23andMe

Millions of people trusted genetic testing firm 23andMe with their most sensitive data—now many are asking whether they should delete it as the embattled biotech company files for bankruptcy and searches for a buyer.

On Sunday, 23andMe announced it had filed for Chapter 11 bankruptcy protection in the United States, aiming to facilitate a court-supervised sale process. The filing follows years of financial turmoil, strategic missteps, and a massive data breach that exposed the personal information of nearly 7 million users.

In a statement, Mark Jensen, chair of the board's Special Committee, said the decision was made to 'maximise the value of the business' and that customer data protection remained a priority. However, concerns are mounting about what will happen to users' DNA records as the company prepares for potential sale to the highest bidder.

Per CNN, the company also confirmed the immediate resignation of co-founder and CEO Anne Wojcicki, who remains on the board but has stepped aside to prepare a bid to repurchase the company through the restructuring process.

Users Urged to Delete Data as Legal Protections Raise Questions

Ahead of the bankruptcy announcement, California Attorney General Rob Bonta issued a consumer alert warning 23andMe users to consider deleting their genetic data. Bonta reminded Californians of their legal rights under the state's Genetic Information Privacy Act (GIPA) and the California Consumer Protection Act (CCPA), which allow residents to request deletion of personal and biological data from companies in financial distress.

According to Fortune, Bonta urged users to 'take control and request that a company delete their genetic data and destroy any samples of genetic material'.

To delete data, users must log into their accounts, access their settings, download a copy of their genetic profile (if desired), and select the 'Permanently Delete Data' option. Those who consented to storing saliva samples can revoke permission via the 'Preferences' section of their profile. Users can also withdraw research consent under the 'Research and Product Consents' tab.

While the company insists customer data will remain protected during the sale process, critics argue the privacy policy leaves room for future transfers of information. As IFLScience notes, the firm's current policy allows for personal data—including genetic records—to be sold or transferred to new owners in the event of bankruptcy or acquisition.

This means a new buyer could impose different terms of service, potentially enabling more lenient data-sharing practices. Even if users delete their data, the company may retain identifying information, including sex and birth dates, to comply with legal obligations.

From Billion-Dollar Darling to Bankruptcy

Founded in 2006, 23andMe rose to prominence with its direct-to-consumer DNA testing kits that allowed customers to discover genetic ancestry and health risk indicators. The firm became a household name and went public in 2021, briefly reaching a valuation of nearly £4.7 billion ($6 billion). At its peak, Wojcicki—who held 49% of the company—became a billionaire.

However, the company never turned a profit. Despite efforts to pivot to subscription-based wellness insights and drug development, it failed to build a sustainable revenue model. In 2023, a major data breach compromised nearly half of its customer base, further eroding public trust.

According to IFLScience, the company's privacy policy confirms that previously used research data cannot be retracted. This raises further questions about how much control users truly have once their information has been shared.

By November 2024, 23andMe had laid off 40% of its workforce and ceased all therapy development. In February 2025, Wojcicki attempted to partner with venture capital firm New Mountain Capital to buy out remaining shareholders at just £2 ($2.53) per share, valuing the company at £59 million ($74.7 million). The offer was rejected by the board.

In a post on X, Wojcicki admitted she was 'disappointed' but affirmed her commitment to repurchase the company's assets: 'If I am fortunate enough to secure the company's assets through the restructuring process, I remain committed to our long-term vision of being a global leader in genetics.'

Can Your DNA Be Sold?

The real concern now is what happens to users' genetic data. Experts warn that direct-to-consumer genetic testing companies like 23andMe are not regulated by laws like the Health Insurance Portability and Accountability Act (HIPAA), because customers are not classified as patients. This lack of oversight leaves millions of people vulnerable to data misuse.

According to IFLScience, in the event of a sale, genetic data can be accessed, transferred or sold unless explicitly deleted beforehand.

While 23andMe has stated it will continue to operate as usual during the bankruptcy process, the implications for consumer privacy are vast. Many users, particularly those outside California who lack similar protections, may have no legal recourse should their data be included in the firm's eventual sale.

With over 15 million customers and one of the largest private genetic databases in the world, 23andMe's collapse serves as a warning to consumers entrusting sensitive personal data to tech companies. As its future remains uncertain, the decision to delete one's data could be more urgent than ever.

Writer's pick