Consumers urged to delete 23andMe data as bankruptcy sparks privacy concerns

By Bhanvi Satija and Siddhi Mahatole

(Reuters) - New York Attorney General Letitia James on Tuesday urged 23andMe customers to secure their data in light of rising privacy concerns after the DNA testing firm filed for bankruptcy amid declining demand for its services.

Uncertainty surrounding the company's future and worries about potential data management by a new owner drove users to delete their accounts as a final privacy safeguard, with many taking to social media to share detailed instructions.

Shares of 23andMe, which filed for bankruptcy on Sunday, closed 11% lower at 65 cents. The stock declined 59% on Monday.

The company's saliva-based tests provide information on a user's ancestry and whether they might be at genetic risk for certain diseases.

23andMe has made at least 30 deals with companies including British drugmaker GSK, allowing them to access its database. Most of its agreements remain undisclosed.

"Genetic data isn't just a bit of personal information — it is a blueprint of your entire biological profile. When a company goes under, this personal data is an asset to be sold with potentially far-reaching consequences," NordVPN cybersecurity expert Adrianus Warmenhoven said.

With over 15 million customers, 23andMe's genetic database was a "digital goldmine", Warmenhoven said.  

23andMe has said the bankruptcy process will not affect how it stores, manages or protects customer data. It also said any buyer would be required to comply with applicable law on how customer data is treated. 

It was reported last year that 23andMe would pay $30 million and provide three years of security monitoring to settle a lawsuit accusing it of failing to protect the privacy of 6.9 million customers, whose personal information was exposed in a 2023 data breach.

However, 23andMe said in January that the settlement was not unconditionally approved by the United States District Court for the Northern District of California.

"The company has said that it retains certain data, including genetic information, even if users delete their accounts. I assume that users will be filing lawsuits against the company to seek protection of all such data... outcomes of such suits is not yet clear," said Robert Klitzman, director of the Masters of Bioethics program at Columbia University School of Professional Studies.

Withdrawing data from the company's website does not fully protect information since its business has been to sell its database, with user data, to other biotech and pharmaceutical companies for several million dollars, Klitzman said.

"You can protect your financial information, such as your credit card number, if hacked, by getting a new card.  But your DNA is permanent – you cannot change it...Better laws are therefore needed to ensure that companies adequately protect this valuable information," Klitzman also said.  

On Friday, California's Attorney General Rob Bonta also urged customers to delete their genetic data, citing 23andMe's financial distress.

James said that users could change their preferences in their account settings if they had previously opted to have their saliva samples and DNA stored by 23andMe. 

She also said customers could withdraw consent even if they had previously agreed that the company and third-party researchers could use their genetic data and samples.

(Reporting by Bhanvi Satija, Siddhi Mahatole and Puyaan Singh in Bengaluru; Editing by Shilpi Majumdar, Pooja Desai and Alan Barona)