Your DNA for Sale: How 23andMe’s Collapse Threatens Genetic Privacy

A 23andMe Fire Sale might well include your genetic information. Here’s what you can do about it.

For those who aren’t aware, 23andMe is a service through which individuals can explore their ancestry and genetic makeup, using targeted DNA sequencing analysis technology. Basically, the user mails in a vial of their own saliva and 23andMe analyzes its unique DNA markers, revealing the user’s personal ancestry and providing certain health-related reports. It’s kinda nifty. But for those considering the service: Maybe think again.

23andMe was founded in 2006 and initially became a Silicon Valley Success Story—going public in 2021 and boasting an estimated value of over $3.5 billion at its peak. However, due to an inherent lack of medium to long-term sustainability (little possibility of repeat customers and a competitive market), the company has found itself in dire straits of late, culminating in a sharp decline in its stock price in November 2024. Since then, bankruptcy has appeared inevitable, with the company laying off over 40% of its workforce in the last 4 months.

You see, another issue with 23andMe’s business model lies in the intrinsically personal nature of DNA—many Americans have expressed unease at the prospect of entrusting someone else with their genetic information. As has been well documented in recent years, even the most sophisticated and well-protected corporations are prone to hacking and data leakages. If 23andMe were the victim of such a breach, the results could be disastrous if users’ genetic data were to fall into the hands of unethical or malicious actors (more on that below).

Unfortunately for those who have already subscribed to 23andMe, this fear might soon become a reality—and it won’t take a hacker or a data breach to do so.

**UPDATE** — Shortly (a couple minutes) after this article was written, 23andMe filed for Chapter 11 Bankruptcy.

23andMe (and possibly them, too)

You see, upon signing up for the service, all 23andMe users agreed to the company’s Privacy Policy. The policy states: (1) the company may not transfer the user’s genetic data to a 3^rd party without the user’s consent, and (2) genetic data cannot be used for a different purpose (i.e. a purpose other than generating your genetic reports) without the user’s consent.

However—that same policy contains a caveat, stating that if [23andMe] is involved “in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction.” Meaning, the user has already consented to the transfer of his/her genetic info in the (now relatively likely certain) event that the company goes bankrupt.

In theory, part (2) of the excerpted Privacy Policy would still apply—the purchaser of that genetic information would still be prevented from using the data for a different purpose (like research or advertising). But the realities of bankruptcy law muddy the waters considerably.

Often, in a bankruptcy sell-off, courts will ‘cleanse’ the company’s assets of liabilities—aiming to maximize the value of the assets and the subsequent payout to creditors. In the event 23andMe goes bankrupt, its users’ genetic information would become an asset subject to liquidation like any other. If the bankruptcy courts prioritize creditor recovery over consumer privacy interests, they might ‘cleanse’ the genetic information of its main ‘liability’—the Privacy Policy and restrictions on use. Meaning the purchaser could use the genetic data for any purpose they desire.

So What?

The gamut of potential misuses of 23andMe users’ genetic data ranges from the annoying (genetically-informed advertising, etc.) to the catastrophic (a genetically-tailored bioweapon capable of targeting select members of a given population). Others have warned against the use of such genetic information to inform insurance carriers about high-risk populations, thus affecting coverage rates or availability.

How realistic are each of these sci-fi-sounding scenarios? I have no idea. (I’m a lawyer, not a scientist). But, eerily, the Attorney General of California (where 23andMe is incorporated) recently warned Americans who have already used the service to delete their data immediately (see instructions on how to do so below). That grim warning likely pushed the company even closer to bankruptcy. More concerningly, though, it suggests this isn’t some fringe ‘conspiracy theory’ or speculative paranoia—it’s a scenario that’s looking increasingly likely with each passing day.

23andMe Users: Instructions on How to Delete Your Data

To permanently delete your data from 23andMe, follow these steps based on the company’s official process:

**Timing Tip** If you are a current subscriber and you want both your data deleted and your subscription canceled, cancel the subscription first. Deleting your data will cause you to lose access to your account, meaning you’ll be unable to cancel your subscription online and may still be charged. If you’ve already deleted your data (and lost account access)—contact 23andMe Customer Care directly at customercare@23andme.com or through their support line (1-800-239-5230, available Monday-Friday, 9 AM-5 PM PT).

1. Log into Your Account: Sign in to your 23andMe account.

2. Navigate to Settings: Once logged in, click on your profile name or initials in the top right corner, then select "Settings" from the dropdown menu.

3. Access 23andMe Data Section: In the Settings menu, scroll down to "23andMe Data" and click "View." You may be prompted to enter your date of birth for verification.

4. Download Your Data (Optional): Before deletion, you have the option to download your genetic data (e.g., raw data, ancestry reports). Select the data you’d like to save and follow the prompts to download it to a personal device. Note: Do this on a secure, private computer, not a public one.

5. Initiate Deletion: Scroll to the bottom of the "23andMe Data" page and click the "Permanently Delete Data" button.

6. Confirm via Email: 23andMe will send an email to the address linked to your account with details about their deletion policy and a confirmation link. Check your inbox (and spam folder) for this email, then click the confirmation link to finalize your request. This step must be completed within 24 hours, or you’ll need to restart the process.

7. Deletion Process Begins: Once confirmed, the deletion starts immediately, and you’ll lose access to your account. The process can take up to 30 days to fully complete.

Best of Luck!

- The Whole Truth