In 1884, at the International Health Exhibition in South Kensington, four million punters came to view the latest scientific marvels: drainage systems, flushing toilets and electrically illuminated fountains. There, the scientist Francis Galton set up the Anthropometric Laboratory, where common folk would pay 3d (around 80p today) to enter, and anonymously fill out a data card. Galton’s technicians recorded 11 metrics, including height, hair colour, keenness of sight, punch strength and colour perception, and the ability to hear high-pitched noises, tested via whistlesmade by Messrs Tisley & Co, Brompton Road. Over the course of a week, 9,337 people went home with some trivial information about themselves, and Galton amassed the largest dataset of human characteristics ever compiled up to that time – and a stack of cash.

There is nothing new under the sun. In the past decade, millions of punters have parted with their cash and a vial of saliva, and in exchange they received some information about their DNA. Our genomes are a treasure trove of biological data, and an industry has sprung up to sell products based on our newfound ability to quickly and cheaply read and interpret DNA.

The biggest of these companies is 23andMe: five million paying customers since 2006, usually nosing for clues about their ancestry. Unlike most genetic genealogy companies, 23andMe also offers health-related information, on traits such as eye colour, predisposition to a handful of diseases, and the tendency to puke when drinking alcohol.

As with Galton’s scheme, 23andMe was never interested in your personal history or your eyes. What it wants is to own and curate the biggest biological dataset in the world. So it was no surprise when the company announced a $300m (£233m) deal with pharmaceutical mammoth GlaxoSmithKline last month to develop drugs based on the data you paid to give them. This is not illegal in any way. 23andMe told users that it was planning to do this, and in 2015 had done something similar, but on a smaller scale, concerning Parkinson’s disease. The new deal is the biggest commercial venture of its sort so far.

This is all unknown territory, and warrants serious thought by regulators as well as by customers. 23andMe is unambiguous about its plans: board member Patrick Chung told Fast Company in 2013: “Once you have the data, [the company] does actually become the Google of personalised healthcare.” Genomes can be mined for subtleties that only become visible with such voluminous data. I’ve little doubt that interesting science will emerge from this, and new drugs may well be developed to treat awful diseases. I also have no doubt that these drugs will be sold back to you.

By buying into 23andMe you are not a consumer or user, you are in fact the product. Again, 23andMe was explicit about this, and gave all its customers the option of not giving up their genomic data to commercial ventures beyond their control. But of the five million people on its database, more than four million did not opt out, and their data is now fair game. By tinkering with some fun ancestry trinkets, you relinquish control over information that is unique to you, and allow it to become a commodity to be traded.

The concerns this raises are similar to many of those created by our new online lives: privacy, data breaches, security, anonymisation. It hasn’t happened yet, but can genome data held by private companies be stolen, or de-anonymised? Concerns about the potential discriminatory use of personal genomics by insurance companies are well founded. There’s no clear pattern of how insurers will or can use information from genetic tests in assessing life cover, but at least in the US, they are entitled to demand medical records, including details of inherited predispositions to particular diseases.

Can information in these databases be subpoenaed? Earlier this year, an open-access genealogy database was used to solve a series of decades-old crimes. The prolific American murderer and rapist known as the Golden State Killer was identified after a genetic profile from a 1980 crime scene was uploaded to a website called GEDmatch. Amateur sleuths constructed a family tree that within a few days identified 72-year-old former police officer Joseph James DeAngelo, whose identity was confirmed by secret collection of DNA samples from his rubbish and the door handle of his car. The outcome may represent justice long overdue, but the methods represent an ethical minefield.

In short: if you really want to spend your cash to discover that you are descended from Vikings (spoiler: if you have European ancestry, you are) or you have blue eyes (try a mirror), go ahead. But be aware of what you are really giving up, and consider the potential risks if things go wrong.

Twenty-five years ago, the fictional potential of DNA was revealed to the world in Jurassic Park. Resurrected dinosaurs are never going to happen – DNA is robust, but only over hundreds, thousands, or hundreds of thousands of years at the very most, not the 66m required for a sample of dinosaur genome. In reality, the wonders of modern genetics continue to transform science and society in unpredictable ways. But the moral core of those films – Dr Ian Malcolm, played by Jeff Goldblum – can still teach us something. He is cynical and refuses to be bewitched by the spectacle.

“Don’t you see the danger inherent in what you’re doing here,” he warns. “Genetic power is the most awesome force the planet’s ever seen, but you wield it like a kid that’s found his dad’s gun.”

• Adam Rutherford is a geneticist and author