This Is MS Multiple Sclerosis Knowledge & Support Community

23andMe is in trouble. What happens to all the DNA data?

September 25, 2024 4:21 PM ET

https://www.npr.org/2024/09/25/nx-s1-51 ... e-dna-data

Once a hot $6 billion biotech company, 23andMe is now on the verge of collapse. What could happen to the DNA data of its 14 million customers?

Ailsa Chang, Host:

The genetic testing company 23andMe went from biotech superstar to the brink of collapse. Its most valuable asset might be its DNA data. NPR's Bobby Allyn reports on what might happen to the genetic information of millions of people.

BOBBY ALLYN, BYLINE: It was an idea that caught on. Pay about a hundred bucks for a saliva kit and, weeks later, learn all about your ancestry. The company behind this, 23andMe, was a hit. It was worth billions, Oprah raved about it and countless people took to social media to share their experience, like TikToker Danielle Edwards (ph).

DANIELLE EDWARDS: OK, I did it y'all. I finally took my 23andMe kit. Whew, Jesus. All right, spitting in a tube, so I'm concentrating. I'm trying to think about anything but what I have to do, which is spitting in this tube.

ALLYN: More than 14 million people spit in a 23andMe tube. People were holding spit parties. The company was part of the zeitgeist. But there was one big business problem - nobody needed to do a 23andMe test twice. It was one and done. And now 23andMe's stock is worth pennies. Financial news networks like CNBC have been blaring the news.

UNIDENTIFIED REPORTER: It has since lost 99.9% of its value from its $6 billion market cap peak.

ALLYN: Then there were two other big blows. Last year, the company was hit with a major data breach of customer passwords. And last week, its entire board of directors resigned. Some analysts say 23andMe could go out of business by next year, which raises the question - what's going to happen with the genetic data it has from millions of people? Even if the company goes under, that data could change hands. That may surprise some customers.

ANYA PRINCE: They might believe that the information is more protected than it actually is.

ALLYN: That's Anya Prince. She's a law professor at the University of Iowa's College of Law who focuses on genetic privacy. She says federal health privacy protections like HIPAA don't apply here since 23andMe is outside of the health care realm. What the company does depends on what customers agreed to when they signed up for the service. Some states, like California and Florida, do give consumers rights over their genetic data.

PRINCE: If customers are really worried, they could ask for their samples to be withdrawn from these databases under those laws.

ALLYN: When I asked 23andMe what it plans to do with all the genetic data if it goes out of business, a spokesman wouldn't say. But he did mention a partnership with pharmaceutical giant GlaxoSmithKline, or GSK, which has been analyzing the data to try to find medical breakthroughs. 23andMe says 80% of customers opted into this kind of research when they signed up. The company says the data is anonymous. Prince thinks if people now are second-guessing that decision, they might be out of luck.

PRINCE: I couldn't go to GSK and say, hey, my sample was given to you - I want that taken out - if it was anonymized, right? Because they're not going to reidentify it just to pull it out of the database.

ALLYN: The 23andMe spokesman said the company is committed to being transparent with whatever happens to customer data, saying its core value is, quote, "behind every data point is a human being."

There’s Never Been a Better Time to Delete Your 23andMe Data. Here’s How to Do It

Published October 16, 2024

https://gizmodo.com/theres-never-been-a ... 2000512323

The troubled startup has records of millions of Americans' DNA and personal information.

23andMe, the well-known genomics company, has been in a downward spiral ever since it suffered a fairly catastrophic data breach last year. Ever since then, the company, which is headed by Sergei Brin’s ex-wife, Anne Wojcicki, has been enduring a maelstrom of controversy. Litigation, layoffs, and financial devastation have marred the business’s operations. As such, a lot of the company’s customers are looking to cut and run.

Understandably, people want to delete their accounts and purge whatever data the company has on them.

Unfortunately, 23andMe isn’t really going to delete all of your data.

Oh, sure, you can delete your account. There is a tutorial on the company’s website explaining how to do it.

