With 23andMe officially filing for Chapter 11 bankruptcy protection, privacy advocates, cybersecurity experts, and even state officials are sounding the alarm. Millions of customers who once eagerly mailed in their saliva for genetic insights now face a sobering question: What happens to their most sensitive data when a company goes broke?
California Attorney General Rob Bonta has publicly urged users to take immediate action, warning that their genetic information—arguably more personal than a Social Security number—could soon be in the hands of unknown third parties. And he’s not alone. Privacy experts across the U.S. are echoing that same urgent call: if you’ve ever used 23andMe, now is the time to delete your DNA data.
Why It Matters: DNA Is Forever
Unlike a password that can be changed or a credit card number that can be replaced, your DNA is permanent. It reveals not only your ancestry but potential health risks, disease predispositions, and even psychological traits. This makes genetic data incredibly valuable—not just to marketers and insurers, but also to data brokers and foreign entities. And right now, it’s at risk.
Under 23andMe’s own privacy policy, customer data can be sold or transferred in the event of a bankruptcy or merger. That means your genetic profile could become a bargaining chip in the company’s efforts to restructure or sell assets. According to consumer privacy expert Justin Brookman of Consumer Reports, “Once that data is sold, you can’t pull it back. It’s out there, and you’ve lost control.”
What’s At Stake
In 2023, 23andMe experienced a major security breach that exposed personal information of nearly 7 million users. The hacker reportedly gained access by credential stuffing—using previously leaked usernames and passwords from other sites. The breach didn’t just expose names and birthdates—it included ancestry information and DNA matches, raising red flags about how well the company was protecting its data even before bankruptcy.
The breach led to several class action lawsuits and further scrutiny over the company’s data handling practices. Now, with bankruptcy proceedings underway, experts say the risk is greater than ever that customer data could be mishandled, sold off, or acquired by an entity with different—possibly less stringent—privacy standards.
What You Can Do: Delete Your Data Now
23andMe allows users to request deletion of their data and destruction of their biological samples. But it’s not as simple as closing your account. Here’s what you need to do:
- Log into your 23andMe account.
- Go to your Account Settings and request data deletion.
- Submit a separate request for the destruction of your biological sample.
- Wait for confirmation from the company—this can take several weeks.
If you’re outside the U.S., you may have additional rights under GDPR or other regional privacy laws, which can be leveraged to demand complete erasure of your genetic data.
The Broader Fallout for Genetic Privacy
The collapse of 23andMe could send shockwaves through the entire direct-to-consumer genetic testing industry. Customers are now realizing that convenience and curiosity may come at a long-term privacy cost. Companies like AncestryDNA and MyHeritage are likely reviewing their own data retention and sale policies under renewed public scrutiny.
Critics argue that genetic data companies built a goldmine without a solid ethical foundation. “There’s been a kind of Wild West attitude toward genetic data,” says Albert Gidari, a privacy expert at Stanford Law School. “The 23andMe situation could be a turning point—either toward reform or toward greater abuse.”
Final Word
If you’ve ever tested with 23andMe, don’t assume your data is safe just because you’re not using the service anymore. The bankruptcy filing has shifted the priorities from customer trust to corporate survival. And in that environment, your genetic blueprint might be more valuable as an asset than as private information.
Delete it. Protect it. Before someone else owns it.
Key Takeaways
- 23andMe has filed for bankruptcy and your genetic data could be sold to other companies under their current privacy policy.
- Government officials and privacy experts recommend deleting your data immediately to protect your sensitive genetic information.
- Customers must specifically request destruction of both digital data and physical samples for complete removal from 23andMe’s systems.
Implications of 23andMe’s Bankruptcy
The recent bankruptcy filing by 23andMe has created significant uncertainty for millions of customers who shared their genetic information with the company. This development raises serious questions about data privacy and what happens to sensitive genetic information when a company faces financial collapse.
Understanding Chapter 11 and Financial Distress
23andMe filed for Chapter 11 bankruptcy protection on Sunday after struggling with weak demand for its DNA testing services. This type of bankruptcy allows a company to reorganize its debts while continuing operations rather than shutting down completely.
The filing follows a difficult period for the company, which has faced declining sales of its ancestry testing kits and significant challenges after a major data breach in 2023 that compromised customer information.
