Users of 23andMe, a direct-to-consumer genetic testing site, are being urged to delete their personal data from the website following the company’s bankruptcy filing in the United States on March 23.
Here’s why it matters.
What happened to 23andMe?
If 23andMe’s bankruptcy goes through, it will soon be up for sale after years of financial troubles.
Since its founding in 2006, the company has amassed the genetic information of about 15 million users – a dataset that is now potentially up for sale to the highest bidder.
23andMe offered services related to family ancestry and genetic traits, gradually expanding into tests for genetic predispositions to cancer and other diseases.
More recently, the company sought to pivot into drug research.
In 2021, the company went public with a $3.5bn valuation, partly to raise funds for this new direction.
However, tough economic conditions and declining sales left the company financially unstable.
In October, it laid off 40 percent of its workforce and now faces delisting from the NASDAQ after its stock price fell below $1 this week.
What are the current risks to users?
In an open letter to its customers, 23andMe insisted that the bankruptcy “does not change how we store, manage, or protect customer data”, adding that any potential buyer would be “required to comply with applicable law with respect to the treatment of customer data”.
Despite this promise, the attorneys general of New York and California have urged residents to log onto the site and delete their data.
Arthur Caplan, the head of the Division of Medical Ethics at the NYU Grossman School of Medicine, expressed scepticism about 23andMe’s promises.
“If 23andMe really goes bankrupt and someone buys its assets, then what’s going to happen is their promises of confidentiality go out the window. The buyer isn’t bound to follow what 23andMe said,” Caplan told example.com.
“They can share data, and given the fact that DNA analysis is even better now than it was 10 years ago when all this collection started, they might be able to identify people.”
Is 23andME data protected by US law?
Unlike the European Union, the US lacks a comprehensive federal data privacy law. Instead, data protection relies on a patchwork of state laws and industry-specific regulations.
Like other DNA home-testing companies, 23andMe is not covered by the main piece of legislation governing the privacy of health records, the US Health Insurance Portability and Accountability Act – better known as HIPAA – because it is not classified as a medical company.
Data from companies like 23andMe can also be obtained by law enforcement under a warrant or subpoena.
In one of the most high-profile cases involving a home-testing service and the authorities, California investigators in 2017 used an unnamed genealogy website to identify Joseph James DeAngelo as the “Golden State Killer,” a prolific serial murderer who was active between the mid-1970s and mid-1980s.
Why Is 23andMe controversial?
Even before its bankruptcy, 23andMe faced criticism for its data security practices.
In 2023, hackers broke into the company’s systems and accessed the information of nearly 7 million users. The company was later forced to pay $30m in a class action lawsuit over the breach.
The company’s scientific claims have also been questioned.
Caplan said 23andMe’s claim that it can reveal meaningful information about ethnic heritage is misleading because DNA can only provide a limited window into someone’s ancestry.
“It didn’t make sense to me that you could find out your ancestry from a genetic test because much of the information needed, including where your ancestors were living and what groups they were mingling with 200 years ago, we just don’t know,” Caplan said.
“Genes do not sort out by cultural categories like Lithuanian or Panamanian. There’s no Costa Rican gene.”
“I always thought the company was collecting the DNA because it wanted to sell it for research,” Caplan added.
“The whole idea of ancestry testing and finding out about your past was almost a bait and switch: ‘We’ll give you this cool information if you give us your DNA.’”
Who might buy 23andMe?
As part of its bankruptcy proceedings, 23andMe has announced a 45-day bidding period for its assets.
Former CEO and co-founder Anne Wojcicki has resigned from her position to submit her own bid for the company.
“We’ve had many successes, but I equally take accountability for the challenges we face today,” Wojcicki said in a post on X on Monday.
“There is no doubt that the challenges faced by 23andMe through an evolving business model have been real, but my belief in the company and its future is unwavering.”
Since last year, Wojcicki has submitted several offers to a special committee of independent directors to take the company private, but those were rejected over share-price concerns.
How can users delete their data?
If you’re concerned about your data, here’s how you can delete it:
- Log into your 23andMe account
- Go to “Settings”
- Select “23andMe Data”
- Click “View”
- Scroll to the option “Delete Data”.
- Click on “Permanently Delete Data”.
- Approve the request.