However, MIT Technology Review reports that, while the company will technically erase your account, it plans to hang onto a chunk of the information associated with it. For instance, if you’ve previously consented to sharing your anonymized genetic data with third parties, there’s no way for you to delete that information. At the same time, the company will also retain a vague amount of your genetic information, as well as information about your sex, birthday, email address, and details about your account deletion request, MIT writes. According to 23andMe’s privacy policy, it retains your genetic and birthday information to fulfill regulatory requirements.

In short, the company will maintain evidence that your account existed, along with easily identifiable information (your DOB), your email contact, and, again, some amount of your genetic information.

If you would like to delete your account, you can do it through your Account Settings tab. Some identity verification may be necessary for you to complete this stage of the deletion request. You’ll get an email from the company asking for a confirmation that you want to delete your account. If you go through with the deletion process, the company notes that, once you’ve confirmed your decision, you won’t be able to go back on it.

[Continued]

23andMe says it faces financial hardships and has doubts it can still operate | Wed, Nov 13

https://www.nbcnews.com/nightly-news/vi ... 4394309582

The CEO of 23andMe said there was "substantial doubt" that the company could continue to operate and said 40 percent of its workforce would be cut. While some users may be concerned about their personal data, 23andMe says it's "committed to protecting customer data" and maintaining customer privacy.

NBC News' Stephanie Gosk reports.

23andMe has filed for bankruptcy. The time to delete your account is now.

Opt out: what to do with your 23andMe account after company filed bankruptcy

The genetic testing firm filed for bankruptcy after a major data breach. Here’s how to protect your DNA privacy

Tuesday March 25, 2025

https://www.theguardian.com/technology/ ... ta-privacy

The DNA testing company 23andMe has filed for bankruptcy after months of concern over its financial health and its ability to keep users’ genetic information secure. In light of the uncertainty looming over the company’s future, you should do one thing to protect your privacy today: delete your 23andMe account.

If you have used the service to discover your ancestry via your DNA, the extremely sensitive information you shared with 23andMe may transfer to the company’s eventual buyer. While 23andMe has a host of privacy controls that now allows users opt out of sharing their data with scientific researchers or requires the company delete their samples, that could change under a new owner.

Generally, privacy and civil liberties experts do not recommend using ancestry and DNA testing services. There are few federal privacy regulations that limit how companies can use your information in the US – even your genetic data. How a private company maintains, stores and shares your data is left up to the whims of the people running it. Privacy policies change often and so do executive suites. Not only is your data vulnerable to hacks, it can also be used for various commercial products and shared with law enforcement.

23andMe has insisted that any new owner would have to comply with existing laws around the sale and use of consumer genetic data, but the reality in the US is that only a handful of states legally protect this type of personal information. In California, where this kind of privacy protection does exist, the attorney general, Rob Bonta, has issued an urgent “consumer alert” encouraging Californians to delete their 23andMe data.

“California has robust privacy laws that allow consumers to take control and request that a company delete their genetic data,” said Bonta. “Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company.”

There’s good reason for concern. 23andMe suffered a massive hack affecting some 7 million users in 2023. The hackers first revealed they gained access to the information when they attempted to sell what they claimed was the data of 1 million users of Ashkenazi Jewish descent and 100,000 users of Chinese descent on a popular hacking forum. In addition to a class-action lawsuit alleging the company failed to notify users of the data breach in a timely manner, the company said it was facing more than 50 other lawsuits in the wake of the hack. Its problems are international, too: the UK information commissioner’s office issued a notice of intent to fine the company £4.59m earlier this month.

If you are one of 15 mllion people who have already handed over your DNA to 23andMe, what can you do to protect your data?

How to delete your 23andMe account

The main thing you should do to protect your genetic privacy: delete your account.

There’s a big caveat: the company says it will have to retain some information in its archives even if you delete your account. “23andMe and/or our contracted genotyping laboratory will retain your Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations … even if you chose to delete your account,” the company’s privacy policy reads.

