Delete your DNA from 23andMe right now

If you’re one of the 15 million people who shared your DNA with 23andMe, it’s time to delete your data.

The genetic information company, best known for its saliva test kits, announced Sunday it is headed to bankruptcy court to sell its assets. And 23andMe’s financial distress prompted California Attorney General Rob Bonta to issue an unusual privacy “consumer alert” about it Friday.

“I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company,” he said in a statement.

The company said there will be “no changes” to the way it protects consumer data while in bankruptcy court. But unless you take action, there is a risk your genetic information could end up in someone else’s hands - and used in ways you had never considered. It took me just a minute to delete my data on the 23andMe website, and I’ve got instructions on how to do it below.

It’s a privacy nightmare, but also an example of how state privacy laws pioneered in California can help protect Americans - at least the proactive ones.

Founded in 2006, 23andMe was a pioneer in the quest to unlock knowledge from the human genome. It offers customers information about their family tree and hereditary characteristics, while researching new kinds of treatments.

But in recent years, 23andMe has been slammed by simultaneous business and security challenges. It went public in 2021 but burned through its cash and watched its value drop from about $6 billion to around $50 million now.

In 2023, it had a data breach that affected some 7 million customers. Hackers used customers’ old passwords to gain access to information that in some cases included family trees, birth years and geographic locations.

In September, 23andMe’s board of directors quit after rejecting CEO Anne Wojcicki’s proposals to take the company private.

23andMe didn’t immediately respond to my questions. But in its Sunday filing announcing bankruptcy, it said it “intends to continue operating its business in the ordinary course throughout the sale process.”

---

How to delete genetic data from 23andMe

-- Log into your 23andMe account.

-- Go to your Profile, then tap Settings.

-- Scroll to the “23andMe Data” section at the bottom of the page and click View.

-- If you want to download your data, select what you want.

-- Scroll to the “Delete Data” section and click Permanently Delete Data.

-- Confirm your request: You’ll receive an email from 23andMe, and click the link in the email to confirm.

---

Bonta, the California attorney general, didn’t specify the risks of leaving your “trove of sensitive consumer data” with 23andMe. But privacy advocates I’ve spoken to have been watching the company’s challenges with concern on several fronts.

First, you are relying on 23andMe to keep your DNA safe from hackers. But that could be hard for any company to do under bankruptcy proceedings - and 23andMe has had plenty of security trouble in the past. (On its website, 23andMe says the company has achieved three certifications to demonstrate the strength of its security program.)

There’s also a risk that your data could get sold or transferred to a new company, which might want to use it for new purposes. The privacy statement of 23andMe seems to treat your data as a company asset that’s on the table like anything else. It reads: “If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction.”

On the website page to delete your data, 23andMe says: “If the company does change ownership in the future, your data will remain protected under the current 23andMe Privacy Policy unless and until you are presented with materially new terms, with appropriate advanced notice to review those material changes as required by law.”

A new owner could also try to change the company’s practices and privacy policy - and it would be on you to keep on top of the changes.

But you do have rights over your data before any of that comes to pass. The California Consumer Protection Act of 2018 gives you the right to delete data from businesses that collect it. While the law specifically applies to California residents, many other states have passed similar laws.

And California also has a separate law pertaining to DNA data, called the Genetic Information Privacy Act. It gives you the right to delete your account, have your biological sample destroyed, and revoke consent you may have previously given to use or disclose your genetic data.

Before you delete your data, you might want to choose to download some or all of it. If you do, just make sure you have a good way to store and keep it safe, too. Unlike a password or telephone number, this is data you’re stuck with for the rest of your life.