DNA analysis company 23andme has been in trouble lately: data was breached in a 2023 hack, and this September the entire board of directors resigned over disagreements with the CEO. That CEO, Anne Wojcicki, had said she was open to third-party takeover proposals; she only reversed that decision this week. The company is not currently for sale, but nothing about this is looking good—and it’s not clear what would happen to customer data if the company goes under.
Is 23andme data being sold?
So far there is no definitive word about the company being sold, with or without its data. However, it’s reasonable to expect that the company could be sold, and that owner could inherit the data. Something similar happened when MyHeritage bought Promethease, another DNA analysis company, in 2020.
Currently, your data may already be shared with other companies. If you signed up to participate in research studies through 23andme, “de-identified” data about you (including genetic data) has likely been given to research institutions and pharma companies. For example, 23andme has a data licensing agreement with GSK (formerly GlaxoSmithKline) to use the 23andme database to “conduct drug target discovery and other research.”
This isn’t a possible future scenario, but rather the current operation of the business. Licensing agreements like these are a big part of how 23andme makes money. Or intends to make money. Or possibly once made money. They’re not doing so great at the money making thing these days.
What happens when you delete your 23andme data?
Deleting your 23andme data doesn’t necessarily withdraw it from studies, especially since the data was “de-identified,” that is, stripped from your name and personal information. It does mean that your data will not be used in future research projects.
23andme explains their deletion policies here and here. It says:
If you participated in 23andMe Research, your Personal Information will no longer be used in any future research projects. If you asked us to store your genetic samples, they will be discarded. We will retain limited information about you, including records of this deletion request, and other information as required by law and otherwise described in our Privacy Statement.
Where to download your data and delete your account
If you would like to keep any of your data, sign in to your account and visit your user settings page. (You can also opt out of research studies there.). Click View on the 23andme Data card.
You’ll be asked to enter your date of birth to confirm your identity. In theory this is where you can download your data, but I can’t test this—I have a 23andme account, but I must have given the company a fake date of birth all those years ago. The website just tells me to contact Customer Care.
That sounds like a pretty bullshit obstacle to me, but here we are. A redditor says that Customer Care asked them to send a copy of their ID, which isn’t very useful if you used a fake date of birth. Still, the company’s documentation claims that you can download your data and delete your account if you can get past that screen. Good luck.
