23andMe Goes Bankrupt: What’s Going To Happen To People’s DNA Data?

23andMe was founded in 2006, and since then, millions of people have spit in a tube and sent it off to the company to find out what their DNA can apparently say about their ancestry and/or health.

However, the company announced on March 23 that not only was CEO and co-founder Anne Wojcicki resigning, but that it was also filing for bankruptcy protections, meaning it would be supervised by a court while seeking a suitable buyer for the business.

This wasn’t unexpected – 23andMe has been in financial trouble for a good while. With doubts over the company’s future looming and what that means for the data they’ve stacked up – not just personal information like birth dates and zip codes, but people’s genetic information – some officials had been encouraging customers to be proactive.

Two days before the company’s bankruptcy announcement, Rob Bonta, Attorney General for California – where 23andMe is based – issued a consumer alert last Friday (March 21) advising state residents to consider deleting their accounts and genetic data.

“California has robust privacy laws that allow consumers to take control and request that a company delete their genetic data,” said Bonta. “Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company.”

In its bankruptcy announcement, 23andMe stated that there were currently “no changes to the way the Company stores, manages, or protects customer data.” 

Mark Jensen, chair of the company’s board of directors, added: “[W]e are committed to continuing to safeguard customer data and being transparent about the management of user data going forward, and data privacy will be an important consideration in any potential transaction.”

But that statement won’t have been reassuring to everyone – this isn’t the first time that 23andMe has faced issues over its handling of data. Back in 2023, hackers stole personal information – although not DNA records – from around 6.9 million users.

Understandably, people are concerned about what might happen to their data now. While this is somewhat uncharted territory, the possible sale of people’s genetic data has long been one of the glaring ethical issues in the field of direct-to-consumer genetic testing – which means that experts have also been exploring the answers to what might happen in such a situation.

According to the authors of a recent perspective on the matter (published before 23andMe went bankrupt), there aren’t many protections in place for consumers to stop their data from being sold on the basis of privacy – 23andMe isn’t beholden to Health Insurance Portability and Accountability Act (HIPAA), for example, because its customers aren’t classed as “patients”.

It doesn’t end there either.

“23andMe’s privacy statement reserves the company’s right to transfer customers’ personal information in the event of a sale of the company or bankruptcy. Customers can’t fully protect their data from being ‘accessed, sold or transferred as part of that transaction’,” the authors explain.

“The company’s privacy statement would apply to personal information that is transferred to a new entity after the transaction, but that entity could create new terms of service, including a new privacy statement, and ask customers (who often don’t read these long and difficult-to-understand terms) to agree to them.”

“If 23andMe goes bankrupt, these data will most likely be sold to the highest bidder,” the authors conclude.

Of course, people could still do what Bonta has suggested and delete their accounts – but that doesn’t mean their data will have disappeared entirely.

“Data that have already been used in research can no longer be retracted,” explain the authors. “23andMe also intends to retain certain information, including information on sex, birth dates, and genetic information, for legal compliance purposes.”

What will actually happen next is unclear for now, but the prospect that some data may inevitably make it through the cracks begs another important question – whoever ends up with 23andMe’s treasure trove of information, what might they be able to do with it? 

But don’t worry, we’ve got that one covered too.