The recent bankruptcy filing of 23andMe, a pioneer in direct-to-consumer genetic testing, has ignited significant concerns regarding the privacy and security of sensitive health data belonging to over 15 million customers. Despite assurances from the company that data management practices remain unchanged during the bankruptcy proceedings, privacy experts and regulatory bodies are urging users to take proactive measures to protect their genetic information.
Background of the Bankruptcy
Founded in 2006, 23andMe offered consumers insights into their ancestry and health risks through DNA testing kits. However, the company faced declining demand, financial losses, and reputational damage following a significant data breach in 2023 that exposed the personal information of approximately 7 million users. These challenges culminated in the company’s Chapter 11 bankruptcy filing in March 2025.
Implications for Customer Data
The bankruptcy process introduces uncertainties about the future ownership and handling of 23andMe’s extensive genetic data repository. Potential acquisition by entities with differing privacy standards raises the risk of sensitive information being misused or inadequately protected. Notably, genetic data held by companies like 23andMe is not covered by health privacy laws such as the Health Insurance Portability and Accountability Act (HIPAA), leaving consumers with limited legal safeguards.
Recommendations for Customers
Given the current situation, customers are advised to:
• Download and Delete Data: Access your 23andMe account to download your genetic information and then proceed to delete your data from their servers.
• Request Sample Destruction: If physical DNA samples are stored by the company, request their destruction to prevent future misuse.
• Stay Informed: Monitor communications from 23andMe and reputable news sources for updates on the bankruptcy proceedings and any changes to data handling policies.
Conclusion
The downfall of 23andMe serves as a stark reminder of the vulnerabilities associated with sharing personal health data with private companies. As the landscape of genetic testing evolves, it is imperative for consumers to remain vigilant and proactive in safeguarding their sensitive information.
For more detailed guidance on data deletion procedures, refer to 23andMe’s official support page.
Here’s how you can delete your 23andMe data:
1. Download Your Data (Optional):
Before deletion, you might want to retain a copy of your genetic information:
• Log into your 23andMe account.
• Navigate to the “Settings” section.
• Scroll to the “23andMe Data” section at the bottom and click “View.”
• Choose the data you wish to download and follow the prompts to save it securely.
2. Delete Your Data:
• While still in the “23andMe Data” section:
• Scroll to the “Delete Data” subsection.
• Click on “Permanently Delete Data.”
• You’ll receive a confirmation email; follow the link provided to finalize the deletion process.
3. Request Destruction of Your Physical Sample:
If you previously consented to 23andMe storing your saliva sample:
• Go to your account’s “Settings.”
• Under “Preferences,” locate the option related to sample storage.
• Request the destruction of your biological sample.
4. Withdraw from Research Participation (If Applicable):
If you agreed to participate in research:
• In “Settings,” navigate to “Research and Product Consents.”
• Withdraw your consent to prevent further use of your data in studies.
Important Considerations:
• Irreversibility: Once deleted, your data cannot be recovered. Ensure you’ve downloaded any information you wish to keep.
• Processing Time: Deletion requests may take some time to process; monitor your email for confirmations.
• Legal Obligations: Some data may be retained by 23andMe to comply with legal requirements.
By proactively managing your genetic information, you can help safeguard your privacy in light of the company’s financial situation.
