23andMe is looking to sell customers' genetic data. Here's how to delete it

After nearly two decades in business, San Francisco-based 23andMe filed for Chapter 11 bankruptcy protection on Sunday and said it would pursue a sale – a sale that could put genetic data of millions of customers at risk. The company an its assets – including that extremely sensitive DNA data  — will likely soon be up for grabs to the highest bidder.

North Carolina's Attorney General's Office was already investigating the company for how it handled a 2023 data breach that compromised information for nearly 7 million people.

“There’s health insurance companies that are interested in this data, there’s life insurance companies that are interested in this data,” California Attorney General Rob Bonta told ABC News7 on Monday.

At least while the company goes through the sale process, it says it won’t change how it manages or protects customer data. And 23andMe board chair Mark Jensen said in a statement that “data privacy will be an important consideration in any potential transaction.”

But the company's website says that a new owner could change privacy policies.

The safest bet is to download your data, and request that 23andMe delete the data from their system and destroy the original test sample on file.

"We are encouraging everyone, while there is still time and while this website still exists, go on there, delete your account, protect your data," North Carolina Attorney General Jeff Jackson said.

23andMe privacy — and why it matters

23andMe has tried to reassure customers by pointing to its privacy policy, which currently states that the company won’t sell customers’ identifiable genetic data, and that they’ll only share data with researchers if customers opt in.

The privacy policy states that if users’ data is sold as part of a bankruptcy or acquisition, the same provisions will apply to that personal information under the new entity. But the policy also states that it can be changed at any time.

“That’s just standard language in companies’ privacy policies,” Anya Prince, law professor at the University of Iowa College of Law, said in an interview with CNN’s Terms of Service podcast.

And that matters because people’s DNA can reveal more than just insights into their family history — it could also be used, for example, to tell something about their future health outlook. Data from online genetics services have also been used by law enforcement to help solve crimes, although 23andMe’s current policy says it won’t share information with police without a legally valid warrant.

There is a federal law, the Genetic Information Nondiscrimination Act, that prohibits employers and health insurances companies from discriminating based on genetic information, but the law is not “foolproof” and doesn’t apply to life insurance companies and other types of services, Prince said.

“Theoretically, the new company could have a similar ethos that the consumer feels good about, but the new company might have a completely different ethos,” Prince said.

Three steps to delete your data from 23andme

To delete data from 23andMe, customers should log in to their account and navigate to the “Settings” section of their profile. At the bottom of the page, click on “23andMe Data,” and then “View.” Users can then download their genetic data for their own, personal use before scrolling to the “Delete Data” section and clicking “Permanently Delete Data.”

Delete genetic data from 23andMe

1. Log into your 23andMe account on their website.
2. Go to the “Settings” section of your profile.
3. Scroll to a section labeled “23andMe Data” at the bottom of the page.
4. Click “View” next to “23andMe Data”
5. Download your data: If you want a copy of your genetic data for personal storage, choose the option to download it to your device before proceeding.
6. Scroll to the “Delete Data” section.
7. Click “Permanently Delete Data.”
8. Confirm your request: You’ll receive an email from 23andMe; follow the link in the email to confirm your deletion request.

Destroy your 23andMe test sample

If you previously opted to have your saliva sample and DNA stored by 23andMe, but want to change that preference, you can do so from your account settings page, under “Preferences.”

Revoke permission for your genetic data to be used for research

If you previously consented to 23andMe and third-party researchers to use your genetic data and sample for research, you may withdraw consent from the account settings page, under “Research and Product Consents.”

Bonta warned that consumers could encounter a slow or glitchy website when they go to delete their information, but encouraged them to keep trying.

“I was attempting to delete my data today, and the website was down today at times,” Bonta said, adding that the outage may have been caused by heavy traffic to the site with many people seeking to delete their data.

A 23andMe spokeman told WRAL News: "Our website experienced some issues and delays due to increased traffic yesterday. As of today (Tuesday), those issues have been resolved. If anyone has any issues in regards to accessing their account or deleting their data, they can go to our customer care site for support."