A Major Drug Company Now Has Access to 23andMe’s Genetic Data. Should You Be Concerned?

Consumer genetic testing company 23andMe announced on Wednesday that GlaxoSmithKline purchased a $300 million stake in the company, allowing the pharmaceutical giant to use 23andMe’s trove of genetic data to develop new drugs — and raising new privacy concerns for consumers.

The “collaboration” is a way to make “novel treatments and cures a reality,” 23andMe CEO Anne Wojcicki said in a company blog post. But, though it isn’t 23andMe’s first foray into drug discovery, the deal doesn’t seem quite so simple to some medical experts — or some of the roughly 5 million 23andMe customers who have sent off tubes of their spit in exchange for ancestry and health insights.

Perhaps the most obvious issue is privacy, says Peter Pitts, president of the Center for Medicine in the Public Interest, a non-partisan non-profit that aims to promote patient-centered health care.

“If people are concerned about their social security numbers being stolen, they should be concerned about their genetic information being misused,” Pitts says. “This information is never 100% safe. The risk is magnified when one organization shares it with a second organization. When information moves from one place to another, there’s always a chance for it to be intercepted by unintended third parties.”

That risk is real, agrees Dr. Arthur Caplan, head of the division of medical ethics at the New York University School of Medicine. Caplan says that any genetic privacy concerns also extend to your blood relatives, who likely did not consent to having their DNA tested — echoing some of the questions that arose after law enforcement officials used a genealogy website to find and arrest the suspected Golden State Killer in April.

But in Caplan’s view, the deal raises some even larger questions: namely whether customers really knew what they were signing up for when they spit into those tubes.

“A lot of people paid money to 23andMe to get their ancestry determined — fun, recreational stuff,” Caplan says. “Even though they may have signed a thing saying, ‘I’m okay if you use this information for medical research,’ I’m not sure they understood what that really meant. I’m not sure they understood that it meant, ‘Yes, we’ll go to Glaxo, and that’s where we’re really going to make a lot of money off of you.'”

A 23andMe spokesperson told TIME that data privacy is a “top priority” for the company, emphasizing that customer data isn’t used in research without consent, and that GlaxoSmithKline will only receive “summary statistics from analyses 23andMe conducts so that no single individual can be identified.”

“When a 23andMe customer consents to participate in research, we clearly state that their de-identified data may be used to identify potential areas or targets for therapeutics development and to conduct or support the development of drugs, diagnostics or devices and may be done so in collaboration with third parties,” the spokesperson said in a statement. “Participating in 23andMe research is always voluntary and requires customers to affirmatively consent to participate. They can also choose to opt-out of our research at any time.”

A representative from GlaxoSmithKline did not immediately respond to TIME’s request for comment.

Still, Caplan says 23andMe’s consent agreement should more comprehensively detail exactly how genetic material could be used in the future, as well as by whom. He points to the National Institutes of Health’s (NIH) All of Us project — which aims to collect data from at least a million Americans in an effort to further medical research and discovery — as a better example of informed consent, because it clearly explains how, when and where individuals’ data will be used.

And while the public does stand to gain from new drugs that may be developed as a result of either project, Caplan says All of Us may also be better positioned to make impactful change, since it recruits volunteers from all subsets of the U.S. population and allows them to contribute for free. By contrast, if GlaxoSmithKline uses data from 23andMe customers — who, presumably, could afford to pay at least $69 for a test kit — it will likely result in a non-nationally-representative research sample, which could in turn limit the widespread relevance of its findings.

“The database will be skewed toward middle and upper class people. I don’t think you’re going to have very big samples in there from very poor neighborhoods or Native American reservations,” Caplan says. “It kind of reinforces the issue about, who’s going to get the benefits of mapping the genome?”

To combat that, Caplan says 23andMe should consider giving back to its customers, or the general public, in some way.

“I could see a duty to try to make things subsidized for poorer people to try and control prices, because it’s built on the backs, the data, of millions of Americans,” Caplan says. “You’re not going to be able to pay them one by one, but there is some obligation to…find ways to return some of the benefits to people.”

Pitts believes 23andMe owes its customers even more. “The information that 23andMe is giving to GlaxoSmithKline isn’t out of the goodness of the hearts of 23andMe for the public good. They’re making money on this deal,” Pitts says. “If your data is going to be used for commercial purposes, you should be compensated for that. At minimum, you should be refunded any money you paid to 23andMe to have your genetic test done in the first place.” (The company’s current policy, as detailed on its website, specifies that individuals “acquire no rights in any research or commercial products that may be developed by 23andMe or its collaborating partners.”)

Perhaps the bigger question, Caplan says, is whether you should pay 23andMe to have your DNA tested in the first place. He notes that the company has had some accuracy issues in the past and says the insights any individual can glean from direct-to-consumer genetic tests are limited at this point.

“I’ve never done it, and I don’t tell others to do it,” Caplan says. Now, “knowing they’re going to give the information to a big pharma company for research, I’d rather do my DNA testing with the NIH project.”