More than 26 million people have taken an at-home ancestry test

As many people purchased consumer DNA tests in 2018 as in all previous years combined, MIT Technology Review has found.

Surging public interest in ancestry and health—propelled by heavy TV and online marketing—was behind a record year for sales of the tests, which entice consumers to spit in a tube or swab their cheeks and ship the sample back to have their genomes analyzed.

By the start of 2019, more than 26 million consumers had added their DNA to four leading commercial ancestry and health databases, according to our estimates. If the pace continues, the gene troves could hold data on the genetic makeup of more than 100 million people within 24 months.

The testing frenzy is creating two superpowers—Ancestry of Lehi, Utah, and 23andMe of Mountain View, California. These privately held companies now have some of the world’s largest collections of human DNA.

For consumers, the tests—which cost as little as $59—offer entertainment, clues to ancestry, and a chance of discovering family secrets, such as siblings you didn’t know about. But the consequences for privacy go well beyond that. As these databases grow, they have made it possible to trace the relationships between nearly all Americans, including those who never purchased a test.

“You may discover unexpected facts about yourself or your family when using our services,” warns Ancestry’s privacy statement. “Once discoveries are made, we can’t undo them.”

What the tests do

When you send in your spit or mouth swab, companies extract DNA from your cells. They analyze it on a chip that decodes around 600,000 positions where people’s DNA code commonly differs. These are called single-nucleotide polymorphisms.

Think of each of your genes as coming in one of a dozen possible flavors. The test determines whether you have a very common version of that gene, like chocolate, or something less common, like pistachio. Your specific combination of genetic flavors reveals three things: where your ancestors came from, how closely you are related to another database member, and whether you have certain traits.

This year, for example, US Senator Elizabeth Warren demonstrated she really does descend from a Native American, although the ancestor lived long ago. The DNA test proved it because each region of the world has a different genetic signature. These differences arose over the eons of prehistory when human populations were separated.

Many consumers want to use the services to compare DNA with one another: if two people share large stretches of identical DNA, it means they’re closely related. Finally, your DNA can say something about certain traits, like how your earlobes are shaped and whether you hate the taste of cilantro or are at risk for cancer. 23andMe offers more than a dozen such trait reports.

Counting users

We estimated the number of people tested based on public statements by the four largest ancestry companies, our own reporting, and data maintained by the International Society of Genetic Genealogy and tracked by genealogy blogger Leah Larkin. Because the companies release information on their user numbers only intermittently, we picked the disclosures closest to January 1 of each year back to 2012.

To compile a 2019 figure, we used data reported by Ancestry on November 29, 2018, when it claimed that a record Thanksgiving sales period had raised the total number of test kits sold to 14 million. The company has not reported any benchmark since, so our figure does not include Christmas sales, which could have added another million members.

Gene By Gene, a Houston company, told us its Family Tree DNA ancestry database has about 2 million people in it, but half underwent earlier, less comprehensive forms of testing, and about 20% of the profiles it holds are uploads of data generated by other companies. Yaniv Erlich, chief scientist of MyHeritage, an Israeli company, said its database, now the third largest, includes 2.5 million profiles.

Although 23andMe has not publicly released a figure recently, a person familiar with the company's figures and market data said it has now tested more than 9 million people. That brought the total of consumer tests speeding past the 25 million mark.

The data comes with some caveats. For instance, Ancestry reports how many kits it sells, but not how many people complete the test (I have an unused one at home). Also, some people test with more than one company, so the total number of unique individuals ever tested is lower than the number of tests ordered. The degree of overlap isn’t known, although Erlich says it is small.

Network effect

The data clearly show how Ancestry and 23andMe are snuffing out competitors. Like large social networks, they’re high-tech operations with plenty of financial and legal muscle. Ancestry has 70 jobs open for big data engineers, computational biologists, and lobbyists.

The sheer size of the two leaders means it’s hard for competitors to gain a foothold. That’s because of a network effect: the more individuals join a database, the more useful it is for finding relatives, for creating ancestry estimates, and (in the case of 23andMe) as a basis for drug research.

“It’s much harder to start up now,” says Erlich. He says MyHeritage is growing fast because it operates in Europe and has translated its site into 42 languages.

Even some well-funded competitors look to be struggling. In 2015, gene giant Illumina and a private equity group gambled $100 million on Helix, their own “app store” for DNA tests. But Helix has never said how many people have bought its apps. That’s one sign things aren’t going well.

It also means that just a few private companies now have their sights on the rest of the world’s population. “This is just the beginning,” Erlich says of the millions tested thus far. “It’s nothing—it’s a drop in the bucket.”

Health debate

Of the four companies, 23andMe is the only one offering health reports in addition to ancestry insights. Last year it won clearance from the US Food and Drug Administration to test two breast cancer genes, and more recently it got a green light to tell consumers about a prostate cancer risk.

Previously, to see that kind of information you’d need to visit a doctor. And some critics say you should still have to. In a remarkable step, the New York Times editorial board in February took aim at the company, telling consumers to be “careful” and comparing the reports to a parlor trick.

The problem is that 23andMe only looks for a few breast cancer mutations out of hundreds that are possible, and does something similar for colorectal cancer. This means the tests aren’t definitive. Muin J. Khoury, director of the office of public health genomics at the Centers for Disease Control and Prevention, has called 23andMe’s cancer tests “a piecemeal, potentially confusing approach to direct to consumer genetic testing.”

But 23andMe isn’t likely to back off now. The company’s CEO, Anne Wojcicki, has said she’s trying to “get back her babies”—namely, a couple of hundred medical tests it was forced to withdraw from the market in 2013, also over accuracy concerns. In an her own editorial, Wojcicki says she's determined to make inexpensive genetic information available without medical professions getting in the way. 

Crime and privacy

Potentially the most important application of the databases is one the public didn’t appreciate at all until last May, when police in California, with the help of a genetic sleuth, identified the Golden State Killer, a rapist and murderer who’d gone unpunished for decades.

They did so using an informally managed ancestry database, GEDMatch, where a million people had shared test results from other companies. The investigators uploaded the still unknown killer’s DNA (from a crime scene sample) and found distant relatives. Since then, more than 30 rapists, killers, and victims’ bodies have been identified the same way.

During the summer, the big four big ancestry companies all promised they wouldn’t let police into their databases without a warrant. But it was only weeks before the smallest player, Family Tree DNA, changed its mind and began allowing the FBI to upload DNA from corpses or blood spatters and surf the database just like any other customer, checking out names and who is related to who.

The unilateral change in policy—which users weren’t alerted to—is troubling because it means that our DNA, just like our posts on social media or our location data, is at the mercy of user agreements none of us have any control over or even bother to read. And that may be the biggest lesson of taking a DNA test.

“First rule of data: once you hand it over, you lose control of it. You have no idea how the terms of service will change for your ‘recreational’ DNA sample,” tweeted Elizabeth Joh, a law professor at the University of California, Davis.