2013 was the year when the dream of DTC personal genome testing untrammeled by regulatory oversight finally was shattered. It was also the year when DTC genetics trailblazer 23andMe ran out of luck. It thumbed its nose at FDA and got a black eye. It gave the US regulator the cold shoulder for six months while launching a TV advertising campaign touting its “Personal Genetics Service” (PGS) for consumer health. And so the inevitable happened; in November, the company received an FDA warning letter demanding an immediate halt to testing “until such time as [the company] receives FDA marketing authorization for the device.” With the threat of injunctions and fines, 23andMe suspended its health advice services; it will still undertake genome analysis but only for genealogical purposes. Although the FDA action has sparked a firestorm of debate over the future of personal genetics companies, the practical question foremost in many minds is how will FDA enforce regulation across the entire risk spectrum of variants interpreted in a DTC genetics service?

23andMe is one of a dwindling number of companies offering consumers personal genetics information. For $99 and a sample of spit, the Mountain View, California, firm offers a genome scan and access to its interpretation tools over the web. Since starting its PGS in 2007, 23andMe has amassed 500,000 users; last May, CEO Anne Wojcicki announced an ambitious campaign to reach one million users by the end of 2013.

A 23andMe genome scan takes a matter of weeks, with samples run on an Illumina OmniExpress Plus Chip in a CLIA (Clinical Laboratory Improvement Amendments of 1988)-approved laboratory run by LabCorp. The chip probes 967,000 single-nucleotide polymorphisms and enables 23andMe to incorporate newly published findings from other laboratories into its models, allowing continuous updating of interpretations of particular disease risk.

Customers view their genome profiles on 23andMe's website, which displays information on 254 traits, including carrier status for mutations underlying inherited diseases, complex diseases, drug response, geographical ancestry and various other traits (e.g., ear wax, baldness, eye color, height, blood group and caffeine consumption). Detailed reports include easy-to-understand summaries of data as well as more technical information and a limited number of links to original research publications for those seeking to explore further.

For the handful of diseases where there are well-established risk variants (e.g., breast cancer, Alzheimer's and Parkinson's), the results are initially 'locked' from a user's view. Those wishing to access such results must click through a series of agreements with language to the effect that “these mutations cannot fully predict if you'll get the disease” or “the information may impact your relatives” or “you should probably talk to a genetic counselor.”

This process, however, takes only a matter of minutes. And the fact that 23andMe was offering information about an increasing number of highly penetrant variants seems to have set alarm bells ringing at the FDA. In its warning letter, the agency highlighted assessments for “BRCA-related genetic risk and drug responses (e.g., warfarin sensitivity, clopidogrel response and 5-fluorouracil toxicity)” because of the potential health consequences of false positives or false negatives. These risks, together with 23andMe's aggressive “marketing campaigns” and brushoff of communications with the agency, led FDA to reevaluate the PGS as a class III device under the Medical Devices Act, requiring the most stringent level of regulation—a premarket approval (PMA).

To comply, 23andMe has to undertake human trials in outside clinical laboratories—something that, with a $99 business model, is likely well beyond its means (or the means of any other DTC company for that matter). The FDA's letter is a particular setback because 23andMe already had submitted documentation for regulatory clearance of seven (undisclosed) genetic tests in its PGS under the less arduous 510(k) path.

A key question that arises from all this is, will the agency require PMAs to prove the validity of all 254 traits in 23andMe's PGS separately? This seems completely unworkable and also at odds with a risk-based regulatory framework. Furthermore, what happens if a new variant is reported in the literature and incorporated into a DTC trait interpretation? Does that test have to go through a PMA all over again?

We do know that FDA has stated that it has no intention of regulating the ability of consumers to access their own genomes. But other than a physician, any service or tool that offers to interpret medically relevant variants in the genome for a consumer potentially falls within the regulator's crosshairs.

Having flipped the DTC analysis sector from 'anything goes' to 'everything stop' in a single stroke, the FDA needs to clarify how it intends to attune the severity of regulatory oversight to the risk associated with a given DTC test.

The truth is, the genome is much less predictive of disease than most people think. Knowing your risk status points to genotype-specific clinical actions for only a handful of traits (BRCA1/2 is a notable exception). Many DTC predictions of risk for complex disease are just plain wrong. We don't understand the true scope of human genetic variation—known variation can explain only a fraction of the heritable component of disease; we don't understand how different genetic variants interact (epistasis) to affect disease risk; and we have little clue how to incorporate environmental, dietary, microbial and lifestyle factors into our risk models.

In that context, it makes no sense to force every DTC test through a resource-limited FDA. The agency needs to strike a balance between protecting consumers and allowing them to access and explore their genome information. If FDA elects to use just one hammer from its tool box, then everything is going to look like a nail—a nail in the coffin of the DTC genomics sector.