If you’re reading this and you are trying to decide if you want to do a DNA test with one of these private companies, take the above caveat as a big reason not to. It’s possible, depending on what state you’re in, your data will never be completely erased.

That said, it is still worth making the effort to delete your account and all the data in it. Here’s how you do it: Log in, go to settings, and scroll to “23andMe Data”. Click “view” and then scroll to “delete data”. Click “permanently delete data”. You will receive an email from the company to confirm your request. (Check your spam folder.) If you don’t confirm it via the link provided to you in the email, it will not complete your request.

The company says that, once your account is deleted, you “will automatically opt you out of Research and discard your sample”.

If you don’t delete your account, opt out of sharing your data

If you want to keep your 23andMe account, the next best thing is have the company discard your sample, stop sharing your information and remove you from any future research studies. You can also do this from your settings.

To stop sharing any reports resulting from your DNA test, scroll down to “Privacy/Sharing” and click “edit”. From there you should be able to adjust the sharing settings on your reports.

To ask the company to discard your DNA sample, go back to your settings and scroll down to “preferences”, click “edit” and opt out of sharing your sample with the company. The company will discard your sample.

To stop the company from sharing your DNA with future research projects, go back to settings, scroll down to “research and product consents” and edit the permissions.

These changes are not retroactive. Withdrawing consent to use your DNA in studies will only stop your data from being used in new research and can take up to 30 days.

If you have any specific questions about your account information, you can also email privacy@23andme.com.

23andMe says it won permission from a judge to sell customers’ medical and ancestry data. Here’s how to delete yours

March 28, 2025 at 4:07 AM PDT

https://fortune.com/2025/03/28/23andme- ... ey-delete/

• Bankrupt 23andMe will be allowed to sell customers’ genetic data to other companies. The company claims its security measures surrounding the data will remain in place, but its privacy policy says it can change those procedures at any time. 23andMe customers do have a way to delete their genetic and ancestral data, however.

A U.S. bankruptcy judge ruled DNA-testing company 23andMe, which filed for bankruptcy Sunday, has the right to sell customers’ medical and ancestry data to potential bidders. Offers will be due on May 7, and a final hearing will be held in June.

Once the hottest start-up in Silicon Valley, shares for the San Francisco-based company soared as much as 158% on Thursday. Investors see the sensitive data of 23andMe’s 15 million customers as the company’s most valuable asset.

After 23andMe set hurried deadlines for potential bidders, U.S. Bankruptcy Judge Brian C. Walsh later delayed those dates by two weeks to gratify his schedule as well as to allow creditors a chance to evaluate before the court arrives at a decision.

While genetic data of 23andMe’s customers will be up for grabs, the company says security measures will remain in place surrounding customer data. The company will continue to be “transparent about the management of user data going forward, and data privacy will be an important consideration in any potential transaction,” board chairman Mark Jensen said in a statement.

According to the company’s privacy policy, in a bankruptcy, merger, or acquisition, sensitive customer data will carry the same contingencies, but the policy also mentions that these procedures can be changed at will. 23andMe emphasized any potential bidders must agree to comply with the company’s security measures concerning customer data, according to its privacy policy.

“There's health insurance companies that are interested in this data, there’s life insurance companies that are interested in this data,” California Attorney General Rob Bonta told ABC News7 earlier this week.

[Continued]

23andMe is potentially selling more than just genetic data. The personal survey info is also a privacy problem.

April 2, 2025 / 1:22 PM EDT

https://www.cbsnews.com/news/23andme-ge ... n-privacy/

As soon as the genetic testing company 23andMe filed for bankruptcy on March 23, 2025, concerns about what would happen to the personal information contained in its massive genetic and health information database were swift and widespread. A few days after, a U.S. judge ruled that the company could sell its consumer data as part of the bankruptcy.

The attorneys general of several states warned their citizens to delete their genetic data. California urged its citizens to request that 23andMe delete their data and destroy their spit samples. Michigan's attorney general released a statement warning that "23andMe collects and stores some of the most sensitive personal information, our genetic code."

