The deadline is up today for 13 personal-genomics companies that were sent cease-and-desist letters last week by the state of California. The companies, which offer genetic-testing services directly to consumers via the internet, will need to show that they are complying with state law. Most notably, they will need to prove that physicians order the tests.

These actions are likely just a hint of the regulatory battles to come. The direct-to-consumer testing market has boomed in the past year, thanks to a flood of studies linking specific genetic variations to disease, and also thanks to cheaper technologies to detect those variants. Along with that growth has come increasing scrutiny over how the medical information inherent in an individual’s genetic information should be used and regulated. As the debate unfolds, scientists, regulators, and entrepreneurs will need to grapple with the central question of how to define this new breed of medical information, which falls short of being a diagnostic tool and, unlike risk factors such as cholesterol levels and blood pressure, is deeply personal and ultimately immutable.

“The current situation is reminiscent of Napster,” says Steven Murphy, a physician and founder of Helix Health, a personalized-medicine practice in New York. “[That company] created a disruptive technology to share music, and the government wasn’t prepared to deal with it. But just like with Napster, there’s a fight coming, and [the personal-genomics companies] are going to lose.”

The letters sent by the California Department of Public Health outlined two main state regulations: laboratories performing tests must be clinically licensed, and a physician’s order is required for all clinical tests. The former is not likely to present a huge barrier. For example, Navigenics, a California-based company that offers a broad screen assessing risk for 18 diseases, outsources laboratory testing to Affymetrix, a California-based genomics technology company that is clinically certified in the state.

The second requirement–that a doctor be involved in the process–highlights a more complex question that is likely to undergo extensive debate at both the state and the federal level: does the information provided by direct-to-consumer genetic-testing companies constitute medical information? At issue are novel services offered by three companies: Navigenics; 23andMe, another California-based startup; and DecodeMe, an offshoot of the Icelandic genetics company Decode. All three companies scan an individual’s entire genome for specific genetic variations that have previously been linked to diseases, such as diabetes, macular degeneration, and breast cancer.

The idea is that someone at higher risk for an ailment, such as cardiovascular disease, can take steps to reduce it, perhaps by taking statins. Opponents argue that such testing has not proved clinically useful and is difficult for both consumers and doctors to interpret: these variations don’t guarantee that the bearer will develop a disease. Proponents argue that genetic-risk information should be viewed just like any other risk information, such as high cholesterol levels, and that consumers have a right to that information.

(As of Friday, the California Department of Public Health had not released a list of companies sent letters. Such a list would likely include companies that offer more-traditional genetic tests, such as tests for specific diseases that have a highly heritable component, as well as companies offering tests with largely unsubstantiated scientific claims, such as some nutrigenomics companies. But because of their novelty and a high level of public attention, the most intense debate will likely focus on issues inherent to companies like 23andMe and Navigenics, both of which have confirmed receiving letters.)

23andMe has somewhat skirted the medical issue by emphasizing a more recreational approach to genetic testing, providing ancestry analysis and the ability to compare one’s genomes with those of family and friends. The company does, however, offer analysis of customers’ genetic risk for various diseases. (23andMe declined to give specifics on how it will respond to the health department’s letter.)

“On the one hand, arguing that it’s not a medical diagnosis helps to enforce the limitations of this information,” says Amy McGuire, a medical ethicist at Baylor College of Medicine, in Houston. “Most physicians would not in the context of medical practice order the testing. But regardless of this, most consumers will misinterpret it–they’ll think of the results as medical information and treat it that way.”

Navigenics, in contrast, focuses on medical risk and offers genetic counseling as part of its testing service. In a statement released last week, Navigenics emphasized that the company’s tests are ordered and reviewed by a California-licensed physician. Whether or not that will satisfy California’s public-health officials–and the broader community–remains to be seen.

“If you look at a Navigenics report, every page says that this is not intended to be medical or diagnostic information,” says James Evans, a clinical geneticist at the University of North Carolina at Chapel Hill and editor in chief of the journal Genetics in Medicine. “Yet their entire marketing strategy is clearly based on the idea that this is useful medical information.” Navigenics had not returned calls for comment at press time.

All three of the genome-wide screening companies make a significant effort to put the genetic-risk information in context. But some critics say that this may not be enough. “I’d be more interested in seeing this argued as a false-claims issue,” says Arthur Caplan, director of the Center for Bioethics at the University of Pennsylvania, in Philadelphia. “It’s the provider’s challenge to make sure you get an informed consumer when you are talking about genetic information.”