23andMe files for bankruptcy, will sell company; vows ‘no change’ in customer data storage

MANCHESTER, NH – That thing  – that nagging feeling you had about privacy and personal genetic data breaches that kept you from sending your DNA to a testing company to learn more about your genetic ancestry? That may not have been a bad call on your part.

Over the weekend 23andMe Holding Co., a popular human genetics and biotechnology company that allows people to submit DNA samples in return for genetic mapping information, announced it filed Chapter 11 bankruptcy proceedings in the U.S. Bankruptcy Court for the Eastern District of Missouri, with the intention to sell off the business.

The Company intends to continue operating its business “in the ordinary course throughout the sale process,” according to a statement posted Sunday on their website, with “no changes to the way the Company stores, manages, or protects customer data.”

Read the full press release on the company website here.

However, one big reason some consumers have avoided commercial DNA testing is the question of what becomes of your genetic data in a situation such as this one – and what, if any, are your rights to privacy?

23andMe has posted a Q&A on their website to answer questions about what happens next, which you can find here.

One of the questions answered is this: What does this mean for my genetic data?

Their answer: “The filing does not change how we store, manage, or protect customer data.”

“Through the sale process, 23andMe will look to secure a partner who shares in its commitment to customer data privacy and will further its mission of helping people access, understand and benefit from the human genome. Any buyer will be required to comply with applicable law with respect to treatment of customer data. Our users’ privacy and data are important considerations in any transaction, and we remain committed to our users’ privacy and to being transparent with our customers about how their data is managed.

“You can opt into and out of our research at any time by updating your consent status in your account settings. If you opt out, we will stop using your information for research going forward (we cannot affect studies that have already been completed) and will discontinue use of your data within 30 days.”

About the Chapter 11 filing

According to the New York Times, 23andMe’s current situation is tied to a recent drop in value – from $6 billion in 2021 to less than $50 million last week, before the bankruptcy filing. This was due, in part, to fallout from a 2023 data breach in which Jewish and Chinese customers appeared to be targeted by hackers, who and gained access to personal information from nearly seven million profiles.

A class-action lawsuit subsequently accused the company of failing to notify those customers that they had been targeted. The company said in a statement at the time that it was taking steps to further protect customer data.

What to do if you want to remove your 23andMe account?

California Attorney General Rob Bonta on Monday issued a consumer alert advising Californians of their “right to direct the deletion of their genetic data” under the Genetic Information Privacy Act and California Consumer Protection Act.

Bonta’s advice included steps California 23andme account holders could take to have their account deleted, including how to retrieve their personal data prior to that request, which you can find below.

Does NH Have a Genetic Information Privacy Act?

Here in New Hampshire there has so far been no official word from the Attorney General’s office. But on Jan. 1, 2025 New Hampshire’s Data Privacy Act (RSA 507-H) went into effect, which does mention the procession of genetic or biometric data. An attempt Monday to reach the NH Attorney General’s office for more precise information for NH consumers was unsuccessful.

The text of the NH Data Privacy Act is attached as a pdf below.

We’ll bring you more information as it become available.

Guidance from California AG Rob Bonta:

How to Delete Genetic Data from 23andMe

1. Consumers can delete their account and personal information by taking the following steps:
2. Log into your 23andMe account on their website.
3. Go to the “Settings” section of your profile.
4. Scroll to a section labeled “23andMe Data” at the bottom of the page.
5. Click “View” next to “23andMe Data”
6. Download your data: If you want a copy of your genetic data for personal storage, choose the option to download it to your device before proceeding.
7. Scroll to the “Delete Data” section.
8. Click “Permanently Delete Data.”
9. Confirm your request: You’ll receive an email from 23andMe; follow the link in the email to confirm your deletion request.

To Destroy Your 23andMe Test Sample:

If you previously opted to have your saliva sample and DNA stored by 23andMe, but want to change that preference, you can do so from your account settings page, under “Preferences.”

To Revoke Permission for Your Genetic Data to be Used for Research:

If you previously consented to 23andMe and third-party researchers to use your genetic data and sample for research, you may withdraw consent from the account settings page, under “Research and Product Consents.” data-privacy-faqs-revised_0Download