results to consumers' healthcare professionals. 23andMe's UK branch also supplies tests through Superdrug, a pharmaceutical chain.

[2] For information on the range of non-health related DTC genetic testing tests on offer, especially some of the more questionable types of testing, see A. Phillips, 'Only a Click Away - DTC Genetics for Ancestry, Health, Love...and More: A View of the Business and Regulatory Landscape' in Applied & Translational Genomics - forthcoming 2016.

[3] Jan Charbonneau, (2015), Doctoral research 'Think before you spit: Regulatory requirements for consumer protection in Direct-to-Consumer Genetic Testing', University of Tasmania.

[4] GenomeWeb Staff Reporter, 'FDA Sends DNA4Life Untitled Letter Regarding Pharmacogenetic Report Product' (GenomeWeb, 9 November 2015) <> accessed 10 November 2015.

[5] This involved compiling a list of the DNA testing companies with English language websites. 248 have been identified and there are 102 websites that have offered testing for health purposes in the last four years. Please also see Andelka M Phillips, 'Genomic Privacy and Direct-to-Consumer Genetics - Big Consumer Genetic Data - What's in that Contract?' (2015 IEEE CS Security and Privacy Workshops); and Andelka M Phillips, Think Before You Click ? Ordering a Genetic Test Online' (2015) 11 Scitech Lawyer 8.

[6] Nancy S Kim, Wrap Contracts: Foundations and Ramifications (OUP 2014) 2.

[7] Nancy S Kim, Wrap Contracts: Foundations and Ramifications (OUP 2014) 35; and Nancy S Kim, 'Exploitation by Wrap Contracts-Click' (2014) 39 California Bar IP Journal, New Matter 10.

[8] Steve Hedley, The Law of Electronic Commerce and the Internet in the UK and Ireland (2nd edn, Cavendish Publishing Limited 2006) 249.

[9] Nancy S Kim, Wrap Contracts: Foundations and Ramifications (OUP 2014) 60-1.

[10] Melissa Gymrek et al, 'Identifying personal genomes by surname inference' (2013) 339 Science 321; Yaniv Erlich and Arvind Narayanan, 'Routes for breaching and protecting genetic privacy' (2014) 15 Nature Reviews Genetics 409.

[11] 23andMe, '23andMe Acquires CureTogether, Inc.' (Press Release, 12 July 2012),<> accessed 6 January 2013; CureTogether Inc., <> accessed 6 January 2013.

Search: GeneWatch
The use of forensic DNA databases by law enforcement around the globe is expanding at a rate that should be of great concern to civil libertarians.
View Project
The purpose of the Genetic Bill of Rights is to introduce a global dialogue on the fundamental values that have been put at risk by new applications of genetics.
View Project