The uncertain future of 23andMe and user data risks

Wednesday 26 March 2025 - 12:10

By: Zahouani Ilham

The uncertain future of 23andMe and user data risks

Users of 23andMe, a well-known direct-to-consumer genetic testing company, are being advised to delete their data following the company's recent bankruptcy filing in the United States on March 23. The company, which has collected genetic information from approximately 15 million users since its founding in 2006, now faces the possibility of having its data assets sold to the highest bidder.

The Downfall of 23andMe

Originally offering services focused on ancestry and genetic traits, 23andMe later expanded into health-related genetic testing and drug research. Despite going public in 2021 with a $3.5 billion valuation, economic struggles and declining sales left the company financially vulnerable. In October, it laid off 40% of its workforce, and its stock price recently dropped below $1, leading to a potential delisting from NASDAQ.

Risks to User Data

While 23andMe has reassured customers that its bankruptcy will not impact data security, legal experts and authorities remain skeptical. The attorneys general of New York and California have urged users to delete their data, as a potential buyer may not be bound by the company’s past confidentiality commitments. Arthur Caplan, a bioethics expert, warns that if the company is sold, previous privacy assurances could become void, increasing the risk of unauthorized data usage.

Gaps in US Data Protection Laws

Unlike the European Union, the US lacks a comprehensive federal data privacy law. Additionally, 23andMe is not covered by HIPAA, which protects medical records, since it is not classified as a medical entity. This means law enforcement agencies can access user data with a warrant, as demonstrated in past criminal investigations involving genealogy databases.

Past Controversies and Security Breaches

Even before its bankruptcy, 23andMe faced scrutiny over its data security. In 2023, hackers breached the company’s systems, exposing the personal information of nearly 7 million users. The company later settled a lawsuit for $30 million. Furthermore, experts have questioned the accuracy of its genetic ancestry claims, suggesting the company’s real goal was to collect and monetize genetic data for research purposes.

What Comes Next?

As part of its bankruptcy process, 23andMe has launched a 45-day bidding period for its assets. Former CEO Anne Wojcicki has stepped down to submit her own bid for the company. While she remains optimistic about its future, previous attempts to take the company private were rejected due to stock valuation concerns.

With the company’s fate uncertain and growing concerns about data privacy, users are increasingly taking action to safeguard their genetic information.