After reading the article, it looks to me like giving access to this data is not what's new, it's that the contractual terms of the existing agreement have changed. That is, it seems like 23AndMe already gives access of some form to pharmaceutical research companies.
Two questions I had:
* I'm vaguely familiar with the challenges of anonymizing omics data, and I'm wondering how they expect to make someone's entire genetic profile sufficiently anonymous or deidentified. All I've seen from them is one of their example reports, and you could take the name off one of those, and it seems like it would still be pretty easy to reidentify the subject just from that high level report, let alone from the raw data.
* When they say these are users who have opted in to data sharing, I wonder what form that actually takes. Is this one of those things where everybody who uses 23AndMe is opting in? Did these 14 million users all actually provide informed, active consent? I assume that to maximize the value of that data, 23AndMe is incentivized to interpret consent as broadly (and vaguely) as possible.