If you’re one of the 15 million people who shared your DNA with 23andMe, it’s time to delete your data.
The genetic information company, best known for its saliva test kits, announced Sunday that it is headed to bankruptcy court to sell its assets. And 23andMe’s financial distress prompted California Attorney General Rob Bonta to issue an unusual privacy “consumer alert” about it Friday.
“I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company,” he said in a statement.
The company said there will be “no changes” to the way it protects consumer data while in bankruptcy court. But unless you take action, there is a risk your genetic information could end up in someone else’s hands — and used in ways you had never considered. I have instructions on how to do it below.
It didn’t take me long to delete my data, but after this article published on Monday, 10 readers told me that the company’s site was not working for them — perhaps due to the number of people trying to scrub their information.
The situation is a privacy nightmare but also an example of how state privacy laws pioneered in California can help protect Americans — at least the proactive ones.
Founded in 2006, 23andMe was a pioneer in the quest to unlock knowledge from the human genome. It offers customers information about their family tree and hereditary characteristics, while researching new kinds of treatments.
But in recent years, 23andMe has been slammed by simultaneous business and security challenges. It went public in 2021 but burned through its cash and watched its value drop from about $6 billion to around $50 million now.
In 2023, it suffered a data breach that affected some 7 million customers. Hackers used customers’ old passwords to gain access to information that in some cases included family trees, birth years and geographic locations.
In September, 23andMe’s board of directors quit after rejecting CEO Anne Wojcicki’s proposals to take the company private.
On Sunday, Wojcicki resigned from her position as CEO, but she is still a member of the company’s board. She resigned to pursue another bid to buy the business, she said in a post on X.
23andMe didn’t immediately respond to my questions. But in its Sunday filing announcing bankruptcy, it said it “intends to continue operating its business in the ordinary course throughout the sale process.”
End of carousel
Bonta, the California attorney general, didn’t specify the risks of leaving your “trove of sensitive consumer data” with 23andMe. But privacy advocates I’ve spoken to have been watching the company’s challenges with concern on several fronts.
First, you are relying on 23andMe to keep your DNA safe from hackers. But that could be hard for any company to do under bankruptcy proceedings — and 23andMe has had plenty of security trouble in the past. (On its website, 23andMe says the company has achieved three certifications to demonstrate the strength of its security program.)
There’s also a risk that your data could get sold or transferred to a new company, which might want to use it for new purposes. The privacy statement of 23andMe seems to treat your data as a company asset that’s on the table like anything else. It reads: “If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction.”
On the website page to delete your data, 23andMe says: “If the company does change ownership in the future, your data will remain protected under the current 23andMe Privacy Policy unless and until you are presented with materially new terms, with appropriate advanced notice to review those material changes as required by law.”
A new owner could also try to change the company’s practices and privacy policy — and it would be on you to keep on top of the changes.
“The DNA data could be used to discern your relatives and ancestry, unearth family secrets, and reveal clues about diseases you have or could be predisposed to. If the data makes its way to certain insurers, they may deny you coverage or charge you more for life, disability, or long-term care insurance because of your genetics,” said Ginny Fahs, director of product R&D for Consumer Reports’ Innovation Lab.
“This is some of the most precious data that exists about you; you’re right to be concerned that it may be up for grabs,” she said.
But you do have rights over your data before any of that comes to pass. The California Consumer Privacy Act of 2018 gives you the right to delete data from businesses that collect it. While the law specifically applies to California residents, many other states have passed similar laws.
California also has a separate law pertaining to DNA data called the Genetic Information Privacy Act. It gives you the right to delete your account, have your biological sample destroyed, and revoke consent you may have previously given to use or disclose your genetic data.
When you request to delete your data, a confirmation email from 23andMe says it also automatically discards your sample and unenrolls you from research programs.
Before you delete your data, you might want to choose to download some or all of it. If you do, just make sure you have a good way to store and keep it safe. Unlike a password or telephone number, this is data you’re stuck with for the rest of your life.
A previous version of this article gave an incorrect name for the California Consumer Privacy Act of 2018. The article has been corrected.
