23andMe changes to terms of service are ‘cynical’ and ‘self-serving,’ lawyers say

Two days before 23andMe disclosed that hackers had accessed the personal and genetic data of almost 7 million customers, the genetic testing giant updated its terms of service. The changes are an effort to make it more difficult for the victims of the breach to band together in filing a legal claim against the company, according to lawyers who specialize in representing victims of data breaches and the arbitration process.

Three lawyers interviewed by TechCrunch called the changes in 23andMe’s terms of service with their customers “cynical,” “self-serving,” and “a desperate attempt” to protect itself and deter customers from exercising their legal rights following the massive breach of customer data.

The lawyers all agreed that the new changes are designed so that customers give up on the possibility of filing arbitration claims together — a process also known as mass arbitration or arbitration swarms — against 23andMe.

“This is some of the most pernicious and cynical attempts I’ve seen of ‘we’ve already made it hard for you to get to court. Now we’re gonna make even it harder for you to get to arbitration,’” Doug McNamara, a partner at the Cohen Milsten law firm, told TechCrunch in a phone call. “It screams a desperate attempt to dissuade and deter people from suing them, which if you’ve done nothing wrong, why do you have to do that?”

Contact Us

Do you have more information about the 23andMe incident? We’d love to hear from you. You can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or email lorenzo@techcrunch.com. You also can contact TechCrunch via SecureDrop.

In its previous terms of service, 23andMe already included a clause that forced customers to go through arbitration rather than “jury trials or class action lawsuits.”

Arbitration is essentially an alternative legal system to resolve disputes. As opposed to a lawsuit, arbitration is a private process that — in theory — is faster and more cost-efficient. But critics say that the forced arbitration process skews in favor of corporations, and research shows that customers are often unaware that they have given up their constitutional right to file a lawsuit when they accepted a company’s terms of service.

The new terms of service essentially forbids 23andMe customers from joining forces in this mandatory arbitration process, according to the lawyers TechCrunch spoke with. The lawyers pointed to a new section of the terms, which refers to an initial period in which customers have to first talk to 23andMe before filing an arbitration claim:

The Initial Dispute Resolution Period must include a conference between you and us to attempt to informally resolve any Dispute in good faith. You will personally appear at the conference telephonically or via videoconference; if you are represented by counsel, your counsel may participate in the conference, but you will also participate in the conference. The conference shall be individualized such that a separate conference must be held each time either party initiates a Dispute, even if the same law firm or group of law firms represents multiple users in similar cases, unless all parties agree; multiple individuals initiating a Dispute cannot participate in the same conference unless all parties agree.

In other words, according to the lawyers, 23andMe wants to avoid mass arbitration, a process that has already cost companies millions of dollars.

In 2022, a judge ruled that Uber had to pay $92 million in fees to the American Arbitration Association as a result of a mass arbitration demand against the ride-sharing company for allegedly discriminating against Black-owned restaurants in its food delivery service, Uber Eats. In the last few years, DoorDash and Amazon have had to fight mass arbitration demands, rather than individual ones. Amazon gave up on arbitration altogether after lawyers filed more than 75,000 arbitration demands on behalf of Echo users who alleged the devices recorded them without permission.

“Is it better for the consumer? No. Is it better for 23andMe? Yeah. It makes it much less likely they’ll face a mass arbitration and have to spend a lot of money to deal with these claims,” said McNamara, who described 23andMe’s strategy as an attempt to weaken its customers’ legal position. “It’s almost like ‘Let’s play ball. But I get to pick the umpires, I get to pick the field, I get to pick the number of innings, I get to pick the pitches that you’re allowed to throw, I get to pick your batter, and make it so that you can’t really hire any of the good batters to go to the plate for you.’”

Julia Duncan, the senior director of government affairs for the American Association of Justice, told TechCrunch that the other disadvantage of individual arbitration is that it is a confidential process, so consumers cannot learn from other people’s cases.

“It’s much easier to bury customers’ claims one by one by one, than facing millions of customers who have joined together to try to seek accountability from the same company. This is all about corporate leverage and power and the power to keep things secret,” Duncan, who has been outspoken against forced arbitration, said in a phone call.

Duncan also said that arbitration in general is more favorable to corporations.

“For most consumers and workers, forced arbitration and mass forced arbitration are tantamount to immunity for the corporations. These systems are rigged, inherently biased, and operate in secret,” said Duncan.

23andMe spokesperson Andy Kill said in an email that “the recent revisions to our terms of service provide more details and clarity around the arbitration process.” Kill added that the company “made changes that make arbitration more efficient for customers when multiple similar claims are filed, and provide more opportunities for disputes to be resolved without customers incurring the expense of litigation or arbitration.” Kill did not respond to a follow-up asking what were the changes that increase the efficiency of arbitration for customers.

The company also made a change that now compels customers to try to negotiate a dispute for 60 days before even filing an arbitration demand.

“They’re hoping that some people, who are very upset at initially hearing that their genetic data has been stolen, would give up within that 60-day window and never follow through and file in forced arbitration,” said Duncan. “They are hoping to make forced arbitration so burdensome and so difficult that most consumers don’t use it at all. And then they get away with never being held responsible.”

23andMe gave customers 30 days to reject the new terms of service. Confusingly, in the new terms of service, 23andMe wrote that customers who want to do that should email arbitrationoptout@23andme.com, but in the email sent to customers, the company wrote that the address to use is legal@23andme.com.

Two 23andMe customers told TechCrunch that they have emailed the company requesting to opt out from the recent terms of service changes, but they have not yet heard back.

Duncan said that even though the terms of service exclude class action lawsuits, victims should still file them, because “the way that 23andMe went about changing their forced arbitration provisions to make them even more burdensome for consumers should absolutely be evaluated in a court of law.”

Jules D’Alessandro, a lawyer based in Rhode Island, also said that if he were a victim, he “would jump into a class action suit or mass arbitration and let 23andMe try to convince a judge that I agreed to limit my involvement to an individual suit.”

And victims are already doing just that.

On November 13, a woman in Illinois filed a class action lawsuit against 23andMe. Last week, two law firms in Canada have also filed class action lawsuits together on behalf of Canadian victims of the breach. Sage Nematollahi, one of the lawyers working on the case, told Global News that “thousands” of victims have already reached out to the firm to join the lawsuit.