How to Delete Your Data From 23andMe

DNA-testing company 23andMe has filed for bankruptcy, which means the future of the company’s vast trove of customer data is unknown. Here’s what that means for your genetic data.

The Bankruptcy and Its Implications

GENETIC TESTING COMPANY 23andMe, once a Silicon Valley darling valued at $6 billion, filed for Chapter 11 bankruptcy protection late Sunday as it prepares for a sale of the business. CEO Anne Wojcicki, who cofounded the company in 2006, has also stepped down after months of failed attempts to take the firm private.

As uncertainty about the company’s future reaches its peak, all eyes are on the trove of deeply personal—and potentially valuable—genetic data that 23andMe holds. Privacy advocates have long warned that the risk of entrusting genetic data to any institution is twofold—the organization could fail to protect it, but it could also hand over customer data to a new entity that they may not trust and didn’t choose.

Legal Rights and Data Deletion

California attorney general Rob Bonta reminded consumers in an alert on Friday that Californians have a legal right to ask that an organization delete their data. 23andMe customers in other states and countries largely do not have the same protections, though there is also a right to deletion for health data in Washington state’s My Health My Data Act and the European Union’s General Data Protection Regulation (GDPR). Regardless of residency, all 23andMe customers should consider downloading anything they want to keep from the service and should then attempt to delete their information.

“This situation really brings home the point that there is still no national health privacy law in the US protecting your rights unless you live in California or Washington,” says Andrea Downing, an independent security researcher and cofounder of the patient-led digital rights nonprofit The Light Collective. “Meanwhile, we continue to evolve our understanding of how genetic information has value, but also has unique vulnerability.”

John Verdi, senior vice president of policy at the Future of Privacy Forum, says 23andMe’s new owner could revise the company’s privacy policies for new customers and new data collection, but the data it has already collected from current customers is subject to existing terms. “The company has legal obligations regarding information collected under the current policies,” he says.

Risks of Data Exposure

Still, researchers emphasize that in practice, such a large transition will create real data exposure that is outside of 23andMe customers’ control.

“In my opinion, these privacy policies—especially in the context of acquisitions in the venture capital and private equity space—aren't worth the paper they're printed on,” says longtime security researcher and data privacy advocate Kenn White. “For regular people out there who use these services, you're pretty much on your own. My advice is to request your data get deleted as soon as possible.”

How to Delete Your Data From 23andMe

To delete your genetic data through 23andMe’s website:

1. Log in to your account.
2. Navigate to Settings in your profile.
3. Scroll to 23andMe Data and click View.
4. Download a copy of your genetic information if desired.
5. Scroll to Delete Data and click Permanently Delete Data.
6. Confirm the deletion via the email sent by 23andMe.

Additionally, if you authorized 23andMe to retain your biological sample, you can request its destruction:

1. Go to Settings → Preferences.
2. Follow the prompts to request destruction.

You can also opt in and out of research participation at any time by updating your consent status in your account settings. Opting out will prevent further use of your data but does not affect completed studies.

The Future of 23andMe

23andMe has never been profitable and has struggled to revamp its business model since it went public in 2021. Demand for its ancestry and health testing kits has been declining for years. The company’s struggles were exacerbated by a major data breach in December 2023 that affected millions of customers, leading to a class action lawsuit that 23andMe agreed to settle for $30 million.

Last summer, Wojcicki filed a proposal to take the company private, which was rejected by 23andMe’s board of directors. Shortly after, the company shuttered its in-house drug discovery unit, and its board members resigned en masse over Wojcicki’s strategic direction.

23andMe says it intends to continue operating as usual throughout the sale process and that there are no immediate changes to the way it stores, manages, or protects customer data. In an open letter to customers, the company stated it will “seek to find a partner who shares our commitment to customer data privacy and allows our mission of helping people access, understand, and benefit from the human genome to live on.”

However, the direction of 23andMe will ultimately be in the hands of whoever takes over the company.

“If there is a new owner that comes out of the bankruptcy process, that new owner steps into the shoes of 23andMe and takes over those assets,” says Jennifer Wagner, an assistant professor of law, policy, and engineering and anthropology at Penn State University.

“They would still be bound by the complex web of contractual agreements that are in place right now with users,” Wagner adds. “But I think it does give rise to some uncertainty in terms of whether or not a new player would have the same values or that same kind of culture that 23andMe was trying to cultivate.”

---

Updated 7:15 pm ET, March 24, 2025, to correct the date 23andMe formally went public.