What’s Next for 23andMe? Bankruptcy Filing Raises Questions About Data Security

23andMe, the South San Francisco-based biotech giant that pioneered at-home genetic testing, filed for Chapter 11 bankruptcy, stoking privacy concerns for many of its more than 15 million customers.

The company announced Sunday that it plans to sell “substantially all of its assets” through a court-approved reorganization plan and said its CEO, Anne Wojcicki, who co-founded the company nearly two decades ago, is stepping down effective immediately but will remain on the company’s board.

As the company’s bankruptcy filing appeared imminent last week, California Attorney General Rob Bonta issued a consumer alert informing the company’s roughly 1.7 million customers in California of their right to delete the trove of genetic information collected about them.

“I want to remind people of their rights given this moment,” Bonta told KQED on Monday, a day after the company submitted its filing in a Missouri bankruptcy court. “They may not have the same guardrails and protections in place for privacy … as they do now.”

Bonta said he’s not going as far as telling customers to delete their data but that, as a 23andMe customer himself, he’s already begun the process of deleting his own data.

“It’s totally their decision about how they value their private data, what kind of risk they want to take on and are willing to absorb,” he said. “So that’s up to them, but I’m just reminding them of their unique rights here in California.”

The bankruptcy filing marks a striking reversal of fortune for the company, which just four years ago had a market value of $6 billion but has since struggled to contain mounting financial and operational challenges.

• Skip to a step-by-step guide on how to delete your 23andMe data 

Since it went public in 2021, 23andMe has struggled to find a profitable business model, which was made more challenging after a massive data breach in 2023 that spooked investors and customers.

“I’m concerned because of the past conduct of 23andMe,” Bonta said. “Even when they were operating at full capacity, having a massive data breach that affected half of their customers — seven million customers, 850,000 Californians — that’s a red flag, that’s a concern.”

Beyond the “inherent injury” in someone’s privacy being violated, breached data could be used by scammers in nefarious ways, including identity theft, someone posing as a relative and asking for money or targeting individuals based on their race or ethnicity.

Founded in 2006, the company is best known for its saliva-based DNA mail-in testing kits that quickly drew millions of customers eager to learn more about their ancestry. More recently, the company delved further into health research and drug development.

But amid ongoing financial woes, the company announced in November that it was laying off more than 200 employees — about 40% of its workforce — and would discontinue its therapeutics division.

Shares of the company have shed nearly all their value since last spring and plunged even farther after Sunday’s bankruptcy filing, trading at less than $1 as of midday Monday.

In recent securities filings, 23andMe continued to warn about its “ability to continue as a going concern.” In its Chapter 11 bankruptcy filing, the company reported total debts of nearly $215 million as of the end of last year.

In a statement on Sunday, Board Chair Mark Jensen said the court-supervised bankruptcy process was “the best path forward to maximize the value of the business.”

The company said it expects to continue regular business operations during the bankruptcy process but is also seeking court approval to reject lease contracts, including for properties in San Francisco and Sunnyvale, in an effort to reduce expenses.

The company assured customers that its bankruptcy filing will not change the way it stores or protects data.

23andMe “is committed to continuing to safeguard customer data and being transparent about the management of user data going forward,” Jensen added.

John Bringardner of Debtwire notes that a prospective buyer of 23andMe will have to comply with regulatory approvals that ensure “customer data won’t end up in unscrupulous hands.”

“Personal data collected by 23andme has always been at risk,” Bringardner wrote in an email on Monday, referencing the 2023 data breach.

Litigation spanning from the aftermath of the breach helped drive up liabilities, eventually contributing to the bankruptcy, he said. Last year, 23andMe agreed to pay $30 million in cash to settle a class-action lawsuit accusing it of failing to protect customers whose personal information was exposed in this breach.

On Sunday, the company said it plans to use the bankruptcy proceedings to “resolve all outstanding legal liabilities” stemming from the 2023 incident.

Hank Greely, a Stanford law professor, said it’s quite likely that customer data will be compromised as the company goes through bankruptcy and ultimately sells its assets. But in most cases, he doesn’t think the consequences will be all that significant.

“There is the non-concrete side of privacy violations. Even though it might not hurt me in any way, if somebody posted on the internet a photo of me sitting on the toilet, I would be more than annoyed,” he said. “There’s a violation of the privacy side to this. But the actual concrete applications, I think, of having the kind of genetic information that 23andMe has … are likely to be relatively small.”

Greely said there are few privacy protections in place when customer data is sold from one company to another, as is expected to happen during a bankruptcy proceeding. The privacy agreement between 23andMe and its customers, he said, only holds weight if the company continues to own the data.

But “if their assets get sold to a different company, the different company doesn’t necessarily have to follow the agreement,” he said, adding, in this case, the asset could be worth more if there are few privacy protections in place.

“And the asset being worth more is something bankruptcy courts are supposed to try to achieve,” he said.

To delete genetic data from 23andMe

1. Log into your 23andMe account on their website.
2. Go to the “Settings” section of your profile.
3. Scroll to a section labeled “23andMe Data” at the bottom of the page.
4. Click “View” next to “23andMe Data.”
5. Download your data: If you want a copy of your genetic data for personal storage, choose the option to download it to your device before proceeding.
6. Scroll to the “Delete Data” section.
7. Click “Permanently Delete Data.”

Confirm your request: You’ll receive an email from 23andMe; follow the link in the email to confirm your deletion request.

To destroy your 23andMe test sample:

If you previously opted to have your saliva sample and DNA stored by 23andMe but want to change that preference, you can do so from your account settings page under “Preferences.”

To revoke permission for your genetic data to be used for research:

If you previously consented to 23andMe and third-party researchers to use your genetic data and sample for research, you may withdraw consent from the account settings page under “Research and Product Consents.”

Under the Genetic Information Privacy Act, California consumers can delete their account and genetic data and have their biological sample destroyed. In addition, GIPA permits California consumers to revoke consent that they provided a genetic testing company to collect, use and disclose genetic data, as well as to store biological samples after the initial testing has been completed.

The Consumer Protection Act also vests California consumers with the right to delete personal information, including genetic data, from businesses that collect personal information from the consumer.

This story includes reporting from the Associated Press.