Genomic testing company 23andMe, which was known for hosting "spit parties" to collect saliva samples so customers could find out their ancestry, has filed for bankruptcy.
It comes after years of struggling to make a profitable business model and a reputational hit from a massive data breach in 2023.
Now the company's assets are set to be sold off, there are fears about what this means for customers' data.
Will people's data be sold?
It sounds like it.
The company plans to "sell substantially all of its assets" if its bankruptcy filing is approved by a court, 23andMe said in a statement.
"The privacy statement reserves the company's right to transfer customers' personal information in the event of a sale or bankruptcy," Harvard law professor I Glenn Cohen said in a piece for the Harvard Gazette.
"Customers can't protect their data from being accessed, sold, or transferred as part of that transaction."
How safe will that data be?
"We are committed to continuing to safeguard customer data and being transparent about the management of user data going forward, and data privacy will be an important consideration in any potential transaction," 23andMe chair Mark Jensen said.
Any buyer would be "required to comply with applicable law with respect to the treatment of customer data", the company's statement said.
And, in the meantime, "there are are no changes to the way the company stores, manages, or protects customer data" the company said in a blog post.
Who could buy that data?
It's unclear.
"23andMe will look to secure a partner who shares in its commitment to customer data privacy and will further its mission of helping people access, understand and benefit from the human genome," the company said in a blog post.
How can you make sure your data is safe?
"If this is something that worries you, this might be a time to go in and delete that information in your account, even though it’s not a perfect solve," Professor Cohen said.
California's Attorney General Rob Bonta urged people in his state to consider deleting their data and asking for their saliva sample to be destroyed in what he described as an urgent "consumer alert".
"I remind Californians to consider invoking their rights," he said.
The alert contained step-by-step instructions on how to do that.
How to delete genetic data from 23andMe
Mr Bonta listed the following instructions on how to delete data from the website in eight steps.
He reminded people that they had to take the extra step of confirming they wanted their data deleted by email:
- Log into your 23andMe account on their website.
- Go to the "Settings" section of your profile.
- Scroll to a section labelled "23andMe Data" at the bottom of the page.
- Click "View" next to "23andMe Data"
- Download your data: If you want a copy of your genetic data for personal storage, choose the option to download it to your device before proceeding.
- Scroll to the "Delete Data" section.
- Click "Permanently Delete Data."
- Confirm your request: You'll receive an email from 23andMe; follow the link in the email to confirm your deletion request.
This will mean your saliva samples will be "securely destroyed", the 23andME website says.
How to get 23andMe to destroy your spit sample
The company analyses customers' deoxyribonucleic acid (DNA) by having them deposit saliva samples into a collection container for testing.
These samples go into storage via process 23andMe calls "biobanking".
But customers can request the company to destroy their saliva sample.
People have to log into their 23andMe account and go to the account settings page.
Once they get to "preferences", they can change the preference to store their sample.
Here's what the 23andMe website says happens next:
"Once you withdraw your biobanking consent, 23andMe will securely discard your stored Samples within the legally applicable timeframe."
How to stop allowing your data to be used for research:
This only impacts you if you've consented to letting the company and other parties to use your data and same for research.
But you can revoke your consent.
This is something you have to do by logging into your account, going to the account settings page and heading to the "Research and Product Consents" section.
But this isn't instantaneous, nor does it mean the your data is deleted from research that has already used your data.
Here's what the 23andMe's website says on that:
"23andMe will prevent your data from being shared after 30 days from receipt of your request (it may take up to 30 days to withdraw your information after you withdraw consent).
"If you withdraw your consent, any data that has been shared prior to this date cannot be reversed or undone."
But not everything will be completely wiped immediately
The company will retain some of your data, which Jess Weatherbed called a "notable issue" in a piece for The Verge.
It says it hangs on to your birthday, sex and genetic information because of legal requirements.
We asked the company if it retained this information indefinitely, or if it does eventually get deleted but it did not address these questions.
Here's what the company says on that on its privacy statement page:
"23andMe and/or our contracted genotyping laboratory will retain your Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations, including the federal Clinical Laboratory Improvement Amendments of 1988 (CLIA), California Business and Professions Code Section 1265 and College of American Pathologists (CAP) accreditation requirements, even if you chose to delete your account.
"23andMe will also retain limited information related to your account and data deletion request, including but not limited to, your email address, account deletion request identifier, communications related to inquiries or complaints and legal agreements for a limited period of time as required by law, contractual obligations, and/or as necessary for the establishment, exercise or defense of legal claims and for audit and compliance purposes."
ABC with Associated Press
