23andMe Bankrupt? Delete Your DNA Before It’s Sold to the Highest Bidder!

23andMe filed for Chapter 11 bankruptcy on March 24, 2025, raising concerns about user data privacy.
It seems likely that users’ genetic data could be transferred to a new owner, who may change privacy policies later.
Research suggests users can delete their 23andMe data by logging in, going to settings, and following specific steps.
The evidence leans toward California’s privacy laws offering protections, with an urgent alert issued for data deletion.

Table of Contents

23andMe and Recent Events

23andMe, established in 2006, has become a household name for genetic testing, serving over 15 million consumers worldwide by offering insights into ancestry and genetic health predispositions. However, the company has recently encountered significant challenges, including a data breach reported in October 2023 , the resignation of independent board directors, layoffs affecting 40% of staff, and the closure of its drug development division. These issues culminated in the company filing for Chapter 11 bankruptcy on March 24, 2025, prompting widespread concern about the fate of users’ genetic data.

Details of the Bankruptcy Filing

The bankruptcy announcement, detailed in 23andMe’s investor relations page, states that the company initiated voluntary proceedings in the U.S. Bankruptcy Court for the Eastern District of Missouri. The goal is to facilitate a sale process to maximize business value, with $35 million in debtor-in-possession financing from JMB Capital Partners to support operations during this period. The company is also seeking court approval to reject contracts, such as real estate leases in Sunnyvale and San Francisco, to reduce expenses.

Implications for User Data

The bankruptcy filing has raised significant concerns about the privacy and security of users’ genetic data. According to an ABC News article (23andMe Bankruptcy and User Data), in the event of a sale, the acquiring company must initially follow 23andMe’s existing privacy policy. However, this new owner could later issue a new privacy statement, potentially changing how data is shared, such as with law enforcement, employers, or insurance companies. This is particularly concerning given that 23andMe is not protected by HIPAA, as it is a consumer service rather than a healthcare provider, leaving user data more vulnerable.

About 80% of 23andMe users have opted in for their data to be used in medical research, which is shared anonymously. However, this data could still be transferred to a new company, and the implications for research consent are unclear. The company’s official statement emphasizes no changes to data storage, management, or protection, with any buyer required to comply with applicable laws (Open Letter from 23andMe), but experts and users remain skeptical.

Privacy Concerns and Legal Protections

The California Attorney General, Rob Bonta, issued an urgent consumer alert on March 21, 2025, due to 23andMe’s financial distress and doubts about its ability to continue as a going concern, as detailed in the press release (Attorney General’s Consumer Alert). This alert highlights Californians’ rights under the Genetic Information Privacy Act (GIPA) and the California Consumer Protection Act (CCPA), urging users to delete their genetic data. The press release provides specific steps for deletion, which are crucial for users seeking to protect their privacy.

Expert opinions further underscore these concerns. Dr. Arthur Caplan from NYU Grossman School of Medicine has criticized the consent process, suggesting it may be insufficient for protecting user data. Anya Prince from the University of Iowa College of Law has highlighted potential issues with the privacy policy, while I. Glenn Cohen from Harvard Law School has discussed the risks of data transfer and potential access by law enforcement, adding to the controversy.

Steps to Delete 23andMe Data

For users looking to delete their genetic data, the following steps are outlined in the Attorney General’s press release:

Log into your 23andMe account.
Go to “Settings.”
View “23andMe Data.”
Optionally download your data if you wish to keep a copy.
Click “Permanently Delete Data.”
Confirm the deletion via email.

Additionally, users can destroy their test sample by changing preferences under “Preferences” in account settings and revoke research consent under “Research and Product Consents.” For more information on CCPA rights, visit CCPA Info.

The bankruptcy of 23andMe has brought critical privacy issues to the forefront, particularly for the 15 million users who have shared their DNA. Users are encouraged to take immediate action to delete their data and understand their rights under applicable privacy laws, especially in states like California with robust protections. As the situation evolves, staying informed through official sources and legal updates will be essential to safeguard personal genetic information.