What does 23andMe’s bankruptcy and potential sale mean for your genetic data?
23andMe was once a leading genetic testing company, offering personalized reports on ancestry, traits and genetic predispositions to diseases. Users simply created an account, provided a saliva sample and awaited their analysis and report.
The service quickly gained popularity, with countless stories of users discovering long-lost relatives, adopted children reconnecting with biological parents and law enforcement even using it in the high profile Golden State Killer case in 2018.
Despite accumulating an estimated 15 million users and reaching a $6 billion valuation after going public, 23andMe has now filed for Chapter 11 bankruptcy. The company has been authorized to seek a buyer, including one for all of its assets—most notably, its vast genetic database.
In a press release regarding the bankruptcy, 23andMe stated that its data storage and protection policies remain unchanged and assured users that any potential buyer must comply with applicable privacy laws.
“We are committed to continuing to safeguard customer data and being transparent about the management of user data going forward, and data privacy will be an important consideration in any potential transaction.”
How to Delete Your 23andMe Data
Despite the press release, many users are skeptical and have opted to delete their data from the website—which caused the website to temporarily crash due to volume shortly after the bankruptcy and sale announcement. For those concerned about their privacy, follow these steps to request the deletion of your 23andMe data:
- Log in to your account and go to “Settings”.
- Scroll to the bottom of the page, select “23andMe Data”, then click “View” to download a copy of your genetic information.
- Choose “Delete Data” and confirm by selecting “Permanently Delete Data.”
- In “Settings,” you can also request the destruction of your genetic material.
- Navigate to the “Research and Product Consents” section and revoke permission for your genetic data to be used in research projects. (This applies only to future research.)
Like many online services, 23andMe makes data deletion more complex than expected and may require additional verification before processing your request. To complete the process, you must follow the instructions in their confirmation email. If you run into any issues, the company suggests reaching out to [email protected] for support.
It is important to note that the full ability to delete your data may not be as straightforward based on their terms of service, which states:
“Your sample is processed in an irreversible manner and cannot be returned to you. Any information derived from your sample remains subject to rights we retain as set forth in these Terms.”
Adding another layer of complexity, your state of residence may impact your data privacy, as consumer protection laws vary by state and may not uniformly apply to 23andMe.
What’s Next for 23andMe Users?
As a 23andMe user myself, I weighed the risks of sharing my genetic information in exchange for analysis, reports and access to their database. For me, the benefits, particularly as an adoptee searching for biological relatives, far outweighed the risks. However, the thought of what might happen if the company were sold never crossed my mind.
The reality is that, despite all the speculation about the future of genetic data in the event of a sale, no one truly knows what will happen until it unfolds. This uncertainty serves as a stark reminder to carefully read the terms and conditions before signing up for any online service that asks for personal data.
While 23andMe continues to offer vague assurances, the truth is that the level of data privacy will ultimately depend on who acquires the company and what their intentions are moving forward.
About Schneider Downs Cybersecurity
The Schneider Downs cybersecurity practice consists of experts offering a comprehensive set of information technology security services, including penetration testing, intrusion prevention/detection review, ransomware security, vulnerability assessments and a robust digital forensics and incident response team. In addition, our Digital Forensics and Incident Response teams are available 24x7x365 at 1-800-993-8937 if you suspect or are experiencing a network incident of any kind.
To learn more, visit our dedicated Cybersecurity page.
Want to be in the know? Subscribe to our bi-weekly newsletter, Focus on Cybersecurity.
