The genetic testing company 23andMe, once valued at $6 billion, has filed for bankruptcy, and millions of customers are now wondering what will happen to their most personal data. The company, famous for its at-home DNA kits, built its reputation on helping people explore their ancestry and health risks. But now that it is financially unstable, serious questions are being raised about the future of the genetic information it collected.
For over 15 million people, 23andMe holds not just names and addresses, but detailed genetic profiles, health histories, family connections, and stored biological samples. As the company enters the bankruptcy process and prepares to sell off its assets, the very core of what it has collected could be sold to outside buyers. These potential buyers may not have the same commitment to privacy or ethics that customers believed they were promised.
How Did 23andMe End Up Here?
23andMe became a household name by offering simple DNA test kits that consumers could use at home. People spit into a tube, mailed it in, and received detailed reports on their ancestry, inherited traits, and potential health risks. The concept was so popular that the company grew quickly, raising millions from investors and drawing attention for its ambitious goals.
However, 23andMe struggled to make money from its success. It tried to expand its business by using customer data to develop new pharmaceutical drugs. That effort led to delays and high costs. Later, the company launched a subscription service that was supposed to offer regular health updates and new features. But not enough people signed up.
Now, the company is seeking to sell all of its assets in a bankruptcy process. In a public letter to its customers, 23andMe said, “Filing for Chapter 11 bankruptcy does not change how we store, manage, or protect customer data.” It also promised that “any buyer of 23andMe will be required to comply with applicable law with respect to the treatment of customer data.”
Still, experts and officials are warning the public to take extra care. As the company looks for a buyer, the privacy of personal genetic information is no longer something customers can take for granted.
What Could Happen to Your Data?
Under bankruptcy law, almost anything a company owns can be sold. That includes intellectual property, technology, real estate, and in this case, data. For 23andMe, customer data is considered one of its most valuable assets. This includes the genetic information of millions of users.
Legal experts say this data could be sold to the highest bidder. Although 23andMe has removed identifying details like names and birth dates from data shared with researchers, the information itself is so unique that it could still be used to trace individuals or families. The company has already used this data in drug development partnerships, including one with pharmaceutical giant GSK. According to court filings, 23andMe claims it has identified over 50 potential drug candidates, and two of them are in early-stage human trials.
Shannon Hartsfield, a partner at law firm Holland & Knight who specializes in health data privacy, pointed out that 23andMe is not covered by federal health privacy laws. “Although 23andMe deals with genetic information, saliva samples, and self-reported health and family information from its customers, it isn’t subject to HIPAA,” she said, referring to the Health Insurance Portability and Accountability Act. This means that protections some people assume are in place do not actually apply.
Sara Gerke, an associate professor of law at the University of Illinois, said that although the company has a privacy policy, a new owner could change it quickly. “Customers would have to sign off,” she noted, “something many people often do without reviewing carefully.”
Even if the bankruptcy court appoints a consumer privacy ombudsman — a role created to protect consumer data in bankruptcy cases — that person only offers recommendations. A judge can still approve the sale of data, even sensitive health information, as long as certain conditions are met.
What Has the Company Promised?
23andMe continues to tell customers that their data is safe. In a statement on its website, the company said it plans to “secure a partner who shares in its commitment to customer data privacy.” It also said that customer access to their accounts and data remains unchanged for now.
Despite these promises, many users have already experienced technical problems. After the bankruptcy was announced, some people trying to delete their data reported that they received error messages. Others said the login portal on the company’s website went down. Customers trying to reach support faced long wait times and delays.
State Officials Warn Consumers to Act
California’s Attorney General, Rob Bonta, has issued a strong warning to consumers. In a public statement, he said, “Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company.” His office explained that California residents have the right to request that their data be deleted under both the California Consumer Privacy Act (CCPA) and the Genetic Information Privacy Act (GIPA).
Bonta’s office also gave a step-by-step guide to removing personal data from 23andMe’s systems. This includes deleting your account, destroying your stored saliva sample, and revoking permission for your data to be used in research. These steps can be done from your account settings page on the company’s website.
In the press release, Bonta stated clearly, “California has robust privacy laws that allow consumers to take control and request that a company delete their genetic data.”
How to Protect Your Data Right Now
If you want to protect your genetic data, you need to act quickly. Here are the recommended steps:
-
Log into your 23andMe account on the company’s website.
-
Go to the “Settings” section of your profile.
-
Scroll to the bottom of the page and look for the section labeled “23andMe Data.”
-
Click “View” next to that section.
-
If you want a copy of your genetic data for personal use, download it before going further.
-
Scroll down to the “Delete Data” section and click “Permanently Delete Data.”
-
You will receive a confirmation email. Follow the link in that email to complete the deletion process.
-
To destroy your test sample, go to the “Preferences” page in your account and change your storage settings.
-
To revoke research consent, go to “Research and Product Consents” and withdraw permission.
Make sure to complete each of these steps fully. If you run into problems, try again later or contact the company’s support team. Due to high demand, response times may be slow.
What Does This Mean for the Future?
The fall of 23andMe serves as a major warning for anyone who has shared personal data with a private company. Genetic information is unlike anything else. It is deeply personal, permanent, and can affect not just you, but your relatives and future generations. Once that information is shared or sold, there is no way to take it back.
Many customers trusted 23andMe to protect their data. Now that trust is being tested. Although the company says it is committed to privacy, the reality is that bankruptcy can change everything. When a company is desperate for funds, even the most sensitive information can be put up for sale.
As this story continues to develop, customers should stay informed, act quickly, and consider what their genetic information is worth. If you’re not comfortable with the risk, now is the time to take control and protect your data before it is out of your hands forever.
FAM Editor: Who do they think they are kidding? The FBI has all of the data, the Chinese, Russians and others have all stolen the data. The only way for your information to be safe is to never have participated.
