Millions of People Using Popular DNA Testing Site Urged to ‘Delete Data Now’ After New Warning Is Issued

If you’ve ever taken a DNA test with 23andMe, you might want to take a closer look at your account. The company, known for helping millions trace their ancestry and explore their genetic health, is now facing a serious financial crisis. With a bankruptcy filing, a CEO resignation, and mounting concerns about data security, 23andMe’s future is uncertain—and so is the fate of your personal genetic information. California’s Attorney General has issued a stark warning to users, urging them to consider deleting their data. But what exactly is at risk, and what should you do about it?

What Happened to 23andMe

Founded in 2006 with a mission to revolutionize the way we understand genetics, 23andMe became a household name by offering easy-to-use saliva-based DNA test kits. With millions of customers worldwide, the company made a mark in both the consumer health and genetic testing space. However, despite its initial success, 23andMe has faced a series of financial and operational challenges in recent years.

In 2023, the company was hit with a major blow when hackers exposed the personal data of nearly seven million customers. This breach, coupled with an inability to find a sustainable business model, has sent the company’s stock price plummeting and left investors concerned. In response, 23andMe attempted to turn things around by going public in 2021, but struggles persisted. These financial woes ultimately led to the company filing for Chapter 11 bankruptcy protection, which allows it to restructure its debts while searching for a potential buyer.

But the company’s troubles didn’t stop there. Along with the bankruptcy filing, 23andMe’s co-founder and CEO, Anne Wojcicki, announced her resignation, further fueling uncertainty about the company’s future.

Why You Should Be Concerned About Your Genetic Data

The core of the growing concern revolves around the safety and future handling of the genetic data you’ve entrusted to 23andMe. While the company has assured customers that it remains committed to safeguarding their information, the reality is that data protection can become a secondary concern when a company is navigating bankruptcy and restructuring.

1. Potential for Data Sale or Transfer:
In the event of bankruptcy or acquisition, 23andMe’s privacy policy allows for the transfer or sale of personal data. This means that your genetic information could potentially end up with another company, which might use it in ways you never intended. Given the lack of comprehensive privacy protections in the genetic testing industry, your data could be sold to third parties without sufficient safeguards in place.

2. Data Vulnerability During Financial Struggles:
As 23andMe grapples with financial instability, cybersecurity experts have raised concerns that the company may not have the resources or motivation to defend against data breaches effectively. This vulnerability increases the risk of your personal genetic information being exposed or exploited by malicious actors, especially with hackers already having compromised millions of customer profiles in a 2023 breach.

3. The Legal Grey Area of Genetic Information:
Unlike medical records, genetic data isn’t protected under the same strict privacy laws, such as HIPAA in the U.S. This gap leaves your genetic data more susceptible to misuse. For example, insurers, employers, or even law enforcement could gain access to this information, potentially leading to discrimination or unwanted investigations. The fact that genetic data is immutable—offering a permanent record of your biological traits—makes it particularly sensitive and personal.

What Actions You Can Take to Protect Your Data

Image Credits: Website @23andME

If you’re concerned about your genetic information now that 23andMe is in financial distress, there are several steps you can take to regain control and protect your data. California’s Attorney General, Rob Bonta, has strongly recommended that users take action to delete their data and destroy any genetic samples that may be on file. Here’s a simple guide to help you do that:

1. Deleting Your 23andMe Account and Data
If you want to remove your genetic data entirely, follow these steps to delete your account:

• Log into your account: Go to 23andMe’s website and log in with your credentials.
• Navigate to your account settings: From your profile, go to the “Settings” section.
• Access 23andMe Data: Scroll down to the “23andMe Data” section and click “View.”
• Download your data: If you want to keep a copy of your genetic information for personal use, choose the option to download your data to your device before deletion.
• Permanently delete your data: Scroll to the “Delete Data” section and click “Permanently Delete Data.” You’ll then need to confirm your request via an email that 23andMe will send you.

Image Credits: Website @23andME

2. Requesting the Destruction of Your DNA Sample
In addition to deleting your data from their systems, you may also want to ensure that your saliva sample is destroyed. To do this:

• Go to your Preferences: In the same settings menu, look for the “Preferences” section.
• Select the option to destroy your sample: You can update your preference to have your genetic material destroyed by 23andMe.

3. Revoking Consent for Future Research
23andMe uses genetic data for research purposes, but if you no longer want your information to be used for research, you can revoke consent:

• Research and Product Consents: Navigate to this section in your account settings.
• Revoke future permissions: Uncheck any boxes that allow your data to be used in future research.

4. Stay Informed and Take Action if Needed
It’s important to stay updated on 23andMe’s bankruptcy proceedings and any changes in its privacy policies. Keep an eye out for any further guidance or updates from the company, regulators, or legal authorities. Depending on what happens with 23andMe’s assets or new ownership, you may need to take additional steps to ensure your data remains protected.

What Could Happen to Your Data After Deletion

Even if you take the step to delete your 23andMe account and data, it’s important to understand that the process may not entirely eliminate all traces of your genetic information. While 23andMe offers a straightforward method for users to delete their data, certain aspects of your information may remain retained for various legal or operational reasons.

1. Retained Information for Legal Compliance
23andMe’s privacy policy specifies that certain limited information may still be retained even after you delete your account. This includes data required to comply with legal obligations. For example, the company may need to keep records such as your genetic information, date of birth, and sex to satisfy regulatory or legal requirements, even after you request deletion. So, while your account and research data may no longer be accessible, some basic identifiers could still be stored.

2. Data Used in Published Research
Another important consideration is that once your genetic information has been used in research or shared in a dataset, it’s not possible to fully retract or erase it. If you consented to allow your genetic data to be included in research studies, it may already be part of published papers or databases. In these cases, although 23andMe will stop using your data for future research, any research that has already been completed will not be reversible.

3. The Impact of Company Ownership Changes
If 23andMe is acquired by another company or sold off as part of its bankruptcy process, your data could be transferred to the new owner. While 23andMe has pledged that any new owner would have to comply with data privacy laws, there’s still some uncertainty about what might happen in the future. It’s possible that your data could be accessed, used, or even sold by the new company, especially if privacy protections are weakened under new ownership.

4. The Risks of Data Exploitation
Lastly, there’s the risk that your data might still be exploited in ways you didn’t anticipate. Even if 23andMe ensures that your account and genetic data are deleted from their systems, genetic information is inherently permanent. If your data is sold, transferred, or exposed in any way—whether through a data breach, a company sale, or regulatory loopholes—it could end up in the wrong hands. This is particularly concerning if it gets into the hands of entities without your explicit consent, like insurance companies, employers, or even law enforcement.

The Urgent Need to Protect Your Genetic Data

With 23andMe’s bankruptcy filing, the growing concerns about the future of your genetic data are understandable. While the company promises to continue safeguarding user information, the risks tied to financial instability and potential ownership changes cannot be ignored. If you value the privacy of your genetic data, now may be the time to take proactive steps to protect yourself. Deleting your account, revoking research permissions, and requesting the destruction of your DNA sample are essential moves to ensure your information remains as secure as possible.

However, as we’ve seen, even deleting your data might not be enough to guarantee complete protection. The legal and technological realities surrounding genetic data make it difficult to fully erase its impact once it’s been collected. The best course of action? Stay informed, take control, and weigh your options carefully. The future of your personal data may depend on it.

Featured Image Credits: Website @23andME