A new era in commercial, personalized genomics was heralded when several companies in the United States, including 23andMe, deCODEme, SeqWright and Navigenics, began offering 'direct-to-consumer' genomic testing [1]. Some companies test genetic risk for specific diseases, for example Smart Genetics' service for Alzheimer's disease. Other companies offer advice on the basis of genetic risk factors and then provide nutritional and other supplements. Early adopters, including some journalists who reported on their own experiences getting these tests, favorably described 'discovering' risk factors that they should be concerned about and the feeling of relief about being unaffected by other factors [2–4]. One author discussed his family history of heart disease and the realization, thanks to 23andMe, that his genes made him less likely than average to have heart disease [2]. But was his interpretation of the test results correct? Family history captures information about inherited risks in a particular family, whereas genome-wide association studies identify population averages and thus generally give a less accurate assessment of risk than is given by family history. How personal are personal genomics tests, and is the validity of these tests good enough for them to be ready for general use by consumers to inform medical decisions? And, given the complexity of genomic information and the potential for misinterpretation, how, if at all, should this kind of direct-to-consumer testing be regulated?

Federal regulation of genetic tests in the US is minimal, being largely confined to approval by the Food and Drug Administration (FDA) of test kits and very complex multi-gene indicators, as well as quality control of laboratories performing tests that are used "to assess patient health and inform medical decisions" through the Clinical Laboratory Improvement Amendments (CLIA). Proficiency testing required by CLIA does not include standards specific to DNA-based genetic tests [5, 6]. Most laboratory tests, as opposed to home-testing kits (for HIV or pregnancy, for example), are not specifically regulated.

The Secretary's Advisory Committee on Genetics, Health & Society, which advises the US Department of Health and Human Services, has identified significant gaps in the oversight and enforcement of genetic testing, especially nutrigenomic and direct-to-consumer tests [6]. Some state agencies have stepped into the gap, including California and New York. The California Department of Public Health recently sent 'cease and desist' letters to 13 genetic testing companies to prevent the sale of personal genomics tests to state residents [7]. New York sent similar letters to 23 firms in spring 2008 [8]. The California Department insists that these companies comply with state law that requires a license to perform clinical laboratory tests and prohibits offering genetic tests directly to consumers without a physician's order. California state law addresses genetic testing to ensure that test results are accurate and valid and offered only with sufficient medical oversight to avoid unnecessary harm. The Department seems to be well within the bounds of its statutory authority, as personal genomics services clearly fit the statutory definitions of a genetic test.

The companies who received the letters from the California Department of Public Health have offered at least three arguments in their public responses. The arguments range, in our opinion, from weak to indefensible. One argument is that genetic information is "a fundamental part of you" and that people have a right to it. This is fair enough; but the same argument could apply to any test about someone's body. Clinical tests are regulated for a reason: the information that they provide is not worth having if it is not accurate and valid, which is why licenses are required for those who provide it. People may indeed have a right to their genetic information, but it does not follow that we should not regulate the process to make sure that information is appropriately provided.

A second argument used is that this testing is not really medical. According to a quote in the New York Times from Mari Baker, Navigenics' chief executive: "It doesn't say you have a disease... It says you carry a genetic predisposition for the disease and should talk with a health care professional" [7]. If that is true, cholesterol tests, lipid panels and glucose tests are not 'medical testing' either, because they merely measure risk factors, not actual disease. Moreover, the marketing of personal genomics tests makes it clear that it is precisely the health (and therefore medical) value of the information that drives demand. Not all of the information provided by these companies is medical, but as long as even some of it is, the law pertains. Mari Baker's point that her clients should talk to a health professional [7] represents the very reason that California and New York passed their laws, except that the laws mandate professional engagement from the start, not after the test has already been done.

A third argument put forward by the testing companies is that patients deserve direct access to their health information without a physician intermediary. Some of the companies clearly have no physician involved in ordering the tests. At least one company claims to be in compliance with the law because a company physician reviews all customer orders. This response is clearly not sufficient. The point of the law is to ensure that each patient (or customer) has a physician looking after their interests when ordering medical tests, to advise on the need for, interpretation of, and clinical follow-up after the tests. A physician working for a company selling the tests is clearly not well situated to look after a patient's best interest.

One of the problems with offering genome-wide data is that most of the growing information derived from association studies has very little predictive power. Typical odds ratios found in genome-wide association studies are less than 1.5 [9]. A 50% increased risk may sound like a lot until you realize how low the starting odds usually are. The combined effect of all 20 genetic variants associated with adult height in a recent study explained only 3% of height variation [10]. Another variant increased the risk of coronary artery disease from 1% to 1.6% [11–13]. The reporter who thinks his genes do not predispose him to heart disease has failed to understand how little these tests tell him [14]. To make matters more confusing, personal genomics could predict risks of very weak genetic associations while leaving out powerful predictive mutations. Genetic tests for well understood heritable diseases can detect powerful causal effects (for example, some inherited breast cancer genes that account for 5% of breast cancer in younger women). But these are not the tests offered through personal genomics services. In rare high-risk families, tests for specific mutations are needed. Personal genomics services in such families are likely to be downright misleading.

Until there is federal regulation or oversight, the California and New York states are right to create standards to protect their citizens from the risks of medical testing. Initial experience of individuals, as exemplified by reporters' experiences with current-generation personal genomics services, makes it clear that the information is likely to be misunderstood without the direct guidance of a physician. And they might not get much help even there. Most physicians know little about the studies that the new personal genomics services use to make their predictions; a lot more education of the medical community therefore also needs to take place.

Regulation of genetic tests must take into account the challenges of predicting complex traits. The FDA is seeking to address concerns about the difficulty of validating some highly complex genetic tests whose results are not transparent to clinicians. The FDA issued guidance on in vitro diagnostic multivariate index assays (IVDMIAs) that are "based on observed correlations between multivariate data and clinical outcome" [15]. There is only a thin line between those tests, over which FDA has asserted jurisdiction, and the personal genomics services being offered directly to consumers. FDA has defined an IVDMIA as: "a device that: (1) Combines the values of multiple variables using an interpretation function to yield a single, patient-specific result (e.g., a 'classification,' 'score,' 'index,' etc.), that is intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment or prevention of disease, and (2) Provides a result whose derivation is non-transparent and cannot be independently derived or verified by the end user" [15]. Personal genomics services do not produce a single index number. Instead they provide hundreds of thousands of data points and hundreds of risk evaluations. Which is more confusing, more prone to misinterpretation or more in need of professional interpretation?

The advent of personal genomics testing will not cleanly fit the regulatory model for Mendelian genetic tests, nor perhaps even the regulatory model for medical tests generally. We must move beyond a purely medical model to truly evaluate the risks and benefits. Clearly these tests are being marketed not only for health risk information but also for genealogy, studying ancestry and as tools for social networking. Some information might be used for forensic purposes. To maximize the benefits and minimize the harms of whole-genome analysis, we need to view this technology in a much broader way. Yet although the standard medical model might not prove to be the way in which we ultimately choose to regulate and monitor these services, it is what we have, and it is where we will start. New York and California have state laws that govern medical tests, and the health information in personal genomics services meets their definitions. It would surely be better to develop a coherent national framework suited to the full range of information coming from these services. Indeed, a unified international framework is necessary, given easy access to these services across borders via the internet. However, we will not get the ideal regulatory system by pretending this is not medical information or hoping that oversight and regulation are unnecessary.