The popular consumer DNA testing company 23andMe is facing mounting scrutiny following a series of major setbacks, prompting privacy advocates to urge users to delete their genetic data. The company, known for offering personalized health and ancestry reports based on DNA samples, recently saw a dramatic shake-up in its leadership, with all board members except CEO Anne Wojcicki stepping down amid plans to take the company private. Compounding the uncertainty is the fallout from a major security breach last October, in which hackers accessed the personal data of approximately 5.5 million customers. With the company’s future in flux and potential new ownership looming, concerns over genetic privacy have escalated.
In an article published by MIT Technology Review, the complexities of deleting personal data from 23andMe were examined in detail. Privacy experts such as Meredith Whittaker, president of the encrypted messaging platform Signal, have strongly advised users to close their accounts, warning that a change in ownership could place sensitive genetic data in the hands of a less scrupulous entity. Jason Kelley, activism director at the Electronic Frontier Foundation, echoed these concerns, noting that while 23andMe currently has certain privacy protections in place, there is no guarantee those safeguards will remain under new leadership.
23andMe maintains that it does not share user data with third parties without explicit consent, emphasizing that its research program is strictly opt-in. A company spokesperson stated that it has “strong customer privacy protections” and reiterated its commitment to safeguarding genetic information. However, users attempting to permanently erase their data from the platform will find that deletion comes with significant caveats.
According to 23andMe’s privacy policy, while users can delete their accounts and request the removal of their data, certain information must be retained to comply with legal obligations. This means that even after a user’s data is removed from the platform, some genetic information, along with details like date of birth and sex, will still be stored by the company and its third-party genotyping laboratory. Furthermore, any data previously contributed to 23andMe’s research projects cannot be withdrawn from completed or ongoing studies, although it will not be used for future research.
For those still determined to delete their 23andMe data, the process is relatively straightforward. Users must log into their accounts, navigate to the settings section, and request permanent deletion. Before proceeding, they are given the option to download their raw genetic data for personal use. Once the deletion request is confirmed, the process begins immediately, and users lose access to their accounts. Additionally, if they had previously opted to store their saliva sample for future testing, the company states that the sample will be destroyed as part of the deletion process.
Despite the push to erase data from 23andMe, some users may still want access to their genetic information for genealogy research or other personal reasons. Several DNA testing companies, such as FamilyTreeDNA, MyHeritage, GEDmatch, and Living DNA, allow users to upload genetic data obtained from 23andMe or other services. However, 23andMe itself does not currently permit uploads from third-party sources.
Downloading raw genetic data from 23andMe involves navigating to the appropriate section of the website, selecting the download option under account settings, and verifying identity with a date of birth. The company cautions users against uploading their data to third-party platforms, warning that bad actors could exploit genetic information to create fraudulent profiles, potentially gaining access to personal details and even sensitive health-related genetic markers.
The debate over genetic privacy is far from over, and 23andMe’s uncertain future has only intensified the discussion. As genetic data becomes an increasingly valuable commodity, consumers must weigh the risks of sharing their DNA with commercial testing companies. While 23andMe insists on its commitment to privacy, the possibility of new ownership raises questions about how genetic information could be used—or misused—in the future. Privacy advocates argue that now is the time for users to take control of their data, ensuring that their most personal information does not fall into the wrong hands.
