Genetic testing company 23andMe, once a Silicon Valley darling valued at $6 billion, filed for Chapter 11 bankruptcy protection late Sunday as it prepares for a sale of the business. CEO Anne Wojcicki, who cofounded the company in 2006, has also stepped down after months of failed attempts to take the firm private.
As uncertainty about the company’s future reaches its peak, all eyes are on the trove of deeply personal—and potentially valuable—genetic data that 23andMe holds. Privacy advocates have long warned that the risk of entrusting genetic data to any institution is twofold—the organization could fail to protect it, but it could also hand over customer data to a new entity that they may not trust and didn’t choose.
California attorney general Rob Bonta reminded consumers in an alert on Friday that Californians have a legal right to ask that an organization delete their data. 23andMe customers in other states and countries largely do not have the same protections, though there is also a right to deletion for health data in Washington state’s My Health My Data Act and the European Union’s General Data Protection Regulation. Regardless of residency, all 23andMe customers should consider downloading anything they want to keep from the service and should then attempt to delete their information.
“This situation really brings home the point that there is still no national health privacy law in the US protecting your rights unless you live in California or Washington,” says Andrea Downing, an independent security researcher and cofounder of the patient-led digital rights nonprofit The Light Collective. “Meanwhile, we continue to evolve our understanding of how genetic information has value, but also has unique vulnerability.”
John Verdi, senior vice president of policy at the Future of Privacy Forum, says 23andMe’s new owner could revise the company’s privacy policies for new customers and new data collection, but the data it has already collected from current customers is subject to existing terms. “The company has legal obligations regarding information collected under the current policies,” he says.
Still, researchers emphasize that in practice, such a large transition will create real data exposure that is outside of 23andMe customers’ control. “In my opinion, these privacy policies—especially in the context of acquisitions in the venture capital and private equity space—aren’t worth the paper they’re printed on,” says longtime security researcher and data privacy advocate Kenn White. “For regular people out there who use these services, you’re pretty much on your own. My advice is to request your data get deleted as soon as possible”
To delete your genetic data through 23andMe’s website, log in and then go to Settings in your profile. Scroll to 23andMe Data and then click View. At this point, you can choose to download a copy of your genetic information. Then scroll to Delete Data and click Permanently Delete Data. Once you initiate the process, you’ll receive an email from 23andMe to confirm. Click the link in the email to complete the deletion process. Additionally, you can direct 23andMe to destroy the biological sample it used to extract your DNA data if you previously authorized the company to keep it. Go to Settings and then Preferences.
You can also opt in to and out of participating in research at any time by updating your consent status in your account settings. If you opt out, 23andMe will stop using your information for research going forward and will discontinue use of your data within 30 days. This does not affect studies that have already been completed.
23andMe has never been profitable and has struggled to revamp its business model since it went public in 2021. Demand for its ancestry and health testing kits has been declining for years. And data privacy has had a role to play in the company’s dwindling fortunes after the company was hit with a major data breach in December 2023 that affected millions of customers. The incident led to a class action lawsuit, which 23andMe agreed to settle for $30 million.
Last summer, Wojcicki filed a proposal to take the company private, which was rejected by 23andMe’s board of directors. Shortly after, the company shuttered its in-house drug discovery unit, and its board members resigned en masse over Wojcicki’s strategic direction.
23andMe says it intends to continue operating as usual throughout the sale process and that there are no immediate changes to the way it stores, manages, or protects customer data. In an open letter to customers, the company said it will “seek to find a partner who shares our commitment to customer data privacy and allows our mission of helping people access, understand and benefit from the human genome to live on.” But the direction of 23andMe will ultimately be in the hands of whoever takes over the company.
“If there is a new owner that comes out of the bankruptcy process, that new owner steps into the shoes of 23andMe and takes over those assets,” says Jennifer Wagner, an assistant professor of law, policy, and engineering and anthropology at Penn State University.
“They would still be bound by the complex web of contractual agreements that are in place right now with users,” Wagner adds. “But I think it does give rise to some uncertainty in terms of whether or not a new player would have the same values or that same kind of culture that 23andMe was trying to cultivate.”
Updated 7:15 pm ET, March 24, 2025 to correct the date 23andMe formally went public.
