The Uncertainty of Deleting Genetic Data from 23andMe
On March 23, 2025, the news broke that genetic testing company 23andMe had filed for bankruptcy. This sparked a firestorm of articles and online posts advising consumers to delete their personal data in order to protect it from ending up in a new, unknown owner's hands.
Major news outlets, including NPR, CNN, and The Washington Post, published stories about this. The Post column's headline read "Delete your 23andMe data right now." The story said that "unless you take action, there is a risk your genetic information could end up in someone else's hands — and used in ways you had never considered."
State attorneys general also issued alerts on social media and government websites calling on users to delete their private information.
Calls for users to delete their genetic information from 23andMe's databases actually began months earlier, prompted by signs of trouble at the company. However, some online voiced skepticism that 23andMe's process for users to delete their data would actually protect their information.
"Until I see HOW they handle data deletion, it's not deleted," one Redditor said; an X user said deleting accounts "may or may not" protect privacy.
The Company's Response
The company's letter announcing its bankruptcy sale said customers "still have the ability to delete their data and 23andMe account" and "the filing does not change how we store, manage, or protect customer data."
However, privacy and data experts said it is impossible to verify whether the company's data deletion process is secure — meaning that simply requesting that the company delete your account and destroy DNA samples doesn't mean your information is 100% protected in the case of a sale.
Experts Weigh In
"Until I see HOW they handle data deletion, it's not deleted," said Albert Fox Cahn, an attorney and director of the privacy rights group Surveillance Technology Oversight Project. "There's no reason not to do it, but it only gives me very modest peace of mind."
Mike Cobb, chief information officer and director of engineering at data recovery company DriveSavers, agreed.
"This type of sensitive data changing hands has a real chance of human error," Cobb said. "To some extent, the genetic horse is out the barn."
Who Has 23andMe Shared Your Data With?
In 23andMe's full privacy statement, the company said it shares personal information with service providers and contractors who help the company with order fulfillment, processing and analyzing samples, customer care support, cloud storage, marketing and analytics, and more.
Consumers may direct the company to share personal information with anyone, including third-party services like social networks, applications, and services like GEDmatch.
The Difficulty of Anonymizing DNA
"There's not much folks can do if this data gets out. When you're dealing with a security breach, when you're dealing with a hacker, you can change your social security number, you can even change your name," said Cahn. "You can't change your DNA."
Biometric data breaches pose a truly unique threat, because there isn't really a way to mitigate the harm," he added.