23andMe goes bankrupt and faces data privacy concerns
Add Axios as your preferred source to
see more of our stories on Google.
The 23andMe campus in Sunnyvale. Photo: Justin Sullivan via Getty Images
Genetic testing company 23&Me has declared bankruptcy, and California Attorney General Rob Bonta is urging people who used the service to delete their data from the platform.
Why it matters: The Bay Area-based company was one of the first to commercially offer autosomal DNA testing for ancestry. But its financial distress sparks a big question for its 15 million customers: What does a sale mean for the genetic data 23andMe stores?
State of play: The lack of a repeat incentive for people to keep testing DNA was part of the company's downfall — for many customers, they spit in a tube, received their results and moved on from their data.
- Now, that data, experts have noted, is effectively up for sale — though 23andMe stresses "any buyer will be required to comply with applicable law with respect to treatment of customer data."
- The company's bankruptcy filing is intended to facilitate its sale.
Driving the news: Bonta is urging Californians to "consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company."
- "California has robust privacy laws that allow consumers to take control and request that a company delete their genetic data," he said in a statement.
- A Sunday open letter from the company notes that customers can still delete their data and account. The company says it will "automatically opt you out of Research and discard your sample."
The other side: 23andMe spokesperson Ann Sommerlath told Axios via email that there will be no changes to the way the company stores, manages or protects customer data.
The big picture: 23andMe helped make the Bay a pioneer in the biotech space.
- Linda Avey, Paul Cusenza and Anne Wojcicki founded the company in 2006 with the hope of accelerating medical research by asking customers to opt in to studies on conditions like Parkinson's and asthma.
- 85% chose to opt in, according to Wojcicki, who said on X that she plans to be an independent bidder.
- It faced scrutiny in 2023 after hackers stole personal data belonging to 6.9 million users.
How it works: Customers can delete their account within their settings, according to the company's customer care page.
- Scroll to the section titled "23andMe data" and select view. Users can download information they want to keep before permanently deleting anything. More comprehensive instructions are available here.
Caveat: In the case of bankruptcy, mergers, acquisitions or other forms of reorganization, 23andMe says, personal information "may be accessed, sold or transferred."
- The company's privacy policies would apply to personal information transferred to a new entity, according to a March article published in the New England Journal of Medicine.
- But that new entity, the paper states, "could create new terms of service."
Between the lines: While the HIPAA protects patients' health information in the U.S., people interacting with 23andMe aren't covered by it because they are "customers" rather than "patients," the authors wrote.