California attorney general Rob Bonta reminded consumers in an alert on Friday that Californians have a legal right to ask that an organization delete their data. 23andMe customers in other states and countries largely do not have the same protections, though there is also a right to deletion for health data in Washington state’s My Health My Data Act and the European Union’s General Data Protection Regulation. Regardless of residency, all 23andMe customers should consider downloading anything they want to keep from the service and should then attempt to delete their information. Those laws typically let users request that the companies delete their data and require law enforcement agencies to get a warrant or subpoena to access genetic information, Prince said, adding that 23andMe already adheres to both of those policies. The United States Federal Trade Commission is not oblivious to the situation, and has issued a stern warning to all companies engaged in DNA testing and related business, especially when it comes to protecting such sensitive information.
How to delete your 23andMe data after the company filed for bankruptcy
- Through the years, there have been concerns for user privacy over a variety of issues, ranging from how the company would use your genetic information to if law enforcement would have access to it to the implications of run-of-the-mill data breaches.
- However, the new company that comes in may not be one that you trust and even if it is, things don’t always go according to plan, so you may still be worried about your personal data being mishandled.
- In the top half of the next screen, you can choose to download your data before you delete it.
- California-based 23andMe has more than 15 million customers worldwide for whom it provides information on genetic ancestry and health.
- Privacy advocates have long warned that the risk of entrusting genetic data to any institution is twofold—the organization could fail to protect it, but it could also hand over customer data to a new entity that they may not trust and didn’t choose.
Customers can withdraw such permission under “Research and Product Consents” on the account settings page. Even before 23andMe had sought bankruptcy protection, California Attorney General Rob Bonta on Friday urged customers to immediately delete “the trove of sensitive consumer data” the company has collected, including samples of people’s genetic material. Your genetic data is connected to your family members, so any invasions of privacy also extend to other people. 23andMe, on the other hand, says it has received multiple requests from authorities seeking access to certain data and genetic profiles, but claims it has resisted all such efforts using legal measures. For nearly a decade, 23andMe has been one of the most popular services offering ancestry reports and even health risk profiles based on a person’s genetic sample.
After deleting your information, you must confirm your request via email. While 23andMe has stated that its bankruptcy filing “does not change how we store, manage, or protect consumer data,” there’s also no way to know what will happen to millions of users’ genetic information in a potential buyer’s hands. The risks were always there, and the hammer finally came down with a hack in 2023 that exposed the data of nearly 7 million customer profiles. Multiple lawsuits later, and en-masse board resignation, 23andMe is on the verge of imploding. For a company that boasts 14 million customers and is now facing a delisting threat, the biggest question right now is what happens to all the genetic and ancestry profiles of its customers. After providing a saliva sample and consenting to 23andMe’s at-home testing, the company will have your registration information, such as sex and date of birth.
You can also opt in to and out of participating in research at any time by updating your consent status in your account settings. If you opt out, 23andMe will stop using your information for research going forward and will discontinue use of your data within 30 days. The company also sought to assure customers that access to their account and data was unchanged. Note that you may also download a copy of your genetic data before deleting it from 23andMe’s database.
How to delete your DNA data from 23andMe
23andMe itself has collaborated with pharma companies like GSK, and other genetic databases have created similar partnerships after being sold to for-profit entities. If privacy and security are your primary concerns, regularly reviewing the privacy policies of companies handling sensitive data is a good practice. As the landscape of data privacy evolves, being proactive about how your information is stored and used can give you peace of mind.
How to Delete Your Data from 23andMe: A Step-by-Step Guide
- Lifehacker has been a go-to source of tech help and life advice since 2005.
- Megan Cerullo is a New York-based reporter for CBS MoneyWatch covering small business, workplace, health care, consumer spending and personal finance topics.
- After deleting your information, you must confirm your request via email.
- If you’re one of those users, this guide will walk you through the process of deleting your data from 23andMe, including account deactivation and data removal.
