23andMe, the DNA and genetic testing firm once hailed as a pioneer in genetic testing, is now grappling with a perfect storm of turmoil following a massive data breach and its ongoing financial decline. The company, recognized for its at-home saliva-testing kits that unveil a person’s genetic ancestry, is confronting potential bankruptcy, which raises serious questions about the security of genetic data belonging to its approximately 15 million customers.
After going public in 2021 at a valuation of around $6 billion, the company has seen its value plummet by more than 99%, now hovering around a grim $50 million. This drop was fueled by a marked decrease in consumer interest in its testing kits and struggles in expanding its subscription services. 23andMe's financial challenges deepened in 2023 when hackers stole sensitive ancestry information affecting almost 7 million users, leading the firm to settle a lawsuit related to the breach for $30 million.
In September 2023, just days after the settlement was announced, 23andMe's founder and CEO Anne Wojcicki hinted at possibly considering third-party takeover proposals, only to reverse her statement shortly after, opting instead to pursue taking the company private. However, this flip-flop resulted in the subsequent resignation of all independent board members, signaling deepening governance issues within the company.
Fast-forward to March 2024, 23andMe officially filed for bankruptcy protection, announcing plans for a court-supervised sale of its assets. This will include vast banks of sensitive DNA data collected from its customers during its operations. In a shocking turn, Wojcicki also stepped down amid mounting pressures surrounding the bankruptcy proceedings.
"If you’re one of the 15 million people who shared your DNA with 23andMe, it’s time to delete your data," advised a recent TechCrunch report, echoing sentiments from various privacy advocates and legal authorities. Privacy advocates warned that unless users act now, there is a significant risk that their genetic information could end up in the hands of companies that could utilize it in unforeseen ways.
California Attorney General Rob Bonta urged residents to take action, reminding them of their rights under state law to demand the deletion of personal data. "I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company," Bonta stated, heightening awareness about the sensitive nature of the information at stake.
23andMe has maintained that while in bankruptcy court, there will be "no changes" to how it protects consumer data. However, advocates stress that customers must not be complacent, asserting that it’s essential for customers to proactively delete their accounts. Reports have circulated detailing how easy it is to navigate the 23andMe platform to delete one’s account, with simple steps to follow.
Yet, users must be aware of the caveats. According to the company’s privacy policy, account deletions are subject to certain retention requirements and exceptions that may permit the company to retain some information indefinitely.
In spite of assurances, the fact remains that around 80% of 23andMe customers—roughly 12 million—have consented to participate in its research program, which raises the stakes. Those who have previously agreed to 23andMe's sharing of data for research purposes will find that, unfortunately, there is no way for them to delete information already provided.
As Ginny Fahs, director of product R&D for Consumer Reports’ Innovation Lab noted, "This is some of the most precious data that exists about you; you’re right to be concerned that it may be up for grabs.”
The California Consumer Privacy Act of 2018 provides a legal framework allowing consumers to delete information held by businesses, including genetic testing companies. California’s Genetic Information Privacy Act specifically gives power to consumers to delete their account and biological samples. This capability empowers customers to exert control over how their precious genetic data is handled.
Advocacy groups are growing wary of the potential implications if 23andMe data were to come under new ownership. The company’s privacy statement has previously stated: “If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold, or transferred as part of that transaction.” This sentiment stirs apprehension among customers about how their data may be used under new management.
As customers contemplate the uncertainty regarding data ownership and potential misuse, privacy advocates emphasize the importance of staying proactive. While customers can take steps now to protect their information, the long-term implications for whether their genetic information remains secure are still very much in question as this saga continues to unfold.
While current customers of 23andMe might find comfort in assurances that data policy will remain intact under bankruptcy, the reality of corporate processes often overshadows such commitments. As 23andMe navigates through this storm, a cloud of uncertainty lingers over the fate of millions of individuals’ genetic information.
