Protecting Your Genetic Data Amid 23andMe Bankruptcy and Sale

The recent bankruptcy of 23andMe, a leading DNA testing service, has sparked widespread concerns about the security and privacy of the genetic data belonging to its 15 million customers. In May, pharmaceutical giant Regeneron acquired 23andMe for $256 million following a bankruptcy auction, promising to maintain existing privacy practices while leveraging the data for drug discovery.

However, this transition has raised alarms among security experts, lawmakers, and customers. During a House Oversight Committee hearing, 23andMe’s interim CEO Joseph Selsavage revealed that approximately 1.9 million customers—about 15% of the user base—have requested deletion of their genetic data. Simultaneously, over two dozen states have filed lawsuits challenging the sale of customer data without explicit consent.

If you are among the millions who have shared your DNA with 23andMe, it’s crucial to understand your options for protecting your data. While complete deletion isn’t always possible due to legal retention requirements, you can take several important steps.

How to Delete Your 23andMe Data

To initiate data deletion, log into your 23andMe account and navigate to the Settings section. Scroll to the "23andMe Data" area, select "View," then find the "Delete Data" section. Click "Permanently Delete Data" and confirm your request via the email link sent to you. Before deletion, you may download a copy of your genetic data for your records.

It’s important to note that 23andMe’s privacy policy states the company will retain certain information such as genetic data, date of birth, and sex to comply with legal obligations. Additionally, limited account information and deletion request records may be kept for audit, compliance, and legal purposes.

Revoking Consent and Destroying Your DNA Sample

If you previously allowed 23andMe to store your saliva sample or use your genetic data for research, you can revoke these permissions through your account settings under "Preferences" and "Research and Product Consents." While you can withdraw consent for future use, previously collected data cannot be deleted retroactively.

Because genetic data is shared among relatives, it’s wise to encourage family members to review their own data privacy settings. Protecting your genetic information is a collective effort that extends beyond individual accounts.

The 23andMe case highlights the complex intersection of biotechnology, data privacy, and legal frameworks. As companies change hands and data usage evolves, customers must stay vigilant and proactive in managing their sensitive information.