23 & Me Customers Urged to Delete Data by Attorney General Upon Bankruptcy

23andMe, the once-pioneering genetic testing company, has filed for Chapter 11 bankruptcy in the U.S. Bankruptcy Court for the Eastern District of Missouri, aiming to restructure its finances and pave the way for a potential sale while continuing operations. With over 15 million customers’ sensitive genetic data in its hands, the filing has sparked urgent concerns about privacy, prompting figures like California Attorney General Rob Bonta to call for users to delete their information from the company’s systems before a new owner could inherit—and possibly exploit—it. While 23andMe assures users that current privacy protections will hold during this transition, the uncertainty of what a future buyer might do with such a vast trove of personal data has ignited a race against time for those seeking to safeguard their genetic footprint.

The good news is you can still request 23andMe to delete your data. Here’s how: log into your 23andMe account, go to "Settings," find the "23andMe Data" section, and select "Permanently Delete Data." You’ll receive a confirmation email, which you must verify to complete the process. This also triggers the destruction of any stored saliva samples if you hadn’t opted out of storage earlier. However, there are caveats—23andMe retains some data (like genetic info, date of birth, and sex) for legal compliance, and any data already shared for research (if you consented) can’t be recalled from completed studies.

Why the urgency? 23andMe’s privacy policy states that in a bankruptcy or sale, your personal information—including genetic data—could be transferred to a new owner. While the company insists it will maintain current privacy standards during this process, a buyer could potentially alter those terms later, and you’d need to stay vigilant to opt out. The California AG’s alert highlights rights under state laws like the Genetic Information Privacy Act, urging users to act before a sale complicates things further.

That said, deletion isn’t a full shield. If your data was part of the 2023 breach affecting 6.9 million users, or already sold to partners like GSK for drug research, it’s out there. Bankruptcy doesn’t erase that. Still, deleting now limits future exposure.