If Your DNA Trains an AI That Finds a Blockbuster Drug, Who Gets Paid?

The spit tube, the server farm and the missing receipt#

Somewhere in a data centre there is a copy of your genome, or of someone very like you. Maybe you sent a saliva sample to a consumer testing company to learn whether you are 4% Viking. Maybe you gave blood to a hospital study twenty years ago and forgot all about it. Either way, the string of letters that makes you biologically you may now be helping to train software that hunts for new medicines.

Suppose that software finds a target, and the target becomes a drug that sells a billion dollars a year. It is a reasonable thing to imagine. Drug programmes backed by human genetic evidence are about 2.6 times more likely to succeed in clinical trials than those without it, according to an analysis of thousands of development programmes (Minikel et al., 2024). That is why genetic data has become one of the most commercially valuable raw materials in biomedicine.

So who owns your DNA at that point? The awkward answer is that, in most legal systems, nobody owns it in the way you own a bicycle. What you usually have instead is a bundle of narrower rights: to give or withdraw consent, to have your data protected, and sometimes to be asked again. Whether that bundle is enough now that AI models can absorb millions of genomes at once is the question this article tries to answer.

Background: the words you need before the argument starts#

A few terms come up again and again, so it is worth pinning them down.

Genetic data is information about the DNA you inherited. It can be a full genome (all roughly three billion letters), an exome (the small fraction that codes for proteins), or a cheaper "genotype" that reads a few hundred thousand known variable spots. Consumer testing firms mostly use genotyping. Large research projects increasingly sequence whole genomes.

Genomic data is the broader term for DNA sequence information from any organism, from people to soil bacteria. When governments talk about plants, animals and microbes, they often use the phrase digital sequence information, or DSI, to describe sequence data stored in databases rather than in physical samples.

A biobank is a long-term collection of biological samples and linked health records, held for research. De-identification means stripping out names, addresses and dates of birth. It is not the same as anonymisation, which in European law means that a person can no longer be identified by any reasonably likely means.

A genomic language model is an AI system trained on DNA sequences in the way a chatbot is trained on text. It learns statistical patterns in the letters A, C, G and T, and can then predict which mutations are likely to be harmful or even propose new sequences. Evo 2, published in Nature this year, was trained on more than 9.3 trillion DNA letters drawn from over 128,000 genomes across the tree of life, and its developers released the weights and training data openly (Brixi et al., 2026; Arc Institute).

Finally, benefit sharing is the principle that people or communities who provide biological resources should get something back when those resources generate value. It sounds simple. It is not.

What the courts have actually said about owning your cells and genes#

The legal story starts with a man named John Moore. In the 1970s, doctors at the University of California treated him for hairy cell leukaemia and, without telling him, developed a patented cell line from his tissue. In 1990 the California Supreme Court ruled that Moore had no property claim over his discarded cells. It did, however, let him sue for breach of fiduciary duty and lack of informed consent, because his doctor had not disclosed his financial interest (Moore v. Regents of the University of California, 1990).

That split has shaped the field ever since. You may not own the material, but you are owed honesty about how it is used.

The case of Henrietta Lacks pushed the same tension into public view. In 1951 doctors at Johns Hopkins took cells from her cervical tumour without her knowledge. Those HeLa cells went on to support research on polio and COVID-19 vaccines and on the human genome itself. In 2023 her estate settled a lawsuit against Thermo Fisher Scientific, which it accused of profiting from the cells; the terms are confidential (NPR via WHYY, 2023). Notably, the claim was about unjust enrichment from a known wrong, not a declaration that the family owned the cells.

Patents add another layer. In 2013 the US Supreme Court held that naturally occurring DNA segments cannot be patented just because someone isolated them, although synthetic copies made in a laboratory can be (Association for Molecular Pathology v. Myriad Genetics, 2013). So neither you nor a company can patent your raw genome. But a company can patent a drug, a diagnostic test or an engineered molecule that your genome helped reveal, and that patent is where the money sits.

In Europe the frame is data protection rather than property. The General Data Protection Regulation lists genetic data as a "special category" of personal data that can only be processed under strict conditions, such as explicit consent or approved scientific research (GDPR, Article 9). The UK retains the same structure. That gives you strong rights over how your data is handled, but no royalty if it leads to a product.

When a DNA company goes bust: the 23andMe test case#

If you wanted a live experiment in what happens to genetic data when the business model fails, 23andMe supplied one.

