(Photo by Justin Sullivan/Getty Images)
If you ever used 23andMe, you might want to consider deleting your data while you still can. The company’s financial troubles are prompting concerns about what could happen to customers’ DNA data if the firm goes under or is acquired by someone else.
On Friday, Meredith Whittaker, president of encrypted messaging app Signal, joined other security experts who are warning 23andMe users about the privacy danger. “It's not just you. If anyone in your FAMILY gave their DNA to 23andMe, for all of your sakes, close your/their account now,” Whittaker tweeted.
How to Delete Your 23andMe Data
23andMe has a page with instructions on how users can request an account closure. But in your 23andMe account, navigate to Settings, scroll down to the 23andMe Data section at the bottom, and click View on the right. Enter your birthday and then scroll to the bottom of the next page and click Permanently Delete Data.
(Credit: 23andMe)Once you submit your request, 23andMe will email you to confirm it. Doing so will prompt the company to discard a customer’s genetic testing samples and prevent the company from using their data for future research projects. It could take up to 30 days to go into effect, though.
Sold to the Highest Bidder?
Rachel Tobac, CEO of SocialProof Security, added: “If and when 23andMe sells to another company, your consumer DNA data sells with it. It won’t fix everything but you can request they remove your data now if you already used them.”
But for now, 23andMe's CEO Anne Wojcicki said earlier this week she isn't considering third-party takeover proposals. "Importantly, I remain committed to our customers’ privacy and pledge to maintain the Issuer’s current privacy policy in effect for the foreseeable future," she said in an SEC filing, which also notes 23andMe is actually pursuing an acquisition.
Recommended by Our Editors
23andMe was once valued at $6 billion. But the San Francisco company’s stock has since declined to less than 50 cents as demand for its DNA testing kits has waned. The financial troubles have gotten so bad that 23andMe’s board of directors resigned last month, saying Wojcicki had failed to produce a “fully financed, fully diligenced” business recovery plan.
The uncertainty has caused some media outlets, including NPR, to question what might happen to 23andMe’s genetic testing data, which spans 15 million customers. The company hasn’t commented on the fate of the DNA data, merely saying: “For our customers, our focus continues to be on transparency and choice over how they want their data to be managed.”
However, NPR notes there’s only a patchwork of state laws that cover genetic data, leaving a gap for third-party companies and law enforcement to potentially use the DNA information. In 23andMe’s case, the company has resisted US law enforcement requests for such data. But in 2018, the company reached a deal with pharmaceutical manufacturer GlaxoSmithKline to tap customers’ genetic data for drug development. That said, users can opt-out from the research.
Although customers can request the company to delete their data, 23andMe won’t necessarily erase all your information. The company has been telling users who request an account deletion: “23andMe and the contracted genotyping laboratory will retain your Genetic Information, date of birth, and sex as required for compliance with legal obligations, pursuant to the federal Clinical Laboratory Improvement Amendments of 1988 and California laboratory regulations.”
23andMe didn't immediately respond to a request for comment about the data retention policy. In the meantime, users can also consider using California’s Consumer Protection Act, which covers genetic data and also includes a “right to delete” clause for companies to follow.