23andMe's business has suffered from data hacks, lawsuits, and a plummeting stock price. The company's problems have raised concerns about how it handles consumer genealogy data. Here's how to delete your 23andMe data:
Thank you for registering!
Access your favorite topics in a personalized feed on the go. Download the app
By clicking “Sign Up”, you agree to our Terms of Service and Privacy Policy. You can opt-out at any time by visiting our settings page or by clicking “unsubscribe” at the bottom of the email.
Things went downhill for 23andMe.
Since launching its direct-to-consumer genetic testing company in 2006, the company has steadily grown and appeared to stand out among Silicon Valley startups. According to Crunchbase, it has raised more than $1 billion from investors as of 2021.
But the 2023 data hack began a series of hurdles that 23andMe seems unable to clear.
That October, news broke that hackers were selling user data, including birth information and names, on the dark web. The company admitted in December that hackers had accessed ancestry data for just under 7 million users. According to a data breach notification filed in January, it took 23andMe five months to realize that hackers had stolen data.
The case led to a class action lawsuit, which 23andMe settled for $30 million in September, according to Reuters.
Less than a week later, the independent directors on 23andMe's board resigned in a letter to CEO and co-founder Anne Wojcicki.
The letter said the board members “wholeheartedly support” 23andMe's mission, but “it is also clear that we have different views regarding the future strategic direction of the company.”
Anne Wojcicki is the co-founder and CEO of 23andMe. Steve Jennings/Getty Images/TechCrunch
The Wall Street Journal reported that the company never turned a profit, despite generating revenue of $299 million in 2023 and $219 million in 2024. The stock peaked in February 2021, but has since fallen steadily to an all-time low of 29 cents.
23andMe's reputation took another hit among consumers in September when Wojcicki said in an SEC filing that the company was “considering a third-party acquisition offer.” She recanted that statement in a separate filing later that month, but the damage was done.
Outlets such as The Atlantic reported that Wojcicki's potential sale of 23andMe could also mean selling user data. The director of cybersecurity at the Electronic Frontier Foundation, a nonprofit organization focused on digital privacy, urged his 186,000 X followers to delete their data from 23andMe. The post received over 531,000 views in three days.
X's post touches on concerns plaguing the DNA testing kit industry. This means that your personal DNA data may not remain private.
“Data is data. Once it's out there, it's very difficult to control,” biomedical researcher James Hazell told Business Insider in 2019.
According to 23andMe, the personal data it collects includes registration information such as date of birth, genetic information such as a user's genotype, sample information such as saliva, and self-reported information.
A 23andMe spokesperson told Business Insider, “Unless you give us consent, we will not provide any information beyond our contracted laboratories that we partner with to process our customers' samples and provide their results.” The information will not be shared with any other entity.”
Related articles
A spokesperson said the company does not share data with “employers, insurance companies, law enforcement agencies, or any public databases.”
Here's how to ask 23andMe to delete your data
Users who wish to have their personal information removed from 23andMe can opt out in the 23andMe Data section of their account settings. But 23andMe says it is legally obligated to keep some information.
“While most of your personal information will be deleted, we must retain some information to comply with our legal obligations,” the company's website states.
The company's privacy statement states, “23andMe and/or our contracted genotyping laboratories will retain your genetic information, date of birth, and gender as necessary to comply with applicable legal obligations. …even if you choose to delete your account.”
In its privacy statement, 23andMe also says it retains some information related to user accounts, such as email addresses.
Genetic data and self-reported information from users who participate in 23andMe Research will not be used in future research projects.
“Customers have the option to delete their account at any time, and once their request is confirmed, we will immediately and automatically begin the deletion process,” the spokesperson said. “Deleting your account and associated data will permanently delete the data associated with all profiles in your account. If a customer asks us to store genetic samples, they will be destroyed.”
