The once-dominant DNA testing company 23andMe is facing a crisis. In just a few short years, the company has gone from a pioneering leader in consumer genetics to a firm teetering on the brink of collapse. Following a massive 2023 data breach that exposed the sensitive genetic and ancestry information of nearly 7 million users, combined with an ongoing financial decline, 23andMe now faces a precarious future—one that could have significant implications for the personal data of its 15 million customers.
The Rise and Fall of 23andMe
Founded with the promise of providing consumers with unprecedented insights into their ancestry and genetic traits, 23andMe revolutionized at-home DNA testing. The company’s easy-to-use saliva-based test kits quickly gained popularity, allowing people to discover their ancestral roots and potential genetic predispositions to certain health conditions.
However, despite its initial success, 23andMe has struggled to remain profitable. After going public in early 2021 with a staggering $6 billion valuation, the company has since seen its stock plummet by over 99%. The decline was fueled by waning consumer interest in one-time-use DNA test kits and the failure of its subscription-based model to generate sustainable revenue. Additionally, the company’s ambitious foray into pharmaceutical research proved costly and unfruitful.
Adding to its woes, 23andMe suffered a catastrophic months-long data breach in 2023, which resulted in hackers stealing vast amounts of user data, including genetic information, personal details, and ancestry records. In response, the company faced multiple lawsuits and ultimately agreed to a $30 million settlement. Just weeks later, 23andMe’s founder and CEO, Anne Wojcicki, made headlines when she announced that the company was considering third-party takeover proposals—only to retract her statement shortly thereafter, claiming she planned to take the company private instead. The damage, however, was already done. The fallout led to the immediate resignation of all independent board members, signaling a deepening crisis.
By March 2024, 23andMe filed for bankruptcy protection, setting the stage for a court-supervised sale of its assets—including its vast database of genetic information. With Wojcicki stepping down as CEO, the company’s future remains uncertain, leaving customers questioning what will happen to their sensitive genetic data.
Who Controls Your DNA?
One of the most alarming aspects of 23andMe’s decline is the potential sale of its user data. Many customers may have assumed that their genetic information was protected under strict privacy laws such as the Health Insurance Portability and Accountability Act (HIPAA), which safeguards sensitive health information. However, 23andMe operates outside of HIPAA regulations and is primarily governed by its own privacy policies—policies that it can modify at any time.
This legal loophole means that the personal and genetic information of millions of users could be up for grabs in a bankruptcy sale. According to the company’s own privacy policy, customer data “may be accessed, sold, or transferred” in the event of a merger, acquisition, reorganization, or sale.
While 23andMe has stated that its privacy policies will remain intact even in the event of a sale, potential buyers may have entirely different plans. The company has already signaled a shift away from its costly drug development programs to focus instead on monetizing its vast DNA database by selling genetic insights to pharmaceutical companies and researchers. Critics argue that such a move raises ethical concerns about who ultimately has control over this highly personal data and how it might be used in the future.
The Privacy Risks of a Sale
The prospect of 23andMe’s genetic database changing hands has alarmed privacy advocates, who warn that the data could fall into the wrong hands. Some fear that law enforcement agencies could gain access to the information, using it to build genetic profiles for criminal investigations—potentially leading to wrongful accusations based on familial DNA matches.
Concerns have also been raised about how insurance companies or employers might attempt to use genetic data in ways that could lead to discrimination. While 23andMe has long maintained that it does not share user data with insurance companies or law enforcement without a legal warrant, a new buyer may not uphold the same standards. With millions of people’s genetic blueprints on the table, the stakes have never been higher.
What Can You Do?
As 23andMe faces bankruptcy, there is growing pressure for customers to take control of their data before it’s too late. Some privacy advocates and cybersecurity experts strongly recommend that users delete their accounts and remove their genetic data from the company’s servers as a precautionary measure.
If you have a 23andMe account, you can request the deletion of your data by following these steps:
- Log in to your 23andMe account.
- Navigate to Settings > Account Information > Delete Your Account.
- Confirm your decision. (Note: Deleting your account is permanent and cannot be undone.)
However, it’s important to understand the fine print. According to 23andMe’s privacy policy, account deletion is subject to certain retention requirements. This means that some data—such as your genetic information, date of birth, and gender—may be retained for compliance purposes. Additionally, if you previously consented to your genetic data being used for research, that data will not be removed even if you delete your account.
The Future of Consumer DNA Testing
The downfall of 23andMe serves as a cautionary tale about the risks of entrusting highly personal genetic information to private companies. While at-home DNA testing has provided valuable insights to millions of people, it has also exposed users to significant privacy and security risks. As the industry continues to evolve, there is a pressing need for stronger federal regulations to ensure that genetic data remains protected from misuse.
For now, if you’ve ever used 23andMe’s services, it may be wise to take proactive steps to safeguard your data. Whether that means deleting your account, revoking research consent, or simply staying informed, the choices you make today could have lasting implications for your genetic privacy.
In a world where data is the new currency, protecting your DNA may be more important than ever.
