Genetic testing company 23andMe in financial distress

[Paddy Casey]

OAKLAND — California Attorney General Rob Bonta today (March 21 2025) issued a consumer alert to customers of 23andMe, a genetic testing and information company. The California-based company has publicly reported that it is in financial distress and stated in securities filings that there is substantial doubt about its ability to continue as a going concern. Due to the trove of sensitive consumer data 23andMe has amassed, Attorney General Bonta reminds Californians of their right to direct the deletion of their genetic data under the Genetic Information Privacy Act (GIPA) and California Consumer Protection Act (CCPA). Californians who want to invoke these rights can do so by going to 23andMe's website.

See https://oag.ca.gov/news/press-releases/ ... -customers

If 23andMe goes bankrupt its assets, including its DNA data and saliva samples, could be bought by another entity. How such an entity might use/monetise that data is worth consideration.

UPDATE (24Mar2025): Popular DNA testing firm 23andMe has filed for bankruptcy protection, and announced that its co-founder and CEO, Anne Wojcicki, has resigned with immediate effect. The company will now attempt to sell itself under the supervision of a court. See https://www.bbc.com/news/articles/c9q4r9xy9wro

UPDATE (31Mar2025): MalwareByte has just published an article explaining how to delete your 23andMe data and also how to find your 23andMe data which was hijacked in the 2023 breach. The article can be found at https://www.malwarebytes.com/blog/news/ ... 023-breach

UPDATE (29 Apr 2025): 23andMe has agreed to allow a court-appointed overseer to take charge of ensuring customers' genetic data remains protected during the company's bankruptcy, settling a dispute with several U.S. states. Those states had argued the company was not taking data security seriously enough. 23andMe had initially proposed hiring a "customer data representative" who would have had a more limited focus on ensuring that a future sale of the company or its data complied with the company's existing privacy policies. But a group of more than 25 states objected, saying that 23andMe simply wanted to hire someone who would "tell this court everything is fine." See https://www.reuters.com/sustainability/ ... 025-04-29/

Questions are now being raised about acquisition and exploitation of the 23andMe data by the Peoples' Republic of China (see https://thehill.com/opinion/5278461-gen ... na-threat/ ).

19May2025: Pharmaceutical maker Regeneron announced Monday it will buy genetic testing company 23andMe for $256 million following a bankruptcy auction. Regeneron said it will acquire 23andMe’s genomics service and its bank of 15 million customers’ personal and genetic data as part of the deal. The pharma giant said it plans to use the 23andMe customer data to help drug discovery, and that it will “prioritize the privacy, security, and ethical use of 23andMe’s customer data.” See https://techcrunch.com/2025/05/19/pharm ... -for-256m/

What can consumers do to protect their data?

Customers should actively manage their data on 23andMe by reviewing policies, deleting data if desired, and staying vigilant about how their sensitive genetic information is used.

People that have submitted samples to 23andMe have three different options, each providing a different level of privacy.
1. Delete your genetic data from 23andMe

For 23andMe customers who want to delete their data from 23andMe (see https://www.malwarebytes.com/blog/news/ ... utical-org):

Log into your account and navigate to Settings.
Under Settings, scroll to the section titled 23andMe data. Select View.
You will be asked to enter your date of birth for extra security.
In the next section, you’ll be asked which, if there is any, personal data you’d like to download from the company (make sure you’re using a personal, not public, computer). Once you’re finished, scroll to the bottom and select Permanently delete data.
You should then receive an email from 23andMe detailing its account deletion policy and requesting that you confirm your request. Once you confirm you’d like your data to be deleted, the deletion will begin automatically, and you’ll immediately lose access to your account.

2. Destroy your 23andMe test sample

If you previously opted to have your saliva sample and DNA stored by 23andMe, but want to change that preference, you can do so from your account settings page, under “Preferences.”
3. Revoke permission for your genetic data to be used for research

If you previously consented to 23andMe and third-party researchers using your genetic data and sample for research, you may withdraw consent from the account settings page, under Research and Product Consents.

A US senator has questioned whether, when a 23andMe user tries to delete his/her genealogical data from the 23andMe database, that data is really deleted see https://youtube.com/watch?v=bDh_rJv_b1g ... RJn3H1Nm6b The replies from the 23andMe CEO leave doubt on this matter.