When customers originally signed up for 23andMe, they agreed to terms and conditions and a privacy notice that allows the company to use their information for research and development as well as share their data, in aggregate, with third parties. If consumers consented to additional research, which the vast majority did, the company can additionally share their individual information with third parties. 23andMe has also been clear that if it is involved in a bankruptcy or sale of assets, consumer information might be sold or transferred.

While 23andMe has warned customers all along about everything that is currently happening, many are still surprised and concerned.

I'm a lawyer and bioethicist who has been studying direct-to-consumer genetic testing for almost a decade. Understanding what information 23andMe has been collecting, and how it might be used if sold or shared, can help clarify concerns for consumers.

What kind of data does 23andMe collect?

While the saying goes "If you're not paying, you're the product," 23andMe managed to convince its consumers to both pay for and be the product. It did this by selling genetic testing kits to consumers as well as collecting a massive amount of their valuable data.

And 23andMe collected more than just genetic data generated from consumers' spit. Eighty-five percent of customers consented to 23andMe research, allowing their individual-level data to be used for studies. The company then collected information from survey questions about their personal health and beyond, such as drinking habits and risk tolerance.

This means that not only does 23andMe possess the genetic data of 15 million people, but it also possesses almost a billion additional data points associated with this genetic information. This makes the 23andMe dataset potentially very private – and very valuable.

At first, drug companies seemed to agree. For example, in 2018, 23andMe granted pharmaceutical company GlaxoSmithKline an exclusive license to use consented customer data to develop new drugs. GlaxoSmithKline also made a $300 million equity investment in 23andMe. When 23andMe went public in 2021, its $6 billion valuation reflected the promise of this business model.

But for over a decade, scholars, including me, have been warning that allowing 23andMe to collect and use personal data was not one that customers fully understood, or were actually comfortable with.

~ ~ ~ ~ ~

What should 23andMe customers worry about?

In response to current public concern about data privacy, 23andMe has stated that there will be no changes to how it stores and protects data during its bankruptcy proceedings. But once that stage is through, what exactly should customers worry about?

First, law enforcement could use genetic information in civil or criminal cases. This happened in 2018, when police used the genetic testing company GEDmatch to help identify the Golden State Killer. Police pretended they were customers looking for genealogy data and sent in an old crime scene blood spot. This allowed them to connect to known suspects with blood relatives who had given their genetic information to the company as consumers. While this was in violation of GEDmatch's own policies, the evidence was successfully used in court.

Second, genetic information could be used to discriminate against customers if it shows that they have or are at high risk of developing a genetic disease or disorder. The federal Genetic Information Nondiscrimination Act prohibits health insurers and employers from asking about genetic information or using it to discriminate in work or health insurance decisions. It does not, however, protect against discrimination in long-term care or life insurance.

Many of the warnings from the media and attorneys general are focused on genetic information because it is unique to only one person. But direct-to-consumer genetic testing companies also retain a massive amount of personal information from the surveys consumers are asked to complete. Much of this information could be embarrassing if it were inadvertently or intentionally revealed, such as a person's intelligence.

In the 2025 book "Careless People," former Meta executive Sarah Wynn-Williams reported that Facebook would use indications of self-consciousness about personal appearance, such as deleting a selfie, to promote beauty products. If companies know such intimate details about a person, they could not only be used to sell products, but also potentially manipulate them over social media or the internet in ways they do not even realize. It could be used for targeted advertising or to build algorithms that exploit a person's vulnerabilities.

I believe consumers are right to be worried about how their genetic data could be misused. But the survey data containing all sorts of other personal information are at least as much, if not more, of a privacy problem. This is particularly concerning if the data is pooled together with other information available on the internet, like a dating profile, to create a more detailed – and personal – picture of an individual.

I am deleting my own 23andMe data. In the future, I would also warn consumers against freely gifting the private sector with information about their fears, hopes, limitations and successes.