Whom does your DNA belong to? Hint, it’s not just you.

When you submit your DNA to a personal genomics company like Ancestry or 23andme, you’re not just uncovering secrets about yourself, but potentially about other people.

That’s what Dani Shapiro learned after she spat into a tube and sent it to Ancestry for testing.

“It really was very much in the spirit of a lark,” says the novelist and memoirist. “It was just this recreational feeling of, ‘Oh, maybe we’ll discover second cousins or third cousins.’”

What she found instead challenged her very sense of self.

As Ms. Shapiro describes in her bestselling memoir, “Inheritance: A Memoir of Genealogy, Paternity, and Love,” published in January, the DNA test found that she was only half Ashkenazi Eastern European, not the 100% that she had always thought. And there was a name that she didn’t recognize, identified as a first cousin. The truth was unavoidable: The man who raised her was not her biological father.

“It’s like the lights blinked on,” she says. “After the initial shock and disruption and disorientation, things about myself that I had not understood became very clear.”

Ms. Shapiro’s discovery illuminates the two faces of home DNA testing: Genetic information, by its very nature, cannot exist in isolation. Any secrets that you uncover in your own genes will also be uncovered in those genes you share with others. As home testing becomes increasingly popular, with tens of millions of kits sold each year, society is only beginning to feel the tension between consumer freedom and collective privacy.   

In Ms. Shapiro’s case, she determined that her parents, who had since died, had sought treatment at a fertility clinic in 1961. At the time, a common practice in male infertility cases was to mix donor sperm – typically that of medical students – with that of the intended father. Donors were promised anonymity, records were destroyed, and parents were instructed to pretend it never happened.

And yet, despite all the clinic’s efforts to purge evidence and maintain ambiguity, Ms. Shapiro managed to track down her biological father, a retired physician with a wife and three children, in just 36 hours.

“It really didn’t take any kind of expert anything,” she says. “It took Facebook and Google and a couple of hunches.”

Ms. Shapiro’s biological father, whom she describes as a “very private guy,” never submitted his genetic information to Ancestry or any other genealogical DNA testing service. But one of his many nephews did, and that was all Ms. Shapiro needed.

Bring the whole family

This spillover effect is prompting some observers to suggest that the way we frame genetic privacy is too individualized to account for the ways that DNA binds us together.

“Online genetic testing really exposes these connections between people,” says Jennifer King, the director of consumer privacy at Stanford Law School’s Center for Internet and Society.

“When you make this individual choice to upload a genetic sample to a site, you’ve brought along everybody you’re directly related to, as well as potentially your current or future children and grandchildren, and presumably you have not asked any of those people for their consent.”

So far, more than 26 million people have taken a home DNA test, with as many people purchasing kits in 2018 as in all prior years combined, according to a report by MIT Technology Review.

The business is dominated by two companies: Ancestry, based in Lehi, Utah, and 23andme, based in Mountain View, California. And around them has spawned a cottage industry of smaller companies that let users upload their raw DNA data from Ancestry or 23andme in exchange for the identities of long-lost relatives or for what are claimed to be genetically personalized tips on nutrition, fitness, and even romance.

A study published in the journal Science last year looked at one such free database, GEDMatch, which contains the profiles of 0.5% of the U.S. population, and found that it could be used to identify 60% of Americans of European descent. With 2% of the U.S. population, this figure would increase to more than 90%, the researchers found.

Nothing to hide?

Last year, authorities in California used information from GEDMatch to track down and convict the U.S. Navy veteran and former police officer Joseph James DeAngelo, the so-called Golden State Killer who committed at least 13 murders and more than 50 rapes in California in the 1970s and 1980s.

Mr. DeAngelo himself had not submitted his DNA to any service, but, just as with Ms. Shapiro’s biological father, that wasn’t necessary. A profile of one of the killer’s relatives was in the database, and that was all that law enforcement needed.

Since then GEDMatch has become the de facto DNA database for law enforcement, leading to dozens more cold-case arrests for rape and murder.

But Dr. King worries that, when these databases make users’ genetic profiles available to law enforcement, a slippery slope lies ahead. “I should be able to opt out of that,” she says. “Otherwise we start opening up a world where you have law enforcement able to engage in fairly intrusive searches of innocent people without any burden of proof. ... You start moving from serial killers to traffic tickets.”

“People who think that they have nothing to hide usually have a lot of social advantages that other people don’t,” she adds.

Far-reaching effects

Internationally, the picture grows even more complicated, as policies set in one country could have impacts on the other side of a globe.

Owned by a Chinese holding company, the for-profit Genomics Medicine Ireland Ltd. announced last November that it planned to build a database of 400,000 participants in Ireland, about 6% of the island’s population. Because the Irish are more closely related to each other than are other European populations, such a database would contain information about a huge proportion of the Irish citizenry.

But it doesn’t stop there. From the middle of the 19th century up through the 1980s, Ireland experienced a massive emigration of its population. Ireland’s emigrants and their descendants are thought to number some 70 million.

“Because the diaspora is so large, you can then make some fairly educated guesses on an international level,” says Róisín Costello, a privacy researcher at the Long Room Hub Arts & Humanities Research Institute at Trinity College in Dublin. “That’s obviously extremely concerning.”

Like Dr. King, Ms. Costello suggests that the way we tend to frame privacy as an individual right, one that each customer can negotiate on their own with a corporation, has the potential to erode the greater good.

“There’s no sense that privacy might be in fact a collective good that can be collectively eroded by small individual actions that cumulatively build to a societal impact that is much greater than that,” says Ms. Costello.

Like Facebook, but for DNA

Dr. King notes that there are currently few legal restrictions in the United States on how DNA testing companies can use your data. “Right now, I would say they’re being fairly conservative and not doing things like selling it and not using it for advertising purposes,” she says. “But there’s no reason why they couldn’t do that in the future.”

Most experts agree that new rules are needed to clarify how personal genetic information can and cannot be used, but to do so you first need to determine what rules already exist, which is itself no small task. But as of last month, a team of lawyers, doctors, and other scholars say they have completed it. Created by the University of Minnesota and Vanderbilt University, the three-year, $2 million LawSeq project is a searchable database of every federal and state law, regulation, and official guideline currently regulating the field of genomics, marking the first step toward a more comprehensive genetic privacy regime.

Katie Hasson, a researcher at the Center for Genetics and Society, draws a comparison between the business models of genetic testing companies with that of Facebook, whose reputation has suffered in recent years following revelations about the ways in which the social network monetizes users’ profiles.

“A few years ago, it seemed really innocuous to put your friends and your likes and whatever daily happenings on Facebook,” she says. "Now ... we’re seeing that when your personal information is monetized by private companies, it's used for all kinds of things that you didn’t want. The effects can go beyond what you would imagine.”

Certainly one of these effects, one unimagined by earlier generations, is that the concept of anonymous sperm donation is quickly becoming incoherent, making about as much sense as the concept of anonymously sharing your social security number.  

“What stuns me is that in 2019 there are still anonymous sperm donors and anonymous egg donors. That is absurd,” says Ms. Shapiro. “They can’t be anonymous. They won’t be anonymous.

“My biological father did not do a DNA test,” she says. “We’re all identifiable and findable.”