Vitagene: The DNA Testing Company That Quietly Changed Its Privacy Policy to Allow Selling Genetic Data It Had Promised to Protect

Vitagene Inc., a direct-to-consumer DNA testing and health data company, agreed to a consent order prohibiting it from sharing or selling consumers' genetic information and health data with third parties following findings that the company had changed its privacy policy years after collecting consumers' DNA samples to permit data uses — including sharing with third parties — that its original privacy policy had not allowed, retroactively applying new commercial data uses to genetic and health information that consumers had provided under a fundamentally different set of privacy promises.DOCUMENTED

The retroactive privacy policy change is a particularly significant consumer protection concern when it applies to genetic data. Unlike most consumer personal information, DNA data cannot be changed, and the information it contains — about health risks, ancestry, family relationships, and biological characteristics — is immutable and deeply personal. When a company collects DNA under one set of privacy promises and later changes those promises to allow commercial uses of that data, consumers have no practical recourse: they cannot undo the DNA collection, and the information the company holds about them remains permanently available for whatever uses the company's revised policy permits.REVIEWED

The Original Privacy Promise

Vitagene's original privacy policy — the policy in effect when consumers submitted their DNA samples — described specific and relatively limited uses for the genetic and health information collected. The policy did not authorize broad sharing of individual genetic data with unidentified third parties for commercial purposes. Consumers who provided their DNA and completed detailed health questionnaires did so with the understanding that their data would be used to provide the health and ancestry analysis service they had purchased, and that the policy's restrictions on other uses would limit what else the company could do with their most intimate biological information.DOCUMENTED

The trust relationship involved in DNA testing is particularly significant: consumers who provide a DNA sample are sharing information about themselves that is unique in the human population, that persists unchanged for their lifetime, and that reveals information not only about them but about their biological relatives. This combination of uniqueness, permanence, and familial reach makes DNA data a category that requires heightened privacy protection — and that makes retroactive changes to the terms under which it was collected particularly harmful.DOCUMENTED

The Retroactive Policy Change

Vitagene's revised privacy policy expanded the permitted uses of collected genetic and health data to include sharing with third parties for purposes beyond the provision of the service consumers had purchased. The revision applied to data already held by Vitagene — including DNA data and health questionnaire responses from consumers who had submitted samples under the original policy. Some of these consumers had submitted their information years earlier and had no ongoing relationship with Vitagene that would have drawn their attention to a policy update.DOCUMENTED

The notification process for the policy change did not ensure that all affected consumers were clearly informed of the material change in how their data would be used before the new policy took effect. A general notice of policy updates — delivered through channels that many prior customers may not have monitored — is not adequate notice when the change retroactively expands the commercial uses of highly sensitive personal information that consumers provided under materially different terms. Regulators found that the notification approach was not designed to ensure informed understanding of the changed terms by the consumers most affected: those who had provided their DNA under the original policy.DOCUMENTED

Consumers who sent Vitagene their DNA under a policy that restricted data sharing had their privacy terms changed years later — retroactively expanding what could be done with genetic information they had already provided and could not take back.

The Consent Order's Protections

The consent order permanently prohibits Vitagene from selling, renting, or otherwise sharing any genetic data or health information collected from consumers under its original, more restrictive privacy policy. The prohibition applies regardless of any subsequent changes to Vitagene's privacy policy — meaning that the data collected under the original policy cannot be commercially exploited even if the company's current policy would otherwise permit it. Vitagene is also required to notify consumers whose data the revised policy had purported to make available for sharing that the company is prohibited from sharing that data under the consent order.DOCUMENTED

The case establishes an important enforcement precedent: companies that make privacy promises to obtain sensitive consumer data cannot simply change those promises retroactively to enable commercial uses of the data the original promises did not authorize. The principle applies with particular force to genetic data, but regulators have indicated that the retroactive privacy policy change concern applies more broadly to any highly sensitive consumer information obtained under privacy terms that consumers relied on when deciding to provide it.REVIEWED

Consumers who have provided DNA samples to direct-to-consumer genetic testing companies should review those companies' current privacy policies and compare them to the policies that were in effect when they submitted their samples. Any material expansion of data use permissions since the original collection may warrant a complaint to federal consumer protection authorities. Individuals with documentation of retroactive privacy policy changes by genetic testing companies are encouraged to contact Watchdog Journal at /tips.DOCUMENTED

The Vitagene case illustrates why consumers should approach direct-to-consumer genetic testing with a long-term perspective on data use, not just the immediate service they receive. A genetic testing company that goes through financial difficulty, gets acquired, or simply decides to pursue new business models may seek to extract commercial value from its data assets in ways that were not contemplated when customers submitted their samples. Consumers who have used direct-to-consumer genetic testing services should review those companies' current privacy policies against the policy in effect at the time they submitted their sample, and should monitor for any material changes that broaden permitted data uses. Consumers who want to protect their genetic data going forward can also contact their genetic testing provider to request deletion of their DNA data and account information under whatever state privacy law rights may be available to them in their state.

Have documents relevant to this story? Reach us through our tips channel.