Financial distress at 23andMe didn’t happen overnight. The company has been dealing with decreased consumer interest in direct-to-consumer genetic testing, increasing competition, and rising operational costs.
The Future of Genetic Data and Customer Profiles
The most pressing concern for users is what happens to their genetic data. According to search results, 23andMe’s privacy policy explicitly allows the transfer or sale of personal information during bankruptcy proceedings.
California’s Attorney General has issued a consumer alert urging customers to request deletion of their data and destruction of any genetic material samples before changes in ownership occur.
If the company is sold, any new owner would theoretically need to follow applicable privacy laws. However, privacy experts worry about potential gaps in protection during ownership transitions.
Customers have limited time to act. Once data transfers to new owners, consumers may have fewer options to control or delete their genetic information.
Some experts recommend downloading your raw data first, then requesting complete deletion from 23andMe’s systems as a precautionary measure.
Why Experts Advise Deleting Your DNA Information
Privacy experts are urging 23andMe customers to delete their genetic data following the company’s bankruptcy filing. With the company’s assets up for sale, there are serious concerns about what might happen to the vast database of DNA information.
Potential Risks to Personal Data Privacy
When 23andMe filed for bankruptcy, the future of millions of DNA profiles became uncertain. The company’s assets—including potentially its database of genetic information—could be sold to the highest bidder during bankruptcy proceedings.
California Attorney General Rob Bonta specifically warned consumers to consider deleting their data due to the company’s financial troubles. The concern is that personal genetic information might change hands without proper consent or oversight.
While 23andMe has stated that customer data will be deleted upon request, privacy advocates worry about what happens in a bankruptcy scenario where normal business operations are disrupted.
The genetic information stored by 23andMe is deeply personal, containing insights about health predispositions, ancestry, and other sensitive details that most people would want to keep private.
Concerns Over Data Hacks and Misuse
The risk of data breaches increases when a company faces financial difficulties. With reduced resources for cybersecurity, hackers might see 23andMe’s database as a valuable target.
Past incidents have shown that genetic information databases are not immune to security breaches. If such data falls into the wrong hands, it could be used for identity theft, fraud, or other malicious purposes.
Beyond hackers, there are concerns about how new owners might use the genetic information. Without the original privacy agreements in place, a new owner could potentially change how this data is used, shared, or monetized.
Insurance companies, employers, or other entities might be interested in genetic information to make decisions about individuals—potentially leading to discrimination based on genetic predispositions.
Once genetic data is compromised, unlike passwords or credit cards, it cannot be changed or reset. Your DNA is permanent, making any breach particularly serious.
Legal Protections for Genetic Information
The Genetic Information Nondiscrimination Act (GINA) provides some protection against discrimination by employers and health insurers based on genetic information, but it has limitations and doesn’t cover all situations.
The California Consumer Protection Act gives California residents specific rights regarding their personal data, including the right to request deletion. Other states have varying levels of protection for genetic information.
However, these laws weren’t necessarily designed with company bankruptcies in mind. The legal protections for consumers when a DNA testing company fails remain somewhat unclear.
Privacy experts recommend taking proactive steps rather than relying on legal protections alone. Deleting your profile from 23andMe is the most effective way to ensure your genetic information isn’t transferred to new owners.
According to a 23andMe spokesperson, the company will delete customer data after receiving a deletion request, but the bankruptcy process might complicate or delay this procedure.
How to Permanently Delete Your Data
If you’re concerned about your genetic information in light of 23andMe’s bankruptcy, you can take steps to remove your data from their systems. The company provides a process for deleting your information, though some limitations exist regarding what happens to your data after deletion.
Steps to Remove Genetic Information from 23andMe
To delete your data from 23andMe, first sign in to your account on their website. Navigate to the “Settings” section, which contains all your account preferences and privacy options. Within Settings, look for the “Delete Your Data” option.
Before proceeding, you may want to download a copy of your genetic information for your records. 23andMe offers this option before deletion.
When ready, click on “Permanently Delete Data” in the Delete Data section. The company will send a confirmation email to verify your request. You must follow the link in this email to complete the deletion process.
The entire deletion should take effect shortly after confirmation, though processing times may vary.
Navigating Account Settings and Data Storage
Understanding what happens to your data after requesting deletion is important. While 23andMe states they will delete your profile data upon request, some aspects of your information may remain in their systems.
