23andMe’s Collapse: What It Means for Your DNA Data

0 CommentsFood for Thought, News, Technology, Way of Life

23andMe, once a pioneer in consumer genetic testing, filed for Chapter 11 bankruptcy on March 23, 2025, signaling a dramatic fall from its $6 billion valuation in 2021. For the 15 million customers who sent in DNA swabs, this collapse—coupled with a major 2023 data breach and weak U.S. genetic privacy laws—raises serious concerns about the security and future of their genetic information. Here’s what happened, the risks you face, and what you can do.

The Company’s Downfall

23andMe’s decline began years before bankruptcy. Demand for its one-time DNA kits waned, efforts to pivot into drug research faltered, and its stock crashed from $363 in 2021 to 65 cents by March 25, 2025. A 2023 data breach exposed 6.9 million users’ information, eroding trust and triggering a $30 million settlement. Facing $305 million in liabilities against $227 million in assets, the company filed for Chapter 11 to restructure and sell its business, including its genetic database. CEO Anne Wojcicki stepped down but plans to bid on the assets, with a sale targeted for May 14, 2025.

Risks to Your DNA Data

Your genetic information—now an asset in bankruptcy—faces multiple threats:

  • The Bankruptcy Sale: A new owner could buy 23andMe’s database and change its privacy terms, potentially sharing your data in ways you didn’t agree to. While 23andMe claims current protections will hold during the process, legal safeguards are thin.
  • The 2023 Breach: Hackers stole raw genetic and personal data via credential stuffing, affecting nearly half the user base. That data, sold on the dark web, could already be in the hands of nation-states or other actors, beyond 23andMe’s control. The breach exposed vulnerabilities that bankruptcy-related staff cuts (40% in 2023) may worsen.
  • Government Access: 23andMe has complied with some law enforcement requests under court orders, per its 2023 Transparency Report. While there’s no proof of a full database transfer to U.S. or foreign governments, the breach and potential indirect sharing (e.g., via relatives’ data on third-party sites) mean your DNA might already be accessible to state actors. Nation-states like China or Russia could value it for surveillance or bioweapons research, as the Pentagon warned when banning troops from DNA kits in 2019.

Genetic Privacy Laws: Weak and Uneven

U.S. laws offer little protection for your genetic data:

  • Federal Level: The Genetic Information Nondiscrimination Act (GINA) of 2008 stops employers and health insurers from using your DNA against you, but not life or disability insurers. HIPAA only covers healthcare providers, not 23andMe. There’s no federal privacy law like the EU’s GDPR to regulate consumer genetic data.
  • State Level: Only about 20 states have specific laws. California’s Genetic Information Privacy Act (2022) requires consent for data use and sharing, while Florida (2021) and Utah (2021) offer narrower rules. Most states lack any genetic privacy statutes, and bankruptcy law can override state protections, leaving your data exposed in a sale.
  • Gaps: No law mandates data security or deletion rights across the board, and federal oversight (e.g., FTC action) is reactive. A foreign buyer could be blocked by the U.S. Committee on Foreign Investment, but only for security reasons—not your privacy.

What You Can Do

Take control of your data now:

  1. Delete Your Account: Log into 23andMe, go to “Settings” > “Delete Account,” and confirm via email. Expect delays due to high demand.
  2. Destroy Your Sample: Request destruction of your physical DNA sample through customer support—state AGs like New York’s Letitia James confirm this right.
  3. Revoke Research Consent: In “Preferences,” opt out of research to limit future use.
  4. Check State Laws: Look up your state’s rules (e.g., via the National Conference of State Legislatures) to understand your rights.

The Bottom Line

23andMe’s bankruptcy puts your DNA at risk of being sold, while the 2023 breach and lax laws mean it could already be compromised—possibly even in nation-state hands.

Federal and state protections are patchy, leaving you vulnerable to everything from corporate policy shifts to foreign exploitation. Act fast to delete your data and sample, because once it’s out there, you can’t get it back. Stay informed as the sale unfolds, and don’t count on the law to shield you—it won’t.