The Office of the Attorney General of the United States (US) state of California has issued a notice advising 23andMe customers to request that the company, which has recently declared itself insolvent, delete their personal data, destroy their test samples, and revoke permission for their data to be used in other investigations. 23andMe is a US company founded in 2006, funded by Google, and specialising in genetic analysis for health and ancestry tests. It is known for sending test kits directly to consumers and publishing the results on its online platform.

In March, 23andMe declared bankruptcy. Following this, it requested court authorisation to begin a process of selling “practically all its assets,” according to the company. Anne Wojcicki, the Chief Executive Officer (CEO), announced her resignation after the bankruptcy announcement. However, she confirmed that she will continue to be a member of the company’s board of directors. Nonetheless, even if the business has filed for bankruptcy, 23andMe intends to continue operating normally throughout the sales process, announcing that there have been no changes in the way it stores, manages, and protects its customers’ data.

“We are committed to continuing to safeguard customer data and being transparent about the management of user data going forward, and data privacy will be an important consideration in any potential transaction,” the company explained in a statement.

Concerns rise over genetic data exposure

Some privacy experts, including academics from Harvard, Cambridge, the University of Illinois Urbana-Champaign, the College of Law, and the EU Center, have expressed concerns over user data now that the company’s assets are for sale. They fear this information could fall into the hands of cybercriminals and expose the genetic data of individuals who have trusted 23andMe’s services. Moreover, concerns about possible data exposure could be well-founded, as hackers accessed the genetic information of 6.9 million 23andMe users through a data breach in 2023, leading to a US$30 million settlement in a class-action lawsuit.

Now, the Office of the Attorney General of California has issued a consumer alert, advising 23andMe customers to request the deletion of their data, destroy their DNA samples, and revoke permission for their data to be used for research purposes.

How to delete your 23andMe data

To delete their data, users have to login into their 23andMe website account, access the settings section in their profile, select the 23andMe data option at the bottom of the page, and click the view button. In this interface, it is also possible to download data for those who wish to keep a copy of their genetic information on their devices. Otherwise, users should click the continue button and finalise the action with the delete data permanently option. The deletion request is confirmed via email. The destruction of samples is also ordered through the settings page, while to revoke permission for genetic data to be used for other research purposes, users must access the research and product consents section.