Many people have heard of the company 23andMe; hundreds of thousands throughout the world have used the company’s Personal Genome Service (PGS), which provides a report that offers detailed information about an individual’s DNA. For $99, a consumer receives a test-tube kit from the company, fills the tube with saliva and sends it back. The company then performs a DNA analysis and provides information about the person’s health risks, ancestry and other characteristics. The website says: “Reports on 240+ health conditions and traits. Discover your lineage, find relatives and more. Get updates on your DNA as science advances.”

On November 22, 2013, the FDA sent a warning letter to the company, stating that it was marketing the PGS without proper clearance or approval. The FDA is responsible for giving regulatory approval for devices as well as for drugs. The detailed letter sent to 23andMe reports a history of interactions going back several years, during which time the company repeatedly failed to comply with requirements specified by the regulatory agency. The FDA’s letter says:

[M]ore than 5 years after you began marketing, you still had not completed some of the studies and had not even started other studies necessary to support a marketing submission for the PGS.

The letter calls for 23andMe to discontinue marketing the PGS until it receives FDA marketing authorization.

What is at stake here? Two issues need to be distinguished. The first is the accuracy of the device, which the FDA claims falls within its mandate. The agency’s role, specified in the Federal Food, Drug and Cosmetic Act, is to ensure the safety of drugs and devices marketed to the public. Here is what the FDA said in its November 22 letter to 23andMe:

FDA is concerned about the public health consequences of inaccurate results from the PGS device; the main purpose of compliance with FDA’s regulatory requirements is to ensure that the tests work.

So that is the first issue: Does the PGS provide accurate results? Few people would object to a regulatory agency that requires evidence of the safety and efficacy of health-related products sold to the public.

But there is a second issue: what people do with the information provided by direct-to-consumer marketing. The FDA is acting well within its mandate in seeking to ensure the accuracy of the PGS. As an example, the letter to the company says: “If the BRCA-related risk assessment for breast or ovarian cancer reports a false positive, it could lead a patient to undergo prophylactic surgery, chemoprevention, intensive screening, or other morbidity-inducing actions, while a false negative could result in a failure to recognize an actual risk that may exist.” Here the agency expresses concern about what people who receive information will do with that information, possibly making medical decisions without proper consultation with doctors. As long as the PGS device could provide inaccurate results, the FDA is on firm ground with these concerns.

But what if corrective actions are taken and the company finally complies with the FDA marketing requirements? Some remarks in the FDA’s letter to 23andMe suggest that even if a device is accurate, risks still may exist with direct-to-consumer diagnostic kits. The letter mentions “the risk that a direct-to-consumer test result may be used by a patient to self-manage” and states that “serious concerns are raised if test results are not adequately understood by patients.” Quite properly, the FDA’s main concern lies with what it has determined to be the company’s failure to comply with FDA requirements for ensuring the accuracy of test kits. But that is where the role of a regulatory agency should stop. Direct-to-consumer marketing of diagnostic products — even when FDA approved — may carry risks because of what people decide to do with the information. In most areas of life, people are free to take health-related risks, with appropriate warning but without governmental prohibition. The same should be true of personal DNA information, which properly belongs to the individual.

Developments that have occurred after the FDA’s November 22 letter indicate that this is a case to watch, as it may have broader implications for direct-to-consumer diagnostic kits. 23andMe has stopped providing health results to people who purchased the kits after the FDA’s letter to the company. Days later, a class-action suit was filed in California against the company for false and misleading advertising. Among other charges, the lawsuit alleges that 23andMe markets the information it collects from DNA tests “to other sources and the scientific community in general, even though the test results are meaningless.”

Whatever the outcome of the lawsuit, the FDA’s action and people’s eagerness to obtain their genomic information indicate the need for public education. Except for specialists in human genetics, even many doctors lack sufficient training to interpret the results of genetic tests. Since virtually all genetic predictions about future disease are probabilistic, consumers need to exercise caution when drawing conclusions regarding worst-case scenarios.

The question arises: whose obligation is it to develop and provide proper consumer education about genetic tests?

Ruth Macklin is a professor, department of epidemiology and population health, Albert Einstein College of Medicine. She blogs at The Doctor’s Tablet.