When Christina Snyder Monahan of Irvine first received her genetic results from 23andMe three years ago, she thought there was a mistake.
The DNA sample she had sent to the company revealed that she was nearly 50% Persian, though to her knowledge, she didn’t have any Persian relatives.
More than a year later, her mother admitted to having an “encounter” with another man, who was her actual biological father and not the man who raised her.
After adjusting to the shock, Monahan embraced the news, using 23andMe to meet relatives she never knew she had, including a first cousin and four half-siblings. Her biological father died before she learned of his existence.
“I was completely blown away,” Monahan said. “The app gave me meaningful information about the region in Iran my father hailed from.”
One of 15 million people who gave their genetic information to 23andMe, Monahan is now processing the news that the South San Francisco-based company filed for bankruptcy and is preparing to sell its trove of sensitive data. She values the connections the platform has brought her, she said, but is worried about where her genetic material could end up, echoing the concerns of other customers.
“The attorney general of California is suggesting that people delete their accounts and that is making me think twice,” Monahan said. “There might be danger lurking out there or repercussions.”
Once a promising company briefly valued at $6 billion after it went public in 2021, 23andMe popularized at-home DNA test kits and spawned a cottage industry of ancestry hunters and true crime sleuths.
But the venture failed to attract repeat customers and has been unable to use the power of genome-mapping to expand into other revenue streams such as drug development. The company also fell victim to internal squabbles, all of which led to the chief executive’s resignation and a Chapter 11 bankruptcy filing on Sunday.
The U.S. Bankruptcy Court for the Eastern District of Missouri this week authorized 23andMe to sell substantially all of its assets, including its database of genetic information. Though any potential buyer must agree to comply with 23andMe’s privacy policy, the uncertain future of the data has raised concerns about whether it could fall into the wrong hands.
“Genetic information is uniquely sensitive because it reveals immutable characteristics about ourselves,” said Sara Geoghegan, senior counsel at the Electronic Privacy Information Center. “I would be very concerned if I had given a swab to 23andMe. There is little we can do to control what happens to it.”
The company’s online terms of service says, “Your sample is processed in an irreversible manner and cannot be returned to you. Any information derived from your sample remains subject to rights we retain as set forth in these Terms.”
23andMe customers are protected by the terms of service, but these terms can be changed by the company or its new owner at any time, Geoghegan said. Terms of service are also often written broadly or vaguely, and “privacy policies are wholly inadequate to protect our personal information,” she said.
California Atty. Gen. Rob Bonta issued a consumer alert after 23andMe’s bankruptcy announcement to remind Californians of their right to have their genetic data deleted under the Genetic Information Privacy Act and the California Consumer Privacy Act.
Customers can delete their account and request their samples be destroyed by logging in and navigating to the settings page. They can also withdraw permission for third-party researchers to use their data.
“California has robust privacy laws that allow consumers to take control and request that a company delete their genetic data,” Bonta said. “Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and destroy any samples of genetic material held by the company.”
The 23andMe website crashed last week as customers rushed to delete their data, the Wall Street Journal reported. As concerns spread, the company issued a statement clarifying that “potential buyers must, among other requirements, agree to comply with 23andMe’s consumer privacy policy and all applicable laws with respect to the treatment of customer data.”
A company spokesperson declined to comment for this story and referred to previous statements.
In 2023, a company data breach affected nearly 7 million customers, and last year, 23andMe agreed to pay $30 million to settle a class-action lawsuit accusing the company of failing to protect its customers.
The level of risk 23andMe customers face now largely depends on who ends up buying the company, said Christo Wilson, a Northeastern University computer sciences professor who specializes in online privacy and data security.
“I do think people should be worried,” he said. “There’s lots of different actors who would want this data for a lot of different purposes, far beyond what you probably thought you were consenting to when you were just interested in genealogy.”
Pharmaceutical companies, insurance companies or law enforcement might be interested in obtaining the data, Christo said. An insurance company might use genetic information to determine pre-existing health conditions and consequentially raise rates for that individual, he said.
23andMe began nearly two decades ago when co-founder Linda Avey had the idea for a direct-to-consumer genetic testing service.
Anne Wojcicki met Avey through her then-boyfriend, Google co-founder Sergey Brin, who had expressed interest in Avey’s work. The pair co-founded the company in 2006, and Wojcicki was named its CEO.
A year later, Wojcicki and Brin married, and Google announced its investment in 23andMe shortly after. In 2009, wanting to run the company herself, Wojcicki persuaded two independent board members to fire Avey, according to the Wall Street Journal.
Originally priced at $399, the DNA test kits attracted attention but were too expensive for the average consumer. That changed in 2012 when new investor funding allowed the company to reduce the price of the kits to $99 for ancestry services and $199 for health and ancestry information. The kits soon became birthday gifts and stocking stuffers.
At its peak, 23andMe attracted celebrity attention and held “spit parties,” where high-profile customers spit into a tube to provide their DNA sample. The samples helped people discover entirely new family trees and could reveal consequential health information, like a genetic predisposition to cancer. The genetic data collected by services similar to 23andMe was used to catch the infamous Golden State Killer in 2018.
While the company’s rise was celebrated, its expansion efforts were hobbled by challenges. In 2013, the Federal Drug Administration ordered a halt in sales of the test kits because 23andMe hadn’t gotten the agency’s approval to market the kits. The company later received approval after it completed a regulatory review process.
Moreover, because users need to provide a DNA sample only once to take advantage of 23andMe’s services, the company failed to establish a sustainable business model based on repeat customers. Additionally, 23andMe struggled to license its tech to pharmaceutical companies, which could have boosted profits.
Last November, the company announced it would lay off 40% of its workforce, or more than 200 employees, and shut down its therapeutics division.
Company shares have plummeted in value, dropping more than 81% so far this year. The day after the bankruptcy announcement, shares fell roughly 50% and closed Friday at 61 cents.
Jo Levy, a Northern California trial lawyer and 23andMe customer, said she used the platform to connect with relatives she had never met before. Despite the attorney general’s warning, she urged consumers not to panic about the fate of their data.
“The fact that they filed for bankruptcy doesn’t mean that tomorrow some nefarious company is going to purchase the data,” Levy said. “There could be many reasons why people would want to maintain their accounts and I would caution people not to overreact.”
Wojcicki has made clear her intentions to bid on the company with a post on X last week. Her resignation came weeks after a company board committee rejected her acquisition proposal, and last September, all independent board members resigned after failed negotiations with Wojcicki.
The potential sale of the company’s genetic data is unprecedented, said Christo, the computer sciences professor. His fear is that a company will seek to purchase 23andMe solely to access and use its data.
“There are certainly other databases full of genetic information, but they’re held by researchers like hospitals and are subject to very different ethical guidelines than a private company,” he said. “I’ve never heard of anything like this happening before.”