According to company spokespersons, your genetic data derived from your saliva sample will be deleted. However, certain anonymized or aggregated data may have already been shared for research purposes and cannot be recalled.
The company maintains backup systems that may contain your information for a limited time after deletion. These backups are typically purged on regular schedules.
If you participated in research programs through 23andMe, some of your data may have been incorporated into studies already published or shared with partners. These contributions cannot be fully retracted once shared.
The Reorganization Plan and Potential Buyers
23andMe’s bankruptcy filing has triggered uncertainty about the future of customer genetic data. The company has outlined a reorganization strategy while looking for potential buyers to take over its operations.
Transparency and Communication during Reorganization
23andMe has assured customers that their genetic information remains secure during the bankruptcy process. The company stated that the Chapter 11 filing will not affect how it stores or protects user data. However, many experts question the transparency of these claims.
The bankruptcy court in Missouri will oversee the reorganization process, requiring 23andMe to provide regular updates about its financial status and data management practices.
Many customers report receiving limited communication about what happens to their genetic information during this transition. Legal experts recommend that users monitor official communications from the company rather than relying on news reports.
The Impact on Ancestry and Disease Profiles
The reorganization significantly affects people who used 23andMe’s services for ancestry tracking or health risk assessments. If a buyer acquires the company, your DNA data and associated disease profiles could transfer to the new owner.
This prospect raises serious privacy concerns. Different buyers might have varying data protection standards or commercial interests in genetic information.
Some potential buyers might focus exclusively on the ancestry side of the business, while others may be more interested in the medical and disease prediction aspects.
Customers with active disease monitoring through the platform should consider downloading their reports before any ownership changes occur. The California Attorney General specifically warned that data security cannot be guaranteed during corporate transitions.
Frequently Asked Questions
The bankruptcy filing of 23andMe has raised serious concerns about the security of genetic data and what customers should do. Many users are searching for clear guidance on protecting their private information during this uncertain time.
What are the implications of 23andMe’s bankruptcy for customer data privacy?
While 23andMe has stated that its bankruptcy filing will not change how it stores or protects data, privacy experts remain concerned. The company’s financial troubles could potentially impact its ability to maintain security protocols.
The bankruptcy process might also lead to company assets being sold or restructured, raising questions about who might eventually control customer genetic information. This creates uncertainty about long-term data protection.
Can customers remove their genetic information from 23andMe, and if so, how?
Yes, customers can request deletion of their genetic data from 23andMe. The company has a data deletion process that begins immediately upon request.
According to 23andMe, once a deletion request is submitted, the process starts automatically and can take approximately 30 days to complete. This process is available regardless of the bankruptcy proceedings.
What should 23andMe users know about data security following the company’s bankruptcy announcement?
Despite 23andMe’s assurances that data protection practices remain unchanged, the California Attorney General has urged customers to request deletion of their information. This suggests official concern about data security during bankruptcy.
Users should understand that while immediate changes may not occur, the long-term handling of their genetic information could be affected by the company’s financial restructuring. Keeping informed about the bankruptcy proceedings is advisable.
What procedures should users follow to ensure their genetic data is deleted by 23andMe?
Users wishing to delete their data should log into their 23andMe account and navigate to the privacy settings. The specific deletion request option can be found within these settings.
For questions about the deletion process, customers can contact 23andMe’s claims agent, Kroll, directly at 23andMeInfo@ra.kroll.com or by calling (888) 367-7556. Documentation of the deletion request is recommended for personal records.
Are there any legal protections for consumers affected by the 23andMe bankruptcy case?
Consumer genetic data is subject to various privacy laws, though the interaction between these protections and bankruptcy proceedings is complex. Bankruptcy courts generally prioritize creditors’ interests, which may conflict with privacy concerns.
Users should monitor official announcements from both 23andMe and regulatory authorities for updates on how consumer rights will be protected. The outcome of this case may set important precedents for genetic data ownership.
What steps can individuals take to protect their privacy now that 23andMe is facing financial difficulties?
The most direct action is requesting complete deletion of genetic data and samples from 23andMe’s systems. This eliminates future risks associated with the company’s uncertain status.
Users should also review any consent agreements they’ve previously accepted with 23andMe. Revoking optional research participation and third-party sharing permissions further reduces potential privacy vulnerabilities.