The company had long seen its database as a drug-discovery engine. In 2018 GSK invested $300 million in 23andMe as part of a collaboration to find drug targets using customer data (CNBC, 2018). Then came a 2023 credential-stuffing attack, in which hackers reused leaked passwords to get into accounts. The UK Information Commissioner's Office later fined the company £2.31 million, finding that the breach affected 155,592 UK residents (ICO, 2025).

In March 2025 the company filed for bankruptcy, and its biggest asset was the genetic data of more than 15 million customers, about 80% of whom had agreed to research use. Regeneron Pharmaceuticals won the first auction with a $256 million bid. After more than two dozen US states sued, bidding reopened, and a judge approved a $305 million sale to TTAM Research Institute, a non-profit led by co-founder Anne Wojcicki (KPBS/NPR, 2025).

Customers had one real lever: deletion. By June 2025, 1.9 million people had asked the company to delete their data, according to testimony to the House Oversight Committee (STAT, 2025). That is roughly one customer in eight walking away. The other seven, presumably, either trusted the new owner or never read the email.

What the episode showed is that consent given to one company can travel with the database when it is sold. The lesson has not gone unnoticed. In 2026 several class actions were filed against Tempus AI after its acquisition of the genetic testing firm Ambry Genetics, alleging that genetic test results were used and shared for commercial work without the written authorisation some state laws require. South Dakota and Utah passed new genetic privacy laws early this year, and other states have bills in progress (Crowell & Moring, 2026). These are allegations, not findings, but they show where the legal pressure is heading.

The chart below puts the main price tags side by side.

How AI changes the ownership problem#

Before machine learning, a researcher who used your data produced a paper, a statistic or a gene name. Once the work was done, your record sat in the database where it began. AI models complicate that picture in two ways.

First, a trained model is a new object built partly out of your information. Its weights, the millions or billions of numbers it adjusts during training, are not your genome. But they are not entirely separate from it either. Researchers have shown that machine-learning models trained on genomic data can be vulnerable to membership inference attacks, where an adversary works out whether a specific person's record was in the training set (Chen et al., 2021). A 2025 review warns that model inversion and membership inference remain open weaknesses even as tools such as differential privacy (adding mathematical noise) and federated learning (training without moving the data) improve (Annan et al., 2025).

European regulators have taken this seriously. In December 2024 the European Data Protection Board issued an opinion on AI models and personal data, concluding that a model trained on personal data cannot automatically be treated as anonymous; that has to be shown case by case (EDPB Opinion 28/2024). If a model is not anonymous, data protection rights may follow your data into it.

Second, DNA is shared. Your genome overlaps heavily with those of your parents, siblings and cousins. A 2018 study estimated that about 60% of Americans of European descent could already be identified through a third or more distant cousin in a consumer genealogy database, even if they had never been tested themselves (Erlich et al., 2018). Consent, by contrast, is individual. When you agree to let a model learn from your genome, you are also letting it learn a little about relatives who never agreed to anything.

That mismatch is why "ownership" may be the wrong word. A better question might be: who has a say, and who has a stake?

Biobanks, pharma consortia and the public-interest bargain#

Large public biobanks offer a different model from consumer companies, and the UK is home to the most influential one.

UK Biobank released whole-genome sequences for 491,554 participants after a £200 million programme. The money came from Wellcome, UK Research and Innovation and four drug companies, Amgen, AstraZeneca, GSK and Johnson & Johnson, each of which put in £25 million. In return, the industry partners got nine months of exclusive access before the data opened to approved researchers worldwide, including commercial ones, working on health research in the public interest (Wellcome Sanger Institute).

The bargain is explicit. Participants volunteer, data are de-identified, access is controlled through a secure cloud platform, and the public gets research it could not otherwise fund. Nobody receives royalties. Supporters argue this is how it should be, because paying individual donors could distort consent and turn health research into a marketplace. Critics reply that "public interest" is stretched when exclusive early access goes to the firms that paid for it.

Here is how the main models compare.

Benefit sharing grows up: from Havasupai to the Cali Fund#

Benefit sharing became urgent because of what happens when it is ignored. Members of the Havasupai Tribe in Arizona gave blood samples for diabetes research and later found they had been used for studies on schizophrenia, inbreeding and migration they had not agreed to. In 2010 Arizona State University's governing board settled for $700,000 and returned the samples (PRI, 2010).

