California’s attorney general has urgently warned customers of 23andMe to purge their genetic data from the company’s databases over uncertainty where it may end up if the firm goes bankrupt.
“Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company,” AG Rob Bonta said in a statement Friday.
The company had been synonymous with at-home genetic testing for more than a decade, providing more than 15 million customers with a wide range of personal health and ancestry data.
Users would provide a saliva sample and mail it back to the company for detailed laboratory analysis at a cost of around $200.
For a time, the company was a runaway success, valued at $6 billion as recently as 2020.
Then it apparently tried to expand too fast into drug research and pharmaceutical partnerships, while a data breach created concerns about users’ information.
The bottom dropped out for the one-time Silicon Valley darling as its share price has cratered, and the firm is now in danger of collapsing.
The company’s share price hovered over $320 in February 2021 but has since slid to less than $2 per share.
Now thorny questions are being raised about the fate of millions of customers’ most sensitive data if the business goes belly-up. The firm experienced the data breach in 2023, which led to concerns over how well users’ information is safeguarded.
Under California’s Genetic Information Privacy Act, companies must obtain explicit consent for the collection, use and disclosure of any genetic data. The 2022 law also guarantees consumers the right to access or delete their data at will.
Bonta said customers can permanently delete their 23andMe data by logging into their account, accessing the “settings” menu and navigating to the data section.
Clicking “view” will give users access to the “delete data” section, where the option to “permanently delete data” will appear.
Going through this process will auto-generate an email from the company confirming the request — which users must click to verify before the data will be deleted, Bonta noted in his statement.
