What consumer DNA health reports can predict — and the BRCA blind spot

A consumer DNA health report can flag a handful of specific genetic variants accurately, but it is not a genetic work-up, and its most dangerous feature is the reassurance a negative result seems to offer. The clearest example is the one health report the US Food and Drug Administration has authorised for a serious disease: 23andMe's test for BRCA1 and BRCA2, the breast and ovarian cancer genes, reads only 3 of more than 1,000 known mutations in those genes [s1].

What the FDA actually cleared

In March 2018 the FDA authorised 23andMe's Genetic Health Risk report for BRCA1/BRCA2 as the first direct-to-consumer test to report on the breast cancer genes [s1]. The authorisation came with "special controls" and a pointed caveat. The three variants the test detects — 185delAG and 5382insC in BRCA1, and 6174delT in BRCA2 — are most common in people of Ashkenazi (Eastern European) Jewish descent and are rare in other populations [s1].

That design creates a trap the FDA named explicitly: because the report covers only three mutations, a customer may misread a negative result as evidence that they carry no BRCA risk at all [s1]. A woman of non-Ashkenazi ancestry with a strong family history of breast cancer could carry a different, cancer-causing BRCA mutation and still receive a "variants not detected" result. The test was never built to find it. Clinical BRCA testing, ordered when family history warrants it, sequences the whole genes.

The raw-data problem

The health reports are the regulated part. The bigger accuracy problem sits in the raw genotyping data that several companies let customers download and run through third-party interpretation sites. A 2018 study from a clinical laboratory, Ambry Genetics, took 49 patient samples that arrived for confirmation of variants first flagged in consumer raw data and re-tested them [s2]. It found that 40% of the variants reported in the raw data were false positives [s2].

Some variants that the raw data or a third-party service had labelled "increased risk" were classified as benign by Ambry and other clinical laboratories, and turned out to be common in public population databases [s2]. The authors' conclusion was blunt: results pulled from consumer raw data need confirmation in a clinical laboratory before anyone acts on them [s2]. The genotyping arrays these services use are built to survey common variation cheaply, not to call rare disease-causing mutations with the accuracy a diagnosis requires.

This is the through-line of the consumer-genomics category. A scoping review of DNA-based diet tests found 104 companies selling nutrigenetic advice, nearly half of which would not disclose which genes they read; a UK review of direct-to-consumer self-tests reached similar conclusions about analytical quality and interpretation. Where a test predicts a complex trait from common variants, the predictions are weak; where it claims to find a serious rare mutation, it usually is not looking at enough of the gene to be trusted alone.

The data outlives the test

The second reason to treat these reports carefully has nothing to do with genetics and everything to do with what happens to the sample. In March 2025, 23andMe filed for Chapter 11 bankruptcy, putting the genetic profiles of millions of customers among the assets to be sold [s3]. Twenty-seven states and the District of Columbia sued to block a sale of that data without customers' explicit consent, and the company was ultimately acquired for $305 million by a nonprofit led by its former chief executive, Anne Wojcicki [s3].

The bankruptcy followed a 2023 breach in which attackers used a credential-stuffing attack — logging in with passwords leaked from other sites — to reach the accounts of about 6.9 million people, roughly half the customer base [s3]. Genetic data is uniquely exposed here because it cannot be reset like a password and it implicates relatives who never took a test [s4].

The legal protections are thinner than most customers assume. The federal Genetic Information Nondiscrimination Act of 2008 bars health insurers and employers from using genetic information, but it does not cover life, disability, or long-term-care insurance [s4]. Consumer testing companies are also not generally covered by the health-privacy rules that bind hospitals and doctors, so what a company may do with a profile is governed largely by its own privacy policy — which can change, or transfer with the company's assets [s4]. The same data-governance gap runs through consumer health devices generally.

What this means for a reader

A consumer DNA report can accurately return the specific variants it is designed to read, and for someone of Ashkenazi ancestry a positive BRCA result is a genuine signal that warrants clinical follow-up. What it cannot do is rule a mutation out: a negative report is not a negative genetic test, and it is not a substitute for the family-history assessment and full-gene sequencing that guide real screening decisions [s1][s2]. The health value and the privacy cost point the same way — treat the report as a conversation-starter with a clinician or genetic counsellor, not as an answer, and read the data-retention terms before spitting in the tube.

Sources

• [s1] US Food and Drug Administration — FDA authorizes, with special controls, direct-to-consumer test that reports three mutations in the BRCA breast cancer genes (2018-03-06)
• [s2] Genetics in Medicine — False-positive results released by direct-to-consumer genetic tests highlight the importance of clinical confirmation testing for appropriate patient care (2018-03-22)
• [s3] ABC News — 23andMe has filed for bankruptcy. What could happen to users' genetic data? (2025-03-24)
• [s4] The Conversation — What users need to know about privacy and data after 23andMe's bankruptcy filing (2025-03-25)