Newer approaches try to build the deal in from the start. Variant Bio, a US genomics company, funded two projects in South Africa in which 10% of the project budget went to organisations chosen by community representatives rather than by researchers. The company has also pledged to distribute 4% of its 2025 revenue across eligible projects and partners, and the partnership is described in Nature Communications (Wits University, 2026; Ngwarai et al., 2026). It is a small company, and the pledge is voluntary. Still, it shows that a revenue share is something a company can write into its business plan.

At the global level, the Convention on Biological Diversity agreed in 2024 to create the Cali Fund. Large companies that use digital sequence information, in sectors such as pharmaceuticals, agricultural biotech and cosmetics, are asked to contribute an indicative 1% of profits or 0.1% of revenue. Where national circumstances allow, at least half the money should support Indigenous peoples and local communities, and public and academic researchers are exempt (CBD Decision 16/2). A June 2026 analysis from the LSE's Grantham Institute estimated the fund could raise between about $929 million and $3.6 billion a year, depending on uptake, and noted that participation remains voluntary with the rules open for revision at COP17 in October 2026 (Grantham Research Institute, 2026).

The Cali Fund mainly covers non-human biodiversity, and human genetic data sits largely outside it. But it matters here because it is the first serious attempt to attach a payment to sequence data rather than to physical samples, which is exactly the shift AI has forced. A model like Evo 2 never touches a test tube. It learns from files.

So what would a fair deal look like?#

There is no settled answer, and anyone who says otherwise is selling something. But the evidence points to a few principles that are hard to argue with.

Consent should survive a sale, or fall away with it. The 23andMe sale and the Tempus lawsuits suggest that people expect to be asked again when their data changes hands, and state legislatures increasingly agree.

Transparency should cover AI training specifically. "Research" in a 2012 consent form did not obviously mean training a foundation model that could be licensed to dozens of companies. Being told plainly is the minimum Moore's court required in 1990, and it still applies.

Value can flow back to groups even if it does not flow to individuals. Paying each donor a few pence would be messy and could cheapen consent. Funding clinics, training or local research, chosen by the communities themselves, is what the Variant Bio and Cali Fund models are attempting.

Privacy needs engineering as well as law. If models can leak information about their training data, then techniques such as differential privacy and federated learning become part of the ethical bargain, not optional extras.

None of this gives you ownership of your DNA in the bicycle sense. It does give you something that may matter more: a say over where your data goes, and a credible chance that the people it helps include the people it came from.

Frequently asked questions#

Do I legally own my DNA? In most jurisdictions, no. Courts such as the California Supreme Court in Moore have declined to treat cells as personal property, and naturally occurring genes cannot be patented in the US. What you do have are rights over consent and, in the UK and EU, strong data protection rights over genetic data.

Can a company sell my genetic data if it goes bankrupt? It can try, and 23andMe's database was sold for $305 million in 2025 under court supervision. Its privacy policy and state attorneys general shaped the terms, and customers could delete their data before the transfer.

Does deleting my account remove my data from an AI model? Not necessarily. Deletion removes your record from the database, but a model already trained on it is not automatically retrained. European regulators say such models are not automatically anonymous, so rights may still apply, but practical "unlearning" is still a research problem.

Would I get paid if my data led to a blockbuster drug? Almost certainly not as an individual. Current consent forms rarely promise royalties. Some newer models share value with communities instead, such as Variant Bio's pledged revenue share or the Cali Fund for sequence data.

Is UK Biobank data used by drug companies? Yes. Approved commercial researchers can access de-identified data for health research in the public interest, and four pharmaceutical firms that co-funded genome sequencing had a period of early exclusive access.

Can my relatives' DNA tests identify me? Quite possibly. A 2018 study estimated that around 60% of Americans of European descent could be identified through a distant relative in a genealogy database, even without being tested themselves.

What is digital sequence information? It is genetic sequence data held in databases rather than in physical samples. International biodiversity talks use the term to decide when companies that profit from such data should share benefits.

