Late last month, US regulators dropped a bombshell on the genetic-testing start-up 23andMe in an exasperated cease-and-desist letter that prompted a fast and contrite response from the company — and a flurry of criticism of both parties among scientists and self-styled Health 2.0 activists who advocate the use of Internet tools in medicine.

Since 2007, 23andMe, which is based in Mountain View, California, has been testing customers’ DNA for a range of traits, from the frivolous, such as earwax type, to the more significant, such as disease risk and genetic ancestry. The company has walked a fine line between promising that this activity will revolutionize medicine and averring that it is not actually medical at all, in an attempt to simultaneously lure in customers and avoid the need to conform to medical regulations.

The US Food and Drug Administration (FDA) has now called 23andMe’s bluff, complaining that the company has “not completed” some studies that would prove the soundness of its methods and “not even started” others; that 23andMe has shunned communication with the FDA since May; and that the company has launched a large advertising campaign without getting marketing approval. The agency demanded that 23andMe stop marketing its testing kit until it received proper authorization.

The episode has been interpreted as everything from a massive regulatory overreach that threatens to quash innovation, to a long-needed dose of supervision for a dangerously out-of-control industry.

But the big question is not whether regulators will stop people from understanding their own DNA — they cannot. The question is whether such understanding has reached the point at which companies can exploit it, and if so, how to protect their customers. Part of answering that question is determining whether a company’s claim is true. This is what the FDA is trying to do, and until earlier this year, it seemed that 23andMe was happy to aid that mission — FDA approval, after all, would dispel worrying chatter about whether regulators would ultimately shut the company down. Mainstream biotechnology companies learned a long time ago that it pays to play nice with regulators.

It is unclear whether 23andMe’s six-month lapse in communication with the FDA stems from inexperience with regulatory procedures, or from a hope that it could quickly grow its customer base large enough to monetize in other ways. The problem with the latter strategy is that direct-to-consumer medical genetic testing is not yet a viable business model.

Direct-to-consumer medical genetic testing is not yet a viable business model.

The company’s chief executive, Anne Wojcicki, told a conference at Stanford University in California in May that 23andMe hoped to amass 1 million customers by the end of this year, but the company still has only half that number. And other firms in the market have not succeeded: last year, Navigenics of Foster City, California, was acquired by biotech firm Life Technologies and stopped offering consumer testing, and deCODEme of Reykjavik shut down.

Consumer demand is low in part because genetic tests on healthy people still cannot be relied on to produce consistent predictions about medical risks. Customers of 23andMe have detailed how the service variously provides lifesaving information and misleading results. This is simply the state of the science today. Silicon Valley ‘health disrupters’ who plan to revolutionize health care, such as Wojcicki and her estranged husband, Google co-founder Sergey Brin, like to think that they can apply their successful data-mining strategies to medicine, but it turns out that biology is more complicated than they perhaps first assumed.

No one should be fooled into thinking that direct-to-consumer genetic testing is doomed to fail. The science is moving so much faster than medical education that motivated and self-taught laypersons can learn and understand just as much about their genetic medical risks as can their doctors. Indeed, there are already public crowd-sourced tools that customers can use to interpret their genetic data for free. So even if regulators or doctors want to, they will not be able to stand between ordinary people and their DNA for very long.

In the meantime, it seems short-sighted for companies to rebuff regulators. If it is too onerous to prove the accuracy of the information they offer, they should not be selling this information in the first place. And if they turn up their noses at regulators, they may run afoul of an even more powerful force: the US system of civil litigation. Consumers are already joining class-action lawsuits alleging that 23andMe is selling misleading information. Such suits are much more effective than anything the government can do to get companies to change their practices.

To its credit, 23andMe seems to have learned this: on 26 November, Wojcicki acknowledged in a blog post both that the “FDA needs to be convinced of the quality of our data” and that “we are behind schedule with our responses” to the agency. The company has also stopped marketing.

It seems, then, that 23andMe’s experience with the FDA is less about the growing pains of a new industry than about affirming a principle — the need for truth in advertising — that is as old as business itself.