Users of 23andMe, a direct-to-consumer genetic testing service, are being advised to delete their personal data from the platform following the company’s bankruptcy filing in the United States on March 23.
Here’s why this is significant.
What happened to 23andMe?
If 23andMe’s bankruptcy is approved, the company will soon be up for sale after years of financial difficulties.
Since its founding in 2006, the company has collected genetic information from approximately 15 million users—a dataset that could now be sold to the highest bidder.
23andMe initially offered services related to family ancestry and genetic traits, later expanding into tests for genetic predispositions to cancer and other diseases.
More recently, the company attempted to shift its focus to drug research.
In 2021, 23andMe went public with a $3.5 billion valuation, partly to fund this new direction.
However, challenging economic conditions and declining sales left the company financially unstable.
In October, it laid off 40 percent of its workforce and now faces delisting from the NASDAQ after its stock price fell below $1 this week.
What are the current risks to users?
In an open letter to its customers, 23andMe assured that the bankruptcy “does not change how we store, manage, or protect customer data,” adding that any potential buyer would be “required to comply with applicable law with respect to the treatment of customer data.”
Despite this assurance, the attorneys general of New York and California have urged residents to log into the site and delete their data.
Arthur Caplan, head of the Division of Medical Ethics at the NYU Grossman School of Medicine, expressed skepticism about 23andMe’s promises.
“If 23andMe really goes bankrupt and someone buys its assets, then their promises of confidentiality go out the window. The buyer isn’t bound to follow what 23andMe said,” Caplan told Al Jazeera.
“They can share data, and given that DNA analysis is even better now than it was 10 years ago when all this collection started, they might be able to identify people.”
Is 23andMe data protected by US law?
Unlike the European Union, the US lacks a comprehensive federal data privacy law. Instead, data protection relies on a patchwork of state laws and industry-specific regulations.
Like other DNA home-testing companies, 23andMe is not covered by the Health Insurance Portability and Accountability Act (HIPAA), the primary legislation governing the privacy of health records, because it is not classified as a medical company.
Data from companies like 23andMe can also be obtained by law enforcement through a warrant or subpoena.
In one of the most high-profile cases involving a home-testing service and law enforcement, California investigators in 2017 used an unnamed genealogy website to identify Joseph James DeAngelo as the “Golden State Killer,” a prolific serial murderer active between the mid-1970s and mid-1980s.
Why is 23andMe controversial?
Even before its bankruptcy, 23andMe faced criticism for its data security practices.
In 2023, hackers breached the company’s systems and accessed the information of nearly 7 million users. The company was later forced to pay $30 million in a class-action lawsuit over the breach.
The company’s scientific claims have also been questioned.
Caplan said 23andMe’s claim that it can reveal meaningful information about ethnic heritage is misleading because DNA can only provide a limited window into someone’s ancestry.
“It didn’t make sense to me that you could find out your ancestry from a genetic test because much of the information needed, including where your ancestors were living and what groups they were mingling with 200 years ago, we just don’t know,” Caplan said.
“Genes do not sort out by cultural categories like Lithuanian or Panamanian. There’s no Costa Rican gene.”
“I always thought the company was collecting the DNA because it wanted to sell it for research,” Caplan added.
“The whole idea of ancestry testing and finding out about your past was almost a bait and switch: ‘We’ll give you this cool information if you give us your DNA.’”
Who might buy 23andMe?
As part of its bankruptcy proceedings, 23andMe has announced a 45-day bidding period for its assets.
Former CEO and co-founder Anne Wojcicki has resigned from her position to submit her own bid for the company.
“We’ve had many successes, but I equally take accountability for the challenges we face today,” Wojcicki said in a post on X on Monday.
“There is no doubt that the challenges faced by 23andMe through an evolving business model have been real, but my belief in the company and its future is unwavering.”
Since last year, Wojcicki has submitted several offers to a special committee of independent directors to take the company private, but these were rejected over share-price concerns.
How can users delete their data?
If you’re concerned about your data, here’s how you can delete it:
- Log into your 23andMe account
- Go to “Settings”
- Select “23andMe Data”
- Click “View”
- Scroll to the option “Delete Data”
- Click on “Permanently Delete Data”
- Approve the request.
Stay updated with the latest news by visiting ZTC News and ZNews Today. Explore more stories and insights on these platforms!