DNA testing site 23andMe is fighting for survival

Three years ago, DNA testing company 23andMe became a huge success, with a share price higher than that of Apple.

But, since those heady days of millions of people rushing to send it saliva samples to get detailed reports about their ancestry, family connections and genetic make-up, it now finds itself fighting for its survival.

The stock price has dropped again this week narrowly avoided delisting from the stock market.

And of course this is a company that holds the most sensitive data imaginable about its customers, raising troubling questions about what might happen to its vast — and most valuable — database of individual DNA.

When contacted by the BBC, 23andMe was upbeat about its prospects – and insisted it remained “committed to protecting customer data and continuously focused on protecting our customers' privacy.”

But how did what was once one of the most talked about technology companies come to a point where it has to answer questions about its survival?

Not long ago, 23andMe was in the public eye for all the right reasons.

Its famous clients include Snoop Dogg, Oprah Winfrey, Eva Longoria and Warren Buffet – and millions of users are experiencing unexpected and life-changing results.

Some people find that their parents are not who they thought they were, or that they had a genetic predisposition to serious health conditions. Its share price reached $321.

Fast forward three years and that price has dropped to just under $5 – and the company is worth 2% of what it was.

What went wrong?

According to Professor Dimitris Andriosopoulos, founder of the Responsible Business Unit at Strathclyde University, 23andMe's problem was twofold.

First, it didn't really have a sustainable business model – once you paid for your DNA report, there was very little you could get back.

Second, plans to use an anonymized version of the collected DNA database for drug research have taken too long to become profitable, because the drug development process takes many years.

That leads him to an indirect conclusion: “If I had a crystal ball, I'd say it's going to last a while,” he told the BBC.

“But as it stands right now, in my opinion, 23andMe is unlikely to survive.”

The problems at 23andMe are reflected in the turmoil in its leadership.

I The board resigned in the summer and only CEO and co-founder Anne Wojcicki — sister of the late YouTube boss Susan Wojcicki and ex-wife of Google co-founder Sergey Brin — remains on the original list.

Rumors have surfaced that the company will soon fold or be sold – claims it denies.

“23andMe founder and CEO Anne Wojcicki has publicly stated that she intends to take the company private, and is not willing to be considered for third party takeover proposals,” the company said in a statement.

But that hasn't stopped the speculation, as rival company Ancestry wants US competition regulators to step in if 23andMe is eventually sold.

Companies rising and falling are nothing new – especially in technology. But 23andMe is different.

“It's a concern because of the sensitivity of the data,” said Carissa Veliz, author of Privacy is Power.

And that's not just for people who have used this company.

“If you've given your information to 23andMe, you've also given the genetic data of your parents, siblings, children, and distant relatives who didn't consent,” he told the BBC.

David Yetwell, professor of computational sociology at Cambridge Judge Business School, agrees that the numbers are high.

“The DNA profile is different. If your bank account information is hacked it will be disturbing but you can get a new account,” he explained.

“If your (non-match) sibling has used it, they share 50% of your DNA, so their data can still be used to make life predictions about you.”

The company maintains that these types of concerns are unfounded.

“Any company that holds consumer information, including the type of data we collect, has effective data protection requirements set out in the law that must be followed as part of any future change of ownership,” it said in a statement.

“23andMe's terms of service statement will remain in effect unless customers are presented with, and agree to, new terms and statements.”

There are also legal protections in place in the UK under its own version of the data protection law, GDPR, even if a company goes bust or changes hands.

However, all companies can be hacked – as 23andMe was 12 months ago.

And Carissa Veliz remains uneasy — and says that ultimately a stronger approach is needed if we want to keep our personal information safe.

“The terms and conditions of these companies are often incredibly comprehensive; when you give out your personal information, you let them do whatever they want with it,” she said.

“Until we stop trading personal data, we are not secure enough.”

Additional reporting by Tom Gerken