23andMe files for bankruptcy: what does this mean for customers’ DNA data?

23andMe, a DNA-testing company that suffered a major data breach in 2023 exposing millions of clients, has filed for bankruptcy. This means that the company and the sensitive customer data will change hands.

23andMe is a popular direct-to-consumer genetic testing service that popularized the analysis of saliva samples sent by mail. However, the one-time service has not turned into a sustainable business plan.

On March 23rd, 2025, 23andMe announced it filed for Chapter 11 bankruptcy protection to facilitate a sale process.

It plans to use the bankruptcy process to sell the company and pay off its debts. The company hopes the bankruptcy process will help to get the best possible sale price to maximize stakeholder value, and will help resolve liabilities.

23andMe has collected a sizeable amount of genetic information from its customers. Some have expressed concerns that their data may “end up in the wrong hands.”

“It is their most valuable asset,” one user posted on Hacker News.

23andMe’s financial distress deepened following the major data security incident in 2023. Threat actors scraped and leaked the personal data of millions of the company’s customers. Later, the company confirmed that attackers stole raw genotype data just by logging in using compromised credentials.

The leaked data contained entries for name, sex, age, location, and ancestry markers, such as lineage, yDNA, and mtDNA haplogroups (traces of paternal and maternal ancestry).

California Attorney General Rob Bonta urgently alerted 23andMe customers about their right to direct the deletion of genetic data under the Genetic Information Privacy Act (GIPA) and California Consumer Protection Act (CCPA).

“Californians who want to invoke these rights can do so by going to 23andMe's website,” Bonta said before the 23andMe’s announcement.

“I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company.”

23andMe expects to continue operations

Meanwhile, 23andMe expects to continue operating its business as usual throughout the sale process.

“There are no changes to the way the Company stores, manages or protects customer data,” 23andMe said.

“Any buyer will be required to comply with applicable law with respect to the treatment of customer data.”

Mark Jensen, Chair and member of the Special Committee of the Board of Directors at 23andMe, expects the bankruptcy process will help address operational and financial challenges. The company aims to reduce costs by rejecting numerous contracts, real estate leases, and resolving other legal and leasehold liabilities.

“We are committed to continuing to safeguard customer data and being transparent about the management of user data going forward, and data privacy will be an important consideration in any potential transaction,” Jensen said.

23andMe will seek bids and potentially hold an auction to sell all of its assets. The company also said it secured financing of up to $35 million.

According to CNN, the firm never made a profit and has faced management gridlock. Forty-nine percent of the company is owned by Anne Wojcicki, who has been attempting to take the company private.

Last year, Wojcicki proposed acquiring all the outstanding shares multiple times. However, the board rejected these proposals. Wojcicki is now stepping down as CEO.

How to delete your personal information from 23andMe?

23andMe users, at least in California and the European Union, can delete their accounts and personal information. Attorney General Bonta suggested taking the following steps:

1. Log into your 23andMe account on their website.
2. Go to the “Settings” section of your profile.
3. Scroll to a section labeled “23andMe Data” at the bottom of the page. Click “View” next to “23andMe Data.”
4. If you want a copy of your genetic data for personal storage, choose the option to download it to your device before proceeding.
5. Scroll to the “Delete Data” section and click “Permanently Delete Data.”
6. Confirm your request: You’ll receive an email from 23andMe; follow the link in the email to confirm your deletion request.

If you previously opted to have your saliva sample and DNA stored by 23andMe, but want to change that preference, you can do so from your account settings page, under “Preferences.”

Users can also remove their consent to use the genetic data and sample for research by 23andMe and third-party researchers. This option is found in the account settings page, under “Research and Product Consents.”

French authority CNIL has previously warned citizens about using genetic-testing services saying “Unlike a password, it is not possible to change your DNA.”