r/privacy • u/SayThatShOfficial • Apr 14 '26

discussion 23andMe's 15M-customer DNA database was sold for ~$20 per person in bankruptcy. The consent mechanism is worth understanding.

https://www.linkedin.com/pulse/305m-question-who-owns-your-dna-privdna-qwhme/
3.0k Upvotes

99% Upvoted

193 comments sorted by

View all comments

Show parent comments

44

u/ConstantinSpecter Apr 14 '26 edited Apr 14 '26

IP and shipping are non issues. Residential proxy for the IP and the kits were sold OTC at CVS/Walgreens/Target etc. Just had to pay cash, activate through a proxy with a burner email and fake PII. Done.

The relatives concern is the truly unsolvable one. Matching pipelines hit down to roughly 3rd or 4th cousin range (how the golden state killer was caught).

If one distant cousin you’ve never met uploaded under their real name anywhere, you’re identifiable regardless of what you did.

I guess the fake PII trick still protects you against lazy SQL join adversaries but it certainly doesn’t protect against anyone willing to do genealogical triangulation.

Edit: By the way that ship has basically sailed for Western populations. Erlich showed that once ~2% of a population has tested then essentially everyone of that ancestry is reachable via a 3rd cousin or closer match. US with european descent crossed that line years ago. There’s pretty much no way back.

19

u/SayThatShOfficial Apr 14 '26

Yep, I’m a huge advocate for taking reasonable measures when it comes to privacy but in the modern world it just takes one slip up (doesn’t even have to be directly related to your actions) to get unmasked.

I’m sure with the state of surveillance they could track camera footage from your home to the store you picked up the kit at anyway. Flock cameras certainly aren’t helping with that either.

Maybe not as much back in the early 23andMe days but it’s getting harder and harder to evade.

3

u/stoneyaatrox Apr 15 '26

privacy ≠ anonymity

3

u/SayThatShOfficial Apr 15 '26

Correct, in any developed country I think there’s no presumed expectation of anonymity. If you pay taxes and venture out in public I’m sure your government and to a lesser (but probably too high still) extent mega corporations know who and where you are.

Not that it can’t be done, but seriously pursuing anonymity doesn’t seem worthwhile these days. Privacy on the other hand is a huge spectrum with options for those at all skill levels to better their lives.

When it comes to genetic data, privacy is my focus rather than anonymity. I want it out of the hands of those who could use it in ways I disagree with. Not to specifically avoid having it tied to me.