THE WASHINGTON POST: Why you should delete your DNA from 23andMe right now

If you’re one of the 15 million people who shared your DNA with 23andMe, it’s time to delete your data.

The genetic information company, best known for its saliva test kits, announced Sunday that it is headed to bankruptcy court to sell its assets. And 23andMe’s financial distress prompted California Attorney General Rob Bonta to issue an unusual privacy “consumer alert” about it Friday.

“I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company,” he said in a statement.

The company said there will be “no changes” to the way it protects consumer data while in bankruptcy court. But unless you take action, there is a risk your genetic information could end up in someone else’s hands — and used in ways you had never considered. I have instructions on how to do it below.

It didn’t take me long to delete my data. The company’s website was not working for some users on Monday morning — perhaps because of the number of people trying to scrub their information. But it appeared to improve in the afternoon.

The situation is a privacy nightmare but also an example of how state privacy laws pioneered in California can help protect Americans — at least the proactive ones.

Founded in 2006, 23andMe was a pioneer in the quest to unlock knowledge from the human genome. It offers customers information about their family tree and hereditary characteristics, while researching new kinds of treatments.

But in recent years, 23andMe has been slammed by simultaneous business and security challenges. It went public in 2021 but burned through its cash and watched its value drop from about $6 billion to around $50 million now.

In 2023, it suffered a data breach that affected some 7 million customers. Hackers used customers’ old passwords to gain access to information that in some cases included family trees, birth years and geographic locations.

In September, 23andMe’s board of directors quit after rejecting CEO Anne Wojcicki’s proposals to take the company private.

On Sunday, Wojcicki resigned from her position as CEO, but she is still a member of the company’s board. She resigned to pursue another bid to buy the business, she said in a post on X.

23andMe didn’t immediately respond to my questions. But in its Sunday filing announcing bankruptcy, it said it “intends to continue operating its business in the ordinary course throughout the sale process.”

How to delete genetic data from 23andMe

• Log into your 23andMe account.
• Go to your Profile, then tap Settings.
• Scroll to the “23andMe Data” section at the bottom of the page and click View.
• If you want to download your data, select what you want.
• Scroll to the “Delete Data” section and click Permanently Delete Data.
• Confirm your request: You’ll receive an email from 23andMe, and click the link in the email to confirm.

The privacy risks

Bonta, the California attorney general, didn’t specify the risks of leaving your “trove of sensitive consumer data” with 23andMe. But privacy advocates I’ve spoken to have been watching the company’s challenges with concern on several fronts.

First, you are relying on 23andMe to keep your DNA safe from hackers. But that could be hard for any company to do under bankruptcy proceedings — and 23andMe has had plenty of security trouble in the past. (On its website, 23andMe says the company has achieved three certifications to demonstrate the strength of its security program.)

There’s also a risk that your data could get sold or transferred to a new company, which might want to use it for new purposes.

The privacy statement of 23andMe seems to treat your data as a company asset that’s on the table like anything else.

It reads: “If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction.”

On the website page to delete your data, 23andMe says: “If the company does change ownership in the future, your data will remain protected under the current 23andMe Privacy Policy unless and until you are presented with materially new terms, with appropriate advanced notice to review those material changes as required by law.”

A new owner could also try to change the company’s practices and privacy policy — and it would be on you to keep on top of the changes.

“The DNA data could be used to discern your relatives and ancestry, unearth family secrets, and reveal clues about diseases you have or could be predisposed to. If the data makes its way to certain insurers, they may deny you coverage or charge you more for life, disability, or long-term care insurance because of your genetics,” said Ginny Fahs, director of product R&D for Consumer Reports’ Innovation Lab.

“This is some of the most precious data that exists about you; you’re right to be concerned that it may be up for grabs,” she said.

Connecticut Attorney General William Tong told me he has the same concerns. “Given the sensitivity of this data, the previous breach and the precarious finances of the company, consumers may decide the best course of action would be to just delete their data so the company no longer has it,” he said.

Fortunately, you have legal rights to do that. The California Consumer Privacy Act of 2018 gives you the right to delete data from businesses that collect it. While the law specifically applies to California residents, many other states, including Connecticut, have passed similar laws. Most companies now implement the policies required in those places across the nation.

California also has a separate law pertaining to DNA data called the Genetic Information Privacy Act. It gives you the right to delete your account, have your biological sample destroyed, and revoke consent you may have previously given to use or disclose your genetic data.

When you request to delete your data, a confirmation email from 23andMe says it also automatically discards your sample and unenrolls you from research programs.

Before you delete your data, you might want to choose to download some or all of it. If you do, just make sure you have a good way to store and keep it safe. Unlike a password or telephone number, this is data you’re stuck with for the rest of your life.

© 2025 , The Washington Post