References#

1. Minikel, E. V. et al. (2024). Refining the impact of genetic evidence on clinical success. Nature. https://doi.org/10.1038/s41586-024-07316-0
2. Brixi, G. et al. (2026). Genome modeling and design across all domains of life with Evo 2. Nature. https://doi.org/10.1038/s41586-026-10176-5
3. Arc Institute. AI can now model and design the genetic code for all domains of life with Evo 2. https://arcinstitute.org/news/evo2
4. Moore v. Regents of the University of California, 51 Cal. 3d 120 (1990). https://scocal.stanford.edu/opinion/moore-v-regents-university-california-31115
5. NPR via WHYY (2023). Henrietta Lacks' descendants reach a settlement over the use of her "stolen" cells. https://whyy.org/npr-story/henrietta-lacks-descendants-settlement-stolen-cells/
6. Association for Molecular Pathology v. Myriad Genetics, Inc., 569 U.S. 576 (2013). https://supreme.justia.com/cases/federal/us/569/576/
7. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 9. https://eur-lex.europa.eu/eli/reg/2016/679/oj
8. CNBC (2018). GlaxoSmithKline, 23andMe team up on genetics-driven drug research. https://www.cnbc.com/2018/07/24/glaxosmithkline-23andme-team-up-on-genetics-driven-drug-research.html
9. Information Commissioner's Office (2025). ICO fines 23andMe £2.31 million for failing to protect UK users' genetic data. https://ico-newsroom.prgloo.com/news/ico-fines-23andme-gbp-2-31-million-for-failing-to-protect-uk-users-genetic-data
10. KPBS/NPR (2025). Judge OKs sale of 23andMe and its trove of DNA data to a nonprofit led by its founder. https://www.kpbs.org/news/science-technology/2025/06/30/judge-oks-sale-of-23andme-and-its-trove-of-dna-data-to-a-nonprofit-led-by-its-founder
11. STAT (2025). 23andMe leaders grilled on genetic data risks by federal lawmakers. https://www.statnews.com/2025/06/10/23andme-leaders-grilled-on-genetic-data-risks-by-federal-lawmakers/
12. Crowell & Moring (2026). Genetic data and artificial intelligence training following acquisitions: emerging litigation risk and a rapidly expanding state regulatory landscape. https://www.crowell.com/en/insights/client-alerts/genetic-data-and-artificial-intelligence-training-following-acquisitions-emerging-litigation-risk-and-a-rapidly-expanding-state-regulatory-landscape
13. GeekWire (2025). Seattle genomics startup Variant Bio signs deal with Novo Nordisk worth up to $50M. https://www.geekwire.com/2025/seattle-genomics-startup-variant-bio-signs-deal-with-novo-nordisk-worth-up-to-50m/
14. Chen, J., Wang, W. H. & Shi, X. (2021). Differential privacy protection against membership inference attack on machine learning for genomic data. Pacific Symposium on Biocomputing, 26, 26 to 37. https://pubmed.ncbi.nlm.nih.gov/33691001/
15. Annan, R. et al. (2025). Genomic privacy and security in the era of artificial intelligence and quantum computing. Discover Computing, 28, 108. https://doi.org/10.1007/s10791-025-09627-w
16. European Data Protection Board (2024). Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models. https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en
17. Erlich, Y. et al. (2018). Identity inference of genomic data using long-range familial searches. Science, 362, 690 to 694. https://doi.org/10.1126/science.aau4832
18. Wellcome Sanger Institute. World's largest genetic project opens the door to new era for treatments and cures: UK Biobank's major milestone. https://www.sanger.ac.uk/news_item/worlds-largest-genetic-project-opens-the-door-to-new-era-for-treatments-and-cures-uk-biobanks-major-milestone/
19. PRI (2010). Settlement with Havasupai tribe means $700,000 for unauthorized use of DNA. https://www.pri.org/stories/2010-04-22/settlement-havasupai-tribe-means-700000-unauthorized-use-dna
20. University of the Witwatersrand (2026). Academic-industry partnership co-creates a new model for sharing the benefits of genomic research. https://www.wits.ac.za/news/latest-news/research-news/2026/2026-04/academic-industry-partnership-co-creates-a-new-model-for-sharing-the-benefits-of-genomic-research.html
21. Ngwarai, N. et al. (2026). From urban NPOs to rural knowledge networks: applying benefit-sharing models to African genomics research. Nature Communications. https://www.nature.com/articles/s41467-026-69674-9
22. Convention on Biological Diversity (2024). Decision 16/2: Digital sequence information on genetic resources. https://www.cbd.int/doc/decisions/cop-16/cop-16-dec-02-en.pdf
23. Grantham Research Institute on Climate Change and the Environment, LSE (2026). From global biodiversity commitments to local action: revenue potential and allocation dynamics of the Cali Fund (working paper; not peer reviewed). https://www.lse.ac.uk/granthaminstitute/publication/from-global-biodiversity-commitments-to-local-action-revenue-potential-and-allocation-dynamics-of-the-cali-fund/