Whether in search of relatives, a family's country of origin, or to understand personal disease risk, 15 million people have shared their DNA with 23andMe since the genetic test site launched in 2006.
But now those who gave their saliva in exchange for genetic information and family history are being urged by California Attorney General Rob Bonta to request that the Sunnyvale-based company delete their data and destroy any samples of their genetic material.
That followed news on Sunday that the biotech company once valued at $6 billion had started voluntary Chapter 11 proceedings in the US Bankruptcy Court for the Eastern District of Missouri—and that CEO Anne Wojcicki had resigned from her role effective immediately, to be replaced temporarily by Joseph Selsavage, 23andMe’s chief financial and accounting officer.
“California has robust privacy laws that allow consumers to take control and request that a company delete their genetic data,” Bonta said in a statement on Friday, when news about the company's fate began to circulate. “Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company.”
Previously, in 2023, 23andMe came under fire following a massive data breach affecting 7 million customers that led to a class action lawsuit and a $30 million settlement. In 2024, all seven independent board members of the biotech company resigned, citing hesitancy over Wojcicki’s strategy for the company.
In light of the most recent events, it's important for consumers to request the deletion of their data—particularly since HIPAA, which protects Americans' sensitive health information, does not apply to direct-to-consumer genetic tests, experts warn.
“In the United States, if you’re talking about genetic data that’s generated outside of the health care setting, there’s a relatively low baseline of protection,” Dr. James Hazel, a postdoctoral fellow at the Center for Genetic Privacy and Identity in Community Settings, told the New York Times. “And that’s provided generally by the Federal Trade Commission. So the Federal Trade Commission, although it’s not specific to genetic data, has the ability to police unfair and deceptive business practices across all industries. Other than that, there are really no laws in the United States that apply specifically.”
What data does 23andMe have?
After providing a saliva sample and consenting to 23andMe’s at-home testing, the company will have your registration information, such as sex and date of birth. It will also have genetic information, the percentage of your DNA that comes from all parts of the world, traits such as eye and hair color, along with health predisposition and carrier status. You can find more information about the data collected in the company's privacy statement.
How do I delete my personal information from 23andMe?
It is possible to delete your information from 23andMe. Under “Settings,” go to “23andMe Data,” and select “Delete Your Data.”
“While we will delete the majority of your personal information, we are required to retain some information to comply with our legal obligations,” reads the company’s website, which refers users to their privacy statement. After deleting your information, you must confirm your request via email.
According to the company, once this step is completed, your information won’t be used for research even if you opted in to 23andMe Research; and if you agreed to have your sample saved, it will also be destroyed.
“Customers always have the option to delete their account at any time, and can elect to do so from their account settings,” a company spokesperson told Fortune. “Once we confirm the request, we will immediately and automatically begin the deletion process.”
