23andMe bankruptcy sparks panic among users trying to delete their genetic data

The urgency stems not just from the bankruptcy filing, but also a 2023 password breach that exposed information for close to 7 million customers.

A stampede of 23andMe customers flocked to the company's website on Monday, frantically attempting to erase their genetic data after the company filed for bankruptcy on Sunday and CEO Anne Wojcicki stepped down. With over 15 million customers having uploaded DNA samples, family medical histories, and health data over the years, fears have mounted about what will become of that intensely personal information if the company is sold, the Wall Street Journal reported.

Deletion delays raise alarm

Most customers experienced long delays or error messages when attempting to request data removal. Some reported that the process was confusing or left them uncertain if their data would be deleted. Others had difficulty deleting the accounts of deceased relatives. Some customers reported success—receiving confirmation emails that stated: "Your data is being deleted… your account will no longer be accessible"—but they were still uncertain about how long deletion would take and if a final confirmation would be sent.

Indiana resident Ted Weidner, a four-year user of 23andMe, reported that he closed his account Monday because of privacy issues and is now "trying to audit the process." The site worked slowly but finally accepted his request. "There's some sensitive information in there," he said.

Privacy concerns increase after previous data breach

The urgency stems not just from the bankruptcy filing, but also a 2023 password breach that exposed information for close to 7 million customers. Numerous clients claim that violation destroyed their faith and left them particularly apprehensive of what new ownership could carry out with their information.

Lucia McIntosh, 46, attempted to download her genetic data before closing her account, but was greeted by error messages. Others such as 88-year-old Don Bieber, who spent hours attempting to delete information for himself and his children, complained of frustration and worry due to technical failures and poor communication from the company.

Legal protection uncertain

While 23andMe's privacy policy limits the sharing of user information with insurers, employers, public databases, and law enforcement, the protection it provides is not as strong as health privacy laws such as HIPAA, as customers voluntarily provided their information under consumer agreements. Legal analysts indicate that state laws in California and Illinois will regulate the use of this information following a sale—but a new purchaser could suggest modifications to the policy, which users would then have to accept.

Sara Gerke, a law professor at the University of Illinois Urbana-Champaign, explained to The Wall Street Journal that any policy shift would still need user approval. Nevertheless, the possibility of sensitive information ending up in new hands makes many users uncomfortable.

A consumer data crisis unfolds

From once promising $6 billion, being hailed as pioneering in direct-to-consumer testing of genes through 23andMe, down to its disastrous pivot to creating drugs which ultimately failed to achieve profitability, followed by the inescapable inflationary drive that crushed what was left-the customers were struggling to secure a hold on its most private personal data as frustration mounted due to long lines without clear timelines ahead and betrayal being felt.