Genetic testing service 23andMe, known for providing customers with insights into their ancestry and health, has recently filed for Chapter 11 bankruptcy protection and announced its intention to sell the company.
This move has raised concerns among privacy advocates, urging customers to delete their genetic data from the platform to avoid potential misuse during the sale process.
The bankruptcy filing has left 23andMe’s 15 million customers wondering about the future of their sensitive genetic information. While the company has reassured users that its privacy policies will remain unchanged during the sale, the prospect of a new owner could lead to significant shifts in how data is handled.
Currently, 23andMe’s privacy policy states that the company does not sell identifiable genetic data without customer consent. However, the policy also includes a disclaimer that the company’s terms could change, especially in the event of a sale or acquisition. This flexibility has raised concerns, particularly for customers who shared personal genetic information with the company for health or ancestry purposes.
Experts warn that while 23andMe claims to protect data under its current policy, new owners may not adhere to the same privacy standards. Genetic data, which can reveal crucial information about a person’s health, family history, and potential genetic predispositions, is considered highly sensitive. There are concerns that a new owner might use this data for purposes beyond research or ancestry insights, including selling it to insurance companies or marketing firms.
California Attorney General Rob Bonta has raised alarms about the risks, noting that health and life insurance companies have shown interest in using such genetic information, despite laws like the Genetic Information Nondiscrimination Act (GINA) that limit discrimination in employment and health insurance. Life insurers, however, are not covered by these protections.
To protect your privacy, 23andMe users can delete their accounts and genetic data. Here are the steps to do so:
Log into your 23andMe account.
Navigate to your profile settings.
Scroll to the “23andMe Data” section at the bottom of the page and click “View.”
If you wish to download your data for personal use, you can do so here.
To delete your data, scroll to the “Delete Data” section and click “Permanently Delete Data.”
You will receive a confirmation email. Follow the link in the email to confirm the deletion.
If you had your saliva sample stored with the company, you can request that it be discarded under the “Preferences” section of your account settings. Additionally, you can withdraw consent for your genetic data to be used by third-party researchers through the “Research and Product Consents” section.
Deleting your data might be a proactive step in light of the uncertainties surrounding the company’s financial situation. Though the company has stated it will continue to protect customer data during bankruptcy proceedings, the reality is that, during a sale or acquisition, personal information might be transferred or sold to a new entity with different privacy practices.
Furthermore, if you live in California or another state with similar privacy laws, you have the legal right to request the deletion of your data. California’s Consumer Privacy Act (CCPA) and the Genetic Information Privacy Act provide protections that allow customers to delete their data, destroy biological samples, and revoke consent for data sharing.
23andMe’s financial difficulties, combined with past security breaches, have raised serious privacy concerns. In 2023, the company experienced a data breach that exposed information from millions of customers, intensifying fears over the safety of sensitive genetic data.
With input from CNN and the Washington Post.
