DNA and genetic testing firm 23andMe is on the brink of bankruptcy, leaving the fate of its 15 million customers' sensitive genetic data uncertain. The company, once a pioneer in the field, has seen its value plummet over 99% since going public in 2021, struggling to turn a profit and facing a massive data breach in 2023.

The data breach, which saw hackers steal the ancestry data of nearly 7 million users, led to a $30 million settlement in September. Shortly after, 23andMe's founder and CEO Anne Wojcicki announced that she was considering third-party takeover proposals, only to later retract the statement and express plans to take the company private. However, the damage was done, and all of the company's independent board members resigned.

In March 2024, 23andMe filed for bankruptcy protection, paving the way for a court-supervised sale of its assets, including its vast banks of DNA data. Wojcicki has since resigned from the company, leaving customers to wonder what will happen to their genetic information.

One major concern is that 23andMe is not bound by the Health Insurance Portability and Accountability Act (HIPAA), which sets standards for protecting sensitive health information. Instead, the company operates under its own privacy policies, which can be changed at any time. This lack of federal regulation, combined with a patchwork of state privacy laws, raises questions about the security and potential sale of customer data.

23andMe's privacy policy states that customer data "may be accessed, sold or transferred" in the event of a bankruptcy, merger, acquisition, reorganization, or sale. The company has maintained that its data privacy policies would not change in the event of a sale, but potential buyers may have different ideas about how to use the data. Privacy advocates have urged 23andMe to resist a sale to any company with ties to law enforcement, warning that customer genetics data could be used by police to indiscriminately search for evidence of crimes.

In response to the uncertainty surrounding 23andMe's future, privacy advocates and experts are urging customers to take action to protect their data. California's attorney general Rob Bonta has reminded state residents of their right to demand the deletion of their genetic data under state law. Others, such as Meredith Whittaker, president of end-to-end encrypted messaging app Signal, and Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation, have advised users to delete their accounts and request the deletion of their data.

Requesting the deletion of your data on 23andMe is a relatively straightforward process, involving a few clicks in the account settings. However, there are important caveats to consider. 23andMe may retain some data for an unspecified amount of time, and users who have agreed to share their data for research purposes cannot delete that information. According to 23andMe, around 80% of its customers – roughly 12 million people – have consented to participate in its research program.

As 23andMe's financial struggles continue to unfold, the fate of its vast genetic database remains uncertain. One thing is clear: the company's customers must take proactive steps to protect their sensitive information and ensure that it does not fall into the wrong hands.