Remember 23andMe—the company that let you explore your ancestry through a saliva-based DNA test? Since its founding in 2006, it also ventured into health research and drug development. However, it struggled financially and filed for Chapter 11 bankruptcy in March, sparking concerns about the security of customers’ sensitive genetic data.
Now, 27 U.S. states and the District of Columbia have filed a lawsuit in bankruptcy court, seeking to prevent the sale of 23andMe’s genetic data archive without user consent. A biotech firm is currently looking to acquire the company, pending court approval.
What Happened to 23andMe?
The San Francisco-based firm filed for bankruptcy protection in March. Its co-founder and longtime CEO Anne Wojcicki stepped down to potentially bid for the company as it looks to sell off most of its assets through court-supervised restructuring. 23andMe also aims to cut costs by reducing its real estate footprint, including leases in San Francisco and Sunnyvale, while continuing operations during the sale process.
Is Your DNA Data Still Safe?
23andMe has stated that customer privacy and data protection are central to any sale agreement, and any buyer must adhere to relevant privacy laws. However, experts caution that the U.S. lacks a federal privacy law, and only about 20 states have their own regulations.
Security risks are also heightened during bankruptcy. In 2023, a breach at 23andMe exposed the genetic data of nearly 7 million users. The company settled a class-action lawsuit for $30 million over its failure to protect user data.
Disney to pay $439m to take full control of streaming service Hulu
Genetic data is particularly sensitive, as it’s uniquely tied to you. “You can change your email if it’s compromised, but your DNA is permanent,” said David Choffnes, a cybersecurity professor at Northeastern University.
While 23andMe claims it doesn’t share information with insurers, employers, or law enforcement (without a legal order), experts warn that the company can still use data for targeted advertising. Even anonymized genetic data can potentially be re-identified by third parties.
How to Delete Your Data from 23andMe
California Attorney General Rob Bonta previously alerted consumers of their right to delete their data, especially in light of the company’s financial troubles.
To delete your data:
Log in to your 23andMe account.
Go to Settings > scroll to “23andMe Data” > click “View”.
Download your data if desired.
Proceed to the “Delete Data” section and click “Permanently Delete Data.”
Confirm the request via the email sent to you.
If you’ve given consent to store your saliva sample, you can request its destruction under “Preferences.” You can also withdraw consent for your genetic data to be used in third-party research under “Research and Product Consents.”