Thanks to the rise of the personal genomics industry, learning about your genetic information is as easy as ordering a kit over the internet with a credit card, sending back a swab of cheek cells to a direct-to-consumer (DTC) testing company and waiting for an e-mail for the desired information. But what if your curiosity extends to the genetic information of others? The increasing sophistication of commercially available genetic testing, ever-decreasing costs and age-old human motivations create easy opportunities for the non-consensual collection and analysis of third party DNA or 'DNA theft'. In the United States, where some of the best known DTC genetic testing companies do business, little regulation exists. As a consequence, opportunities for DNA theft abound. The problem of non-consensual DNA collection and analysis raises a number of ethical questions that only a handful of countries have begun to address through regulation.

Committing DNA theft requires little skill and modest expense. Whether the person committing DNA theft is a spouse who suspects their partner of infidelity, a parent who is suspicious of their child's paternity or a 'genetic trophy hunter' who is interested in a Hollywood celebrity, the targeted genetic material can be easily obtained by the surreptitious retrieval of a discarded cigarette or a used cup and analysed for as little as US$100. Although the prevalence of DNA theft is unknown, anecdotal evidence suggests that individuals can in fact retrieve and analyse genetic information from unsuspecting victims with ease. Journalists from New Scientist1 reported that no effort was made to verify that a sample they submitted to a DTC laboratory belonged to the person requesting the genetic information. In addition, an undercover investigation that was conducted by the US Government Accountability Office2 found that some DTC companies openly encouraged DNA theft by suggesting that potential customers could secretly send in a fiancé(e)'s DNA sample and 'surprise' them with the results.

The use of DTC testing to intrude on the lives of others raises serious ethical questions about individual privacy and the government's role in protecting that privacy

The use of DTC testing to intrude on the lives of others raises serious ethical questions about individual privacy and the government's role in protecting that privacy. Whether for profit, blackmail or simply mischief, DNA thieves can wreak havoc on their victims' lives. Revealing predispositions to disease as well as existing medical conditions can result in social stigma and can affect employment prospects. Other tests may reveal the presence or absence of genetic ties among individuals that can disrupt families by questioning social or legal relationships among members. Even when information that has been retrieved through DNA theft reveals no new knowledge to the victim, it is the non-consensual nature of the genetic analysis that strikes at the core of our ability to control deeply personal information about ourselves.

In the United States, opportunities for DNA theft are widespread because, in most jurisdictions, no specific legal restrictions outlaw the practice. At the state and federal level, most legislative efforts have focused on protecting individuals from genetic discrimination at the hands of employers or health insurers, leaving little protection against intrusions by private individuals. For instance, the federal Genetic Information Nondiscrimination Act of 2008 (Ref. 3) does not address non-consensual DNA collection and analysis outside of the insurance and employment settings. A small minority of states — no more than ten — have laws that might be interpreted to ban DNA theft, but many of these laws only target a particular type of conduct: for example, they prohibit disclosure but not collection. Nor does any American jurisdiction punish DNA theft as a criminal felony. In such a regulatory climate, the prevalence of DNA theft will only grow as the costs of genetic analysis decrease.

American legislators might take a cue from other nations that have contemplated the same problem. Since 2006, the United Kingdom has prohibited the non-consensual retrieval of another person's bodily material for genetic analysis as a criminal offence under section 45 of the Human Tissue Act of 2004 (Ref. 4). The Australian government is currently considering a model criminal offence that is similar to the British DNA theft law5. Finally, a recently enacted German law prohibits genetic testing unless conducted by qualified doctors with the consent of all involved parties6. Yet these laws can be circumvented by DTC companies that advertise over the internet and maintain their laboratories within the United States. Although the problem is a global one, a solution may lie in stricter American legislation.

Genetic privacy deserves greater protection. American state legislatures should enact criminal laws that punish the non-consensual collection and analysis of genetic material. A recent bill proposed by legislators in the US state of Texas, for example, considers civil and criminal penalties for DNA theft and establishes a property right in one's own DNA7. The federal government too should step in by enacting and enforcing more restrictive standards that ensure privacy safeguards are in place through the US Food and Drug Administration. What prevents a person from finding out whether a romantic partner carries a gene for persistent miscarriage or male pattern baldness? What prevents someone's personal enemy from discovering and posting to the internet his or her victim's alleged genetic predisposition to alcoholism, obesity or criminality? What prevents a political party from discovering and publicizing the embarrassing health condition of a rival candidate? In the absence of more stringent regulation, the answer is nothing.