The deadline is up today for 13 personal-genomics companies that were sent cease-and-desist letters last week by the state of California. The companies, which offer genetic-testing services directly to consumers via the internet, will need to show that they are complying with state law. Most notably, they will need to prove that physicians order the tests.

These actions are likely just a hint of the regulatory battles to come. The direct-to-consumer testing market has boomed in the past year, thanks to a flood of studies linking specific genetic variations to disease, and also thanks to cheaper technologies to detect those variants. Along with that growth has come increasing scrutiny over how the medical information inherent in an individual's genetic information should be used and regulated. As the debate unfolds, scientists, regulators, and entrepreneurs will need to grapple with the central question of how to define this new breed of medical information, which falls short of being a diagnostic tool and, unlike risk factors such as cholesterol levels and blood pressure, is deeply personal and ultimately immutable.

"The current situation is reminiscent of Napster," says Steven Murphy, a physician and founder of Helix Health, a personalized-medicine practice in New York. "[That company] created a disruptive technology to share music, and the government wasn't prepared to deal with it. But just like with Napster, there's a fight coming, and [the personal-genomics companies] are going to lose."

The letters sent by the California Department of Public Health outlined two main state regulations: laboratories performing tests must be clinically licensed, and a physician's order is required for all clinical tests. The former is not likely to present a huge barrier. For example, Navigenics, a California-based company that offers a broad screen assessing risk for 18 diseases, outsources laboratory testing to Affymetrix, a California-based genomics technology company that is clinically certified in the state.

The second requirement--that a doctor be involved in the process--highlights a more complex question that is likely to undergo extensive debate at both the state and the federal level: does the information provided by direct-to-consumer genetic-testing companies constitute medical information? At issue are novel services offered by three companies: Navigenics; 23andMe, another California-based startup; and DecodeMe, an offshoot of the Icelandic genetics company Decode. All three companies scan an individual's entire genome for specific genetic variations that have previously been linked to diseases, such as diabetes, macular degeneration, and breast cancer.

The idea is that someone at higher risk for an ailment, such as cardiovascular disease, can take steps to reduce it, perhaps by taking statins. Opponents argue that such testing has not proved clinically useful and is difficult for both consumers and doctors to interpret: these variations don't guarantee that the bearer will develop a disease. Proponents argue that genetic-risk information should be viewed just like any other risk information, such as high cholesterol levels, and that consumers have a right to that information.