DNA testing firm 23andMe’s recent filing for bankruptcy has sparked significant concerns regarding the future of its customers’ genetic information, affecting more than 15 million individuals who have used the company’s services.
In March, 23andMe declared bankruptcy and subsequently entered an auction process, in which pharmaceutical giant Regeneron sought to acquire the genetic testing business for $256 million. Upon announcing the intended purchase in May, Regeneron assured the public it would uphold 23andMe’s original privacy policies. However, the pharmaceutical company also indicated it plans to utilize customer genetic data to facilitate drug research efforts.
The sale process took a new turn recently when TTAM Research Institute, a nonprofit led by 23andMe’s co-founder and former CEO Anne Wojcicki, emerged as the latest leading bidder in a subsequent round of offers.
Since the initial bankruptcy announcement, experts and lawmakers alike have urged customers to protect their personal genetic data. During a hearing before the House Oversight Committee, 23andMe’s interim CEO Joseph Selsavage reported that about 1.9 million individuals—approximately 15% of the company’s total users—have requested their genetic data be permanently deleted from company databases.
This week also saw the filing of lawsuits by attorneys general from over two dozen states, challenging 23andMe’s right to transfer private genetic data to other parties without explicit and direct customer consent.
For the millions of users concerned about their personal information, there are several actions available for protection:
To delete your genetic data from 23andMe, begin by logging in to your account online, and perform the following steps:
– Navigate to the Settings section within your profile.
– Scroll down to the area labeled “23andMe Data.”
– Click “View,” and then locate the “Delete Data” option.
– Click on the “Permanently Delete Data” button.
Upon requesting data deletion, you will receive a confirmation email containing a link to authorize the action. It is advisable to download a backup of your genetic information before deleting it, if desired.
However, customers should be aware that 23andMe’s privacy policy allows for retaining certain information—specifically genetic data, date of birth, and sex—to comply with existing legal obligations. Additionally, the policy states that limited personal identification information, including email addresses and account deletion requests, may be retained temporarily for legal, contractual, compliance, or audit purposes.
Customers who chose to allow 23andMe to store their physical DNA samples or use their genetic information for research purposes retain the ability to withdraw consent. To do so, access your account settings and navigate to the Preferences section, where permissions can be revoked in the “Research and Product Consents” area. Note that although you may reverse consent, data already collected and analyzed in completed research studies cannot be retroactively removed.
Given that genetic data can influence the privacy of related individuals, experts recommend that customers also encourage their family members and close relatives to review their own permissions and consider deleting their genetic material if previously shared with the service.
