INDIANAPOLIS, Ind. - Red hair, green eyes, and a curiosity to know where it all began.
Brooke Nigh had a lot of questions about where she came from and the answers seemed to lie in a DNA testing kit she got from her husband for Christmas. So she spit into a vial, sealed it, and mailed it off to a lab in Utah.
"It would be exciting to see something that I had not considered pop up," she said.
Perry Pride was hoping for clues into his heritage too when he sent off his DNA sample.
"I wanted to see if we had any other races in us," he said.
He got some interesting results.
“I had no idea that this was gonna be there," he said as he pointed to the Caucasus region on a map.
Lots of Hoosiers got genealogy gifts for Christmas, but like Brooke and Perry, not everyone really knows what they are getting themselves into.
Just weeks before Christmas, U.S. Senator Chuck Schumer called on a federal investigation into DNA testing companies, saying these popular kits were putting consumer privacy at a great risk.
"Here's what many consumers don't realize. That their sensitive information can end up in the hand of unknown third-party companies, there are no prohibitions, and many companies say that they can still sell your information to other companies," said Schumer during a news conference.
The Federal Trade Commission followed his call with a warning of their own saying "a major concern for consumers should be who else could have access to information about your heritage and your health."
"Unfortunately, that's part of culture today. It's a click-through culture," said Consumer Protection Attorney Ryan Frasher.
Knowing most folks weren't reading the Terms of Agreement and Privacy Standards for these DNA kits, we asked Frasher to do it for us. We chose the two biggest DNA testing companies, 23andMe and Ancestry DNA, and Frasher helped us narrow down three big questions everyone should be asking.
1. How can my DNA be used?
"23andMe seems to be more profit driven and they seem to have more connections with big pharma companies," said Frasher.
He found 23andMe had numerous partnerships with private companies like Pzifer. That means your DNA could help the company turn a profit one day. But a company spokesman for 23andMe told FOX59, your DNA will never be shared with third parties unless you give them explicit consent. The same goes for Ancestry DNA.
However, Frasher warns, if you do say yes, the use of your DNA is seemingly limitless.
"'At some point they're going to package it up and sell it for billion if not trillions of dollars."
2. Who can access my DNA?
"'This information can legally be subpoenaed by the government very easily," said Frasher.
Your genetics can wind up in the hands of police. 23andMe says it has not given up any DNA information to law enforcement yet. However, Ancestry has responded to a request for DNA information once in 2014.
Ancestry's website explains it was "a 2014 search warrant ordering us to provide the identity of a person based on a DNA sample that had previously been made public for which the police had a match. We disclosed information in response to that valid warrant."
Ancestry.com has also handed over customer information at least eight times in 2016. Ancestry said all of those cases involved credit card misuse and identity theft.
And if you're thinking about getting life insurance, think before you spit in that tube. Frasher said, while a federal law prevents your employer or health insurance company from using your DNA against you, the law doesn't apply to life insurance, disability, or even long-term care insurance.
"You'd have to turn over these tests that were run by these companies to this life insurance program."
3. Can my DNA wind up in the wrong hands?
The simple answer is yes. While both companies say they have safeguards in place to prevent a hack, they can't rule out the possibility that it could happen.
"I don’t think we've had privacy for 20 years," said Perry. He knew that much when he signed up and shipped off his DNA.
Brooke wasn't too worried either.
"I don't have a lot of concerns, because as long as they don't have any kind of malicious intent with it I feel like that's okay," she said. She eventually found out she is from western Europe.
For so many like Brooke and Perry, the idea of knowing more about the past, means more right now than what might happen in the future.
23andMe Privacy Officer Kate Black sent FOX59 a statement about privacy concerns:
"Customer privacy is our top priority. We do not sell individual customer information nor do we include any customer data in our research program without an individual’s voluntary and informed consent. Our Research program is built on established ethical principles as laid out in the Belmont Report and the Common Rule. 23andMe customers are in control of their data - customers can choose to consent, or not to, at any time. Our consent document and privacy statement are published online for everyone to read and our research is overseen by an independent third party (IRB) to ensure research meets all legal and ethical standards."
Ancestry DNA responded to the FTC warning by issuing a statement to FOX59 which reads in part:
We respect and agree with the concern for customer privacy and believe any regulation should match the commitments we make to our customers:
- You own your data and you always maintain ownership of it
- We do not sell your data to third parties or share it with researchers without your consent
- You may request that we delete your data or account at any time
We are always open to working with regulators and others to protect consumers.
You can read the full Terms of Agreement for 23andMe and Ancestry DNA here: