LEHI, Utah _ It markets its DNA kits with promises that tug at the heartstrings: Discover ancestors. Strengthen family ties. Understand your life.
Aided by venture capital and a flood of savvy marketing, Ancestry LLC has grown to become the world's largest DNA testing conglomerate. Since 2012, it has lured more than 5 million people to spit into tubes and add their genetic code to the world's largest private database of DNA. It has also banked away the world's largest collection of human spittle, numbering in the hundreds of gallons.
In the age of Facebook and Google, consumers seem comfortable surrendering their personal information to corporations that aggregate it and monetize it. But Ancestry and other DNA testing companies have added an audacious tweak: Consumers are now paying to hand over their genetic code, their most sensitive individual identifier, to companies that could monetize it far into the future.
Ancestry officials say they have state-of-the-art systems to prevent hacking and security breaches. So far the company has sidestepped privacy scandals that tripped up companies like Facebook, which allowed a political data firm, Cambridge Analytica, to access data from 50 million customers, or government agencies like the U.S. Office of Personnel Management, which a few years ago exposed more than a million personnel records and security clearance data to hackers.
But a three-month review by McClatchy, including visits to Ancestry's headquarters and a main testing lab, reveals a pattern of breached promises to customers, security concerns and inflated marketing pledges that could give consumers some pause:
Unidentified hackers last year accessed an Ancestry website, RootsWeb, compromising the sign-ins of 55,000 Ancestry customers who had the same log-in credentials with RootsWeb. The site has since been shut down. The incident received little attention, but revealed how customers' personal information could be accessed and exploited through Ancestry's partnerships and acquisitions.
AncestryDNA, a subsidiary of Ancestry LLC that markets genetic testing, pledges to safeguard people's private data. But the company has a history of changing the terms of its agreements with customers. In the most high-profile example, Ancestry in 2014 shut down MyFamily.com, a social networking site where more than 1.5 million users had posted family memories, photos and conversations. Numerous customers said they lost treasured family history because of inadequate notification from the company, which decided not to back up the data.
Ancestry claims to beat its competitors in accurate analysis of a person's ethnicity. But interviews with company officials reveal that Ancestry has wide gaps in its ethnic markers for Asia and other sections of the world. Outside geneticists and anthropologists say that Ancestry and other companies are making misleading claims about the accuracy of their ethnic analyses.
Most Ancestry customers consent to have their DNA results, in a de-identified form, shared with the company's research partners in the pursuit of sciences, including finding cures to diseases. But Ancestry's main research partner is a secretive Google subsidiary called Calico Life Sciences, which is focused on ways to extend human longevity through biotechnology. Critics have labeled Calico a "vanity project" of several Silicon Valley billionaires who want to extend their own lifespans.
Peter Pitts, a former associate commissioner for the Food and Drug Administration, said it was inevitable that private companies would one day commercialize DNA analysis. But the speed and scope of the industry's rise is worrisome, he said, in part because few consumers read the fine print of a company's terms and conditions.
"People need to be aware there are risks and benefits," said Pitts, who now runs Center for Medicine in the Public Interest, a New York-based nonprofit. "Right now they see the benefit as being able to have cocktail-party conversation about their genetic makeup. They aren't thinking about the risks of giving up their personal information, and the long-term implications."
Many consumers, he said, have a limited understanding of how DNA is such a unique personal identifier, even more than a fingerprint or social security number. DNA determines the color of a person's hair and eyes, their skin color and propensity to inherited diseases _ information that employers or insurers might want to obtain.
And when someone takes a DNA test, the results not only provide information about that individual, but close relatives as well, said Marcy Darnovsky, director of the Center for Genetics and Society, a biotech watchdog group based in Berkeley, Calif. "You are not just taking the test for you. You are taking it for the whole family," she said.
Born in "mother lode" of family tree research
Founded by a pair of Brigham Young University graduates in the 1990s, Ancestry.com was one of the early internet start-ups that allowed customers to build their family trees online, accessing troves of information that the company assembled. Paul B. Allen, one of the founders of Ancestry.com, said it makes sense that a family-tree internet company would arise in Utah, where the Mormon church has long kept extensive family history records. "This is the mother lode of genealogical research," he said.
Thirty years later, Ancestry is still based in Utah, but has mushroomed into a multinational company that operates in more than 30 countries, pulling in $1 billion in revenue in 2017. Its headquarters in Lehi, south of Salt Lake City, is home to 1,100 of the company's 1,600 employees. The building features a display of lanterns, descending through several floors, meant to resemble DNA strands.
But to really grasp the company's rapid growth, one needs to visit one of Ancestry's contractor labs, where the company sends customer's genetic samples for analysis. One of these labs is in La Jolla, Calif., owned by Illumina, a leading company in sequencing and genotyping DNA.
On a recent weekday, Illumina lab manager Jay Antico donned gloves and a gown and entered a room where Ancestry kits arrive daily. A line of workers were removing spit tubes from the kits, scanning their bar codes and checking for defects. Behind them were a wall of shelving filled with thousands of partly full tubes.
How many tubes arrive at Illumina daily? Antico and Ancestry officials declined to say. "Let's just say it's a lot," said Antico, eyeing the shelves lined with people's saliva.
Like other DNA testing companies, Ancestry uses spit for genetic analysis because is it an easy way for consumers to provide their DNA. Saliva contains white blood cells and cells from the inner lining of people's mouths. Companies such as Illumina isolate the DNA, then go through a multi-step process of "amplifying" it, processing it and turning it into a machine-readable code. The entire process takes about four days, after which Ancestry uses the code to analyze a customer's ethnicity.
Ancestry is highly sensitive about concerns that customer's privacy could be compromised as DNA is shipping around the country, passing through labs and sorting centers.
"Privacy is basically our top priority here," Eric Heath, Ancestry's chief privacy officer, said. "In terms of security, you know, we are very cognizant that without our customers' trust, we do not have a business."
To prevent disclosure of customer identities, the kits and spit tubes that Ancestry sends to Illumina are marked only with bar codes, not people's names and addresses. After Illumina finishes its analysis, the results are sent back to Ancestry, which, according to Heath, is the only entity that can reconnect the results with individual customers. After Ancestry generates an ethnicity estimate for a customer, it is forwarded onto that person's email.
