Once hailed as a pioneer in consumer genetics, 23andMe made it easy to unlock insights about ancestry, health risks, and inherited traitsall from a saliva sample. But now, with the company filing for Chapter 11 bankruptcy, a much bigger concern has surfaced: Data Privacy. Millions of users are left asking the same urgent questionwhat happens to our DNA when the company holding it goes under?
This isn’t just a business story. It’s a digital privacy crisis wrapped in biotech. A high-profile data breach in 2023, a dramatic drop in valuation, and growing regulatory scrutiny have turned 23andMe’s future into a cautionary tale. At the center of it all is your genetic informationdeeply personal, impossible to change, and suddenly at risk. This article explores how 23andMe got here, what it means for your data, and how the current legal and compliance landscape offersor fails to offerprotection.
How 23andMe Roseand Then Fell
Founded in 2006 by Anne Wojcicki, 23andMe aimed to democratize access to genetic testing. The company was among the first to market a direct-to-consumer DNA testing kit, offering ancestry analysis and health risk reports without a doctor’s visit. With backing from major investors and a $300 million partnership with pharmaceutical giant GlaxoSmithKline in 2018, the company became a household name and amassed over 14 million customers globally.
But the business model faced growing challenges. Regulatory hurdles around health claims, rising competition, and ethical concerns around data commercialization led to a decline in public trust. Then, in 2023, the situation worsened. A major breach exposed the data of nearly 7 million users, including sensitive genetic and personal information. That same year, the company’s share price tumbled below $1, eventually slipping into penny stock territory.
In March 2025, 23andMe officially filed for Chapter 11 bankruptcy. CEO Anne Wojcicki stepped down but remains on the board and reportedly plans to buy back parts of the business. For customers, however, the biggest concern isn’t who will own the companybut who might access their genetic blueprint.
Why Genetic Data Is Uniquely Risky
Your genetic data is not like a phone number or even a Social Security number. It cannot be changed. This information contains deeply personal details about health, ancestry, and biological relationships. Genetic records can reveal predispositions to disease, mental health conditions, and inherited traits that affect not only one individual, but entire families.
If this data falls into the wrong hands, the consequences can be permanent. It could be used by insurers, employers, hackers, or foreign entities. It might even be re-identified, even if anonymized. That’s why a company’s collapseespecially one holding DNA recordsis not just a financial event. It’s a privacy emergency.
California Attorney General Issues Public Warning
In the wake of 23andMe’s bankruptcy, California Attorney General Rob Bonta issued a stark advisory. He urged all 23andMe usersparticularly California residentsto delete their data from the platform and formally request the destruction of their DNA samples.
He reminded consumers that California law offers powerful privacy protections, including the right to know what data companies collect and the right to delete it. But the responsibility to act often falls on the consumer, especially when a company is undergoing bankruptcy and may transfer data assets to new owners.
The urgency of this call stems from fears that personal genetic data may be sold, misused, or insufficiently protected during bankruptcy proceedings.
How to Permanently Delete Your 23andMe Data
If you’re a 23andMe customer and want to protect your genetic information, here are the recommended steps:
- Log into your account at 23andMe.com.
- Go to your Settings page.
- Scroll down to the “23andMe Data” section.
- Select “Permanently delete data” and confirm the request.
- Contact customer support to request the destruction of your physical DNA sample.
- Revoke any research consent you may have previously given.
Make sure you receive a confirmation email. Screenshot all deletion requests in case future legal proof is needed.
What Happens to Genetic Data During Bankruptcy?
During bankruptcy proceedings, a company’s assetsincluding its datacan be sold or transferred to other parties. That includes customer databases, which often represent a significant portion of a firm’s value. In 23andMe’s case, this database contains millions of genetic profiles tied to personally identifiable information.
While 23andMe has stated that customer privacy will remain a top priority, legal protections can become murky during bankruptcy. Creditors may push for asset sales, and new owners may have different policies. Although U.S. bankruptcy courts sometimes impose restrictions on how data can be used or sold, it’s not guaranteed.
Consumers should not wait to see what happens. They should act now to remove their information before any potential transfer occurs.
Understanding Applicable Compliance and Privacy Laws
With genetic data, compliance is not just about internal policyit is also shaped by a patchwork of state, federal, and international regulations. Here’s an overview of the key laws that apply:
1. California Consumer Privacy Act (CCPA) and CPRA
CCPA gives California residents the right to:
- Know what personal data is being collected
- Request deletion of their personal data
- Opt-out of data sharing or selling
Under the California Privacy Rights Act (CPRA), genetic data is classified as “sensitive personal information,” giving it additional protections. Organizations must notify consumers before collecting or selling this data and allow them to opt out.
2. Genetic Information Nondiscrimination Act (GINA)
Enacted in 2008, GINA prohibits health insurers and employers from using genetic information to discriminate against individuals. However, GINA does not apply to life insurance, disability insurance, or long-term care providers. Nor does it cover how genetic data is stored or sold.
3. Health Insurance Portability and Accountability Act (HIPAA)
HIPAA protects health-related data shared with healthcare providers, but it does not extend to most consumer genetic testing companies, including 23andMe. This gap means that users of direct-to-consumer platforms have fewer legal protections than patients in clinical settings.
4. General Data Protection Regulation (GDPR)
For customers in the European Union, GDPR provides strict protections:
- Explicit consent must be obtained for genetic data collection
- Users have the right to erasure (“right to be forgotten”)
- Companies must ensure data security and report breaches quickly
Although 23andMe mainly operates in the U.S., it must comply with GDPR for EU customers. However, enforcement becomes complicated once a company files for bankruptcy or changes ownership.
Ethical Questions Around Genetic Data Ownership
Even with legal frameworks in place, deeper ethical questions persist. Who truly owns your DNA once it’s submitted? Can a company monetize your genetic blueprint if you gave consent years ago? If a firm is sold, should the new buyer inherit the right to your genetic profile?
While 23andMe gave users options to opt-in or opt-out of research programs and data sharing, the lines often blur. Informed consent in the digital age is complex, and most users don’t read or fully understand the implications of long privacy policies.
This bankruptcy highlights the need for a broader conversation about genetic rights, data ethics, and what protections are needed when companies fail.
What Other Genetic Testing Companies Can Learn
For the wider industry, this moment should serve as a wake-up call. Transparency, data portability, deletion policies, and zero-knowledge storage must become standard practice. Companies like Ancestry.com and MyHeritage should re-evaluate their disaster recovery plans, data compliance programs, and customer communications.
Investors and consumers alike will be watching closely. Future success in the genetic testing space will depend not only on scientific credibility but on rock-solid trust.
Conclusion: Take Control While You Still Can
The collapse of 23andMe represents far more than a financial failure. It serves as a wake-up call for consumers who entrusted tech-driven companies with deeply personal information. The situation highlights what can happen when innovation outpaces regulation and when biometric data protection is treated as an added feature instead of a core responsibility. In the case of 23andMe, millions of users shared genetic information believing it would remain secure. With the company now in bankruptcy and its future uncertain, the risk to that data and to personal privacy is immediate and real.
Anyone who has used 23andMe should take steps now to regain control over personal information. This includes deleting accounts, revoking consent for research use, and formally requesting the destruction of stored DNA samples. While these actions cannot undo past exposure, they can reduce future risk. Consumers should also closely monitor bankruptcy proceedings, particularly any developments involving asset sales or data transfers. Genetic information is permanent and uniquely identifying, which makes strong biometric data protection essential. Acting quickly is not just prudent, it is necessary to safeguard long-term privacy in an increasingly exposed digital environment.