Our mission is to offer reliable tech help and credible, practical, science-based life advice to help you live better.
The company also has a therapeutics arm, which conducts research and works to develop treatments for a range of conditions and diseases. On Monday, however, some customers said they were unable to delete their genetic information from the company’s databases. 23andMe said in a statement to CBS MoneyWatch that its “website experienced some issues and delays due to increased traffic yesterday.” 23andMe customers who once turned over the most personal form of information to the company — their own genetic data — may want it back after the personal genomics and biotech startup declared bankruptcy on Sunday. Last year, 23andMe came under fire following a massive data breach affecting 7 million customers that led to a class action lawsuit and a $30 million settlement. To make matters worse, last month, all seven independent board members of the biotech company, whose shares have plummeted, resigned, citing hesitancy over CEO Anne Wojcicki’s strategy for the company.
Can I recover my 23andMe account after deletion?
The company will then send an an email asking users to confirm the deletion request. You must reply in the affirmative for the deletion process to be completed. With an uncertain path forward for the at-home testing giant, it’s understandable that the genetic information of millions of people also feels at stake. And more, HIPAA, which protects Americans’ sensitive health information, does not apply to direct-to-consumer genetic tests, experts warn. However, the new company that comes in may not be one that you trust and even if it is, things don’t always go according to plan, so you may still be worried about your personal data being mishandled.
How to delete your 23andMe test sample
Note that if you requested any downloads of data reports that aren’t immediately available (some take time to process), requesting to delete your data will stop those requests. So only delete your data after you have downloaded everything you want to keep. California Attorney General Rob Bonta put out a statement last week calling on 23andMe customers to delete their data “due to the trove of sensitive consumer data 23andMe has amassed.”
If you’re one of those millions who has used 23andMe’s DNA sequencing process, there are a number of serious privacy implications with a potential sale—and it’s time to delete your data. 23andMe states that if it’s involved in a bankruptcy or sale, customers’ personal data may also be sold or transferred. It also provides a relatively straightforward way for customers to delete their data and request that their genetic samples be destroyed.
The company and/or its contracted genotyping laboratory will hold on to your genetic information, birthdate, sex, email address and more for a period of time to fulfill “legal obligations,” according to its privacy policy. When Good Housekeeping asked 23andMe what specific personal information it retains and for how long, the company ignored the question. This presents a number of risks, according to privacy advocates interviewed by The Washington Post. 23andMe already suffered a data breach in 2023 in which hackers accessed the records of around 7 million customers, and users are now trusting a company navigating bankruptcy to keep their information secure going forward. Yes, you can choose to delete only your genetic data and continue using your account for other services, such as family tree building or ancestry updates. However, this will remove all DNA-related reports from your profile.
This week, the genetic testing company 23andMe filed for bankruptcy, which means the genetic data the company collected on millions of users is now up for sale. If you do not want your data included in any potential sale, it’s a good time to ask the company to delete it. When the company first announced it was considering a sale, we highlighted many of the potential issues, including selling that data to companies with poor security practices or direct links to law enforcement. With this bankruptcy, the concerns we expressed last year remain the same. It is unclear what will happen with your genetic data if 23andMe finds a buyer, and that uncertainty is a clear indication that you should consider deleting your data. 23andMe, the genetic testing company that has collected data from more than 15 million customers, has filed for Chapter 11 bankruptcy and is looking for a buyer.
Follow these steps to delete your genetic data and deactivate your account from 23andMe. When it comes to protections around data, some states have adopted laws covering genetic privacy. At least 11 U.S. states have enacted laws giving consumers a say in how their genetic data is used, according to an article published in 2023 by Anya Prince, a University of Iowa law professor who studies health and genetic privacy. Now, we don’t know if 23andMe will find a savior, but the data will likely change hands and they may not survive the tides of commercial deals. “If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction,” notes the company’s privacy policy.