The DNA testing company 23andMe has filed for Chapter 11 bankruptcy protection, which could involve selling off customer data. For that reason, privacy advocates and the U.S. state of California are warning 23andMe customers to delete their information as soon as possible.
23andMe has been a popular DNA test for years, providing genetic testing kits that provide information about a person’s ancestry and possible hereditary diseases. The company went public in 2021, but never turned a profit, and a 2023 data breach impacted private information for almost seven million customers. 23andMe paid $30 million to settle a lawsuit related to the security breach, which probably didn’t help its financial situation.
23andMe’s Uncertain Future
The company said in a press release, “23andMe is seeking authorization from the Court to commence a process to sell substantially all of its assets through a chapter 11 plan or pursuant to Section 363 of the U.S. Bankruptcy Code. If approved by the Court, the Company, with the assistance of an independent investment banker, would actively solicit qualified bids over a 45-day process. […] Any buyer will be required to comply with applicable law with respect to the treatment of customer data and any transaction will be subject to customary regulatory approvals, including, as applicable, approvals under the Hart-Scott-Rodino Act and the Committee on Foreign Investment in the United States.”
Put simply, 23andMe is hoping to exit bankruptcy by finding a buyer for the entire company, or at least most of its current assets. That could involve the same type of data that was leaked in 2023, which included customer names, birth years, the percentage of DNA shared with relatives, ancestry reports, relationship labels, and family tree information.
The press release mentioned a potential buyer should “comply with applicable law with respect to the treatment of customer data,” but the United States does not have strong privacy laws on a federal level. The bankruptcy courts and 23andMe’s investors will want the company sold off for as much money as possible, above all other priorities.
Anne Wojcicki is also stepping down as Chief Executive Officer of 23andMe, but she will remain on the company’s board.
California Says Delete Your Data
Before 23andMe confirmed its bankruptcy, the State of California Department of Justice issued an alert to California customers of 23andMe, reminding them that they have the legal right to have their personal data deleted and genetic material destroyed.
The department said, “The California-based company has publicly reported that it is in financial distress and stated in securities filings that there is substantial doubt about its ability to continue as a going concern. Due to the trove of sensitive consumer data 23andMe has amassed, Attorney General Bonta reminds Californians of their right to direct the deletion of their genetic data under the Genetic Information Privacy Act (GIPA) and California Consumer Protection Act (CCPA). Californians who want to invoke these rights can do so by going to 23andMe’s website.”
The California Consumer Protection Act only directly applies to customers in California, but some other states have laws with similar requirements, such as Colorado. The customer support page on 23andMe’s website says, “While we will delete the majority of your Personal Information, we are required to retain some information to comply with our legal obligations.”
If you’re a 23andMe customer, you can visit the “23andMe Data” section of your account settings to see options for downloading and deleting data. However, unless you live in a state that legally requires the full deletion of all personal data on request, that may not fully erase everything.
Source: TechCrunch, State of California, BBC, 23andMe
