Privacy Researcher at Consumer Reports
This post shares some background on the challenges of testing direct to consumer DNA products, and how we met these challenges.
One of the quandaries of privacy testing is that the process of testing often requires the tester to sacrifice privacy in order to run the test. This conundrum cannot always be ethically solved by creating a fake account — or even a fake persona — to use while testing. In any scenario where there is the possibility of interacting with an actual human as part of the research, the testing team needs to be extremely conservative: if there is even a remote chance that an innocent, uninvolved person could have a negative experience as the result of encountering a test process, the test process can’t move forward. Even if the people running the test are fully convinced of the good intentions of the research, good intentions aren’t adequate justification for a dubious test process.
In many testing scenarios, the risk of affecting a human during testing can be mitigated by a strict “no interactions” rule. The test account goes in, creates a profile (if needed) with minimal info, doesn’t make any comments, doesn’t respond to any comments, and only interacts with areas of the site where they can operate independently of other people. While these rules limit the scope of what we can observe during testing, they also help maintain the ethical constraints required to test well.
But to state the obvious, running tests on direct to consumer DNA kits requires a DNA sample — or, more precisely, requires the purchase and return of a DNA kit. Our options here included having a human send in their DNA sample, sending the kits back with no sample, or sending in a non-human DNA sample to see what happened.
We briefly considered sending in human DNA, but then rejected that possibility. We also considered sending in a blank kit, but then one of my dogs — Door, a rescue hound who found us a few years ago — reminded me that she loves treats, and will drool profusely when offered a treat, or dinner, or breakfast, or really, anything edible or close to edible.
So, we requested that Door sit, and then placed a large bowl between her feet, under her jowls. With the drool capture bowl in place, we showed Door a piece of cheese and let the magic happen. After about 30 seconds, we had more than enough dog spit, and Door had been a very good pup for a very long time, and cheese was administered.
To be clear, all companies reported that they could not process the sample, which is a good baseline test. Our requirements for testing largely stopped with the purchase and return of a DNA kit, so with Door’s help the project could move forward without compromising anyone’s privacy.