The Data You Cannot Un-Give

That one sentence is the entire problem, and in 2023 the Federal Trade Commission spent a $75,000 settlement learning to say it out loud. The target was 1Health.io — formerly Vitagene, because nothing rebuilds trust in a DNA company quite like a fresh name on the door. The charge: it left customers' genetic and health records sitting in unencrypted, publicly accessible cloud storage. Anybody who knew where to look could read them. The company had been warned at least three separate times over two years that the buckets were wide open. Three. This is not a sophisticated breach story. This is a company being handed the same memo three times and filing it under later.

Then comes the part that should make you put the spit tube down. 1Health quietly rewrote its privacy policy to retroactively expand what it could do with data people had already handed over. You consent to one set of promises in 2019; the terms shift underneath you in 2020; your cells don't get a revote. The deal you agreed to is not the deal you're in, and the only notice you got was a diff buried in a document nobody reads. The FTC's own business blog laid out the lesson for every other DNA firm watching: the promises you make about genetic data are not decorations. They are the product.

Sit with the asymmetry. A password is a token you can revoke — leak it and you generate a new one before lunch. Genetic data is the opposite of a token. It is the master key, permanent, non-reissuable, and it isn't only about you. Your genome is a map of everyone you're related to: the siblings who never consented, the cousins who never spit in a tube, the children who don't exist yet. You can't consent on their behalf. The spit tube does it anyway. One person's curiosity about their ancestry becomes a family's permanent exposure, and the family is never in the room when the privacy policy changes.

The settlement reads like a list of things a competent custodian would have done on day one: instruct the contract labs to destroy DNA samples held longer than 180 days, actually encrypt the data, stop changing the rules retroactively without consent. The price for failing all of it was $75,000 — for a genetic database. That is not a deterrent. That is a parking ticket issued to a company that sells the one piece of information you can never get back. In 2024 the FTC mailed refunds to roughly 2,400 people. A refund. As if the harm here were a defective blender and not the permanent residence of your DNA on a stranger's hard drive.

Here is the pattern the marketing buries, and it cuts deeper than a weak fine. Consent is the foundation the whole industry stands on — you agreed, you clicked, you spat — and for genetic data that foundation is incoherent by construction. You cannot consent for the siblings and cousins and not-yet-born children whose genome travels inside your own. You cannot consent in 2019 to terms rewritten in 2020. The agreement can't bind the people it exposes, and it can't survive the company's next edit. It was never really a contract. It was a costume worn by a power asymmetry.

So the fine was never the point. The point is the mismatch underneath it: immutable data guarded by mutable incentives. The genome doesn't expire; the privacy policy gets edited on a Tuesday. Every genetic-testing company discovers security right after the breach and ethics right after the lawsuit — and by then the samples are already in the building, and unlike a password, you cannot ask for them back.