23andDelete
March 25, 2025 2:06 PM Subscribe
Genetic testing and analysis company 23andMe has entered Chapter 11 bankruptcy, with the intent of putting its corporate assets for sale - including its genetic library.
In response to this, the California Attorney General's office has put out a consumer alert for the company's clients to request their data be deleted and samples destroyed;
In response to this, the California Attorney General's office has put out a consumer alert for the company's clients to request their data be deleted and samples destroyed;
California Attorney General Rob Bonta today issued a consumer alert to customers of 23andMe, a genetic testing and information company. The California-based company has publicly reported that it is in financial distress and stated in securities filings that there is substantial doubt about its ability to continue as a going concern. Due to the trove of sensitive consumer data 23andMe has amassed, Attorney General Bonta reminds Californians of their right to direct the deletion of their genetic data under the Genetic Information Privacy Act (GIPA) and California Consumer Privacy Act (CCPA). Californians who want to invoke these rights can do so by going to 23andMe's website.
Reminder that 23andMe already had a data breech in 2023 that leaked a portion of their user data.
posted by gwint at 2:14 PM on March 25 [3 favorites]
posted by gwint at 2:14 PM on March 25 [3 favorites]
I wrote some notes about deleting your own data back in 2019. The interesting part there is about archiving your data first, you can (or could) download SNPs to use with other systems. OTOH I wrote that over five years ago so no idea if the product changed.
posted by Nelson at 2:15 PM on March 25 [2 favorites]
posted by Nelson at 2:15 PM on March 25 [2 favorites]
Actually this is shockingly good news. If 23AndMe had stayed in buisness, then eventually they'd wind up owned by some future billionaire president, with a focus upon racial purity, so really these bankruptsy proceedings sound like the current best case scenario. It's possible such a billionaire buys them during bankruptsy, but right now we've some non-zero chance for deletion. :)
posted by jeffburdges at 2:48 PM on March 25 [1 favorite]
posted by jeffburdges at 2:48 PM on March 25 [1 favorite]
If 23AndMe had stayed in buisness, then eventually they'd wind up owned by some future billionaire president, with a focus upon racial purity
This information is already out there; the data breach in 2023 saw the release of user information grouped by genetic ancestry on the dark web.
posted by Pseudonymous Cognomen at 2:57 PM on March 25 [3 favorites]
This information is already out there; the data breach in 2023 saw the release of user information grouped by genetic ancestry on the dark web.
posted by Pseudonymous Cognomen at 2:57 PM on March 25 [3 favorites]
I can speak to this directly about pulling your data before deletion. If you want to get your Phased Genotype Data and Imputed Genotype Data R6, you actually need to file a request which takes a few days. The reports you can get in settings are:
posted by jadepearl at 2:58 PM on March 25 [5 favorites]
-
Reports Summary
Ancestry Composition Raw Data
Family Tree Data
Raw Data
posted by jadepearl at 2:58 PM on March 25 [5 favorites]
I got tapped for a local TV news interview about this today.
Based on this thread, I'm not displeased with what I said.
posted by humbug at 3:02 PM on March 25 [3 favorites]
Based on this thread, I'm not displeased with what I said.
posted by humbug at 3:02 PM on March 25 [3 favorites]
If the breach in 2023 doesn't sound horrible enough in and of itself, the hackers were repeatedly focused on obtaining lists of people with Jewish or Chinese ancestry.
posted by DirtyOldTown at 3:36 PM on March 25 [13 favorites]
posted by DirtyOldTown at 3:36 PM on March 25 [13 favorites]
I have never done any of the genetic services and I'm an only child whose parents never did them (my dad died before they were invented and I'm pretty sure my mom had skeletons in her family's closet she wanted to keep quiet). I am really relieved I don't have to deal with this problem.
That said, I've seen folks on Bluesky railing about how if you're on Facebook you've already given the panopticon so much information that the genetic data is meaningless. I'm not sure that's true for everybody--especially not Americans if the government repeals the section of the ACA that prevents the use of "pre-existing conditions" to increase your insurance costs--but there is a contrarian take out there.
posted by gentlyepigrams at 3:40 PM on March 25 [2 favorites]
That said, I've seen folks on Bluesky railing about how if you're on Facebook you've already given the panopticon so much information that the genetic data is meaningless. I'm not sure that's true for everybody--especially not Americans if the government repeals the section of the ACA that prevents the use of "pre-existing conditions" to increase your insurance costs--but there is a contrarian take out there.
posted by gentlyepigrams at 3:40 PM on March 25 [2 favorites]
honest question (and not trying to be provocative): what are some actual scenarios of this data being used by hackers or other bad actors?
posted by rude.boy at 4:38 PM on March 25 [2 favorites]
posted by rude.boy at 4:38 PM on March 25 [2 favorites]
I guess it's worthwhile to highlight one of the BlueSky arguments about this specifically so people can see the full context of it, which is pointing out how if all the laws surrounding privacy on this data get overturned they won't need 23andMe data to get access to your genetic data anyway (they could just require genetic testing for coverage or test material they get ahold of), that using it for police work is time consuming and not very fruitful, and that the biggest problem about 23andMe going into bankruptcy is it used to be an affordable resource people could use to get information about some SNPs that there are not commercially available test for so doctors cannot order it but knowing that information could affect your treatment.
posted by foxfirefey at 5:02 PM on March 25 [6 favorites]
posted by foxfirefey at 5:02 PM on March 25 [6 favorites]
I have a friend with data at 23AndMe. She refuses to do anything. She has no concern about anything they might do with her genetic data. After all, they promised to keep it anonymous. She thinks people are concerned about "science fiction" things.
She's not dumb. But I've stopped talking to her about it.
posted by lhauser at 5:09 PM on March 25
She's not dumb. But I've stopped talking to her about it.
posted by lhauser at 5:09 PM on March 25
rude.boy: The releases based on the leak seemed purposebuilt to spark hate crimes.
foxfirefey: "if" is doing a lot of work there.
posted by humbug at 5:47 PM on March 25 [2 favorites]
foxfirefey: "if" is doing a lot of work there.
posted by humbug at 5:47 PM on March 25 [2 favorites]
rude.boy: the anti-Semites will go bananas with it.
posted by Melismata at 6:10 PM on March 25 [1 favorite]
posted by Melismata at 6:10 PM on March 25 [1 favorite]
ah, yes, antisemites, famously concerned with limiting themselves to verifiable facts and making sure they do their homework to avoid targeting the wrong people
posted by DoctorFedora at 6:35 PM on March 25 [7 favorites]
posted by DoctorFedora at 6:35 PM on March 25 [7 favorites]
It's also not an impossible future scenario where a company sells this data to insurance companies to use in some way to deny coverage, deny coverage of specific care, or otherwise use in some way that benefits them financially at the cost of a person's health. I know the pre-existing condition part of the ACA is blocking some (all?) of that, but we're in a spot where there are no guarantees on anything protective for the public at large to stay in place.
Additionally, even if some of this is technically anonymized, depending on what is included there can be ways to de-anonymize it by context. I don't know the details of how they anonymized it, but I do know that I don't trust either a private equity firm that might buy them or a health insurance company to keep any promises beyond however far over the line they think they can get away with.
posted by past unusual at 7:40 PM on March 25 [2 favorites]
Additionally, even if some of this is technically anonymized, depending on what is included there can be ways to de-anonymize it by context. I don't know the details of how they anonymized it, but I do know that I don't trust either a private equity firm that might buy them or a health insurance company to keep any promises beyond however far over the line they think they can get away with.
posted by past unusual at 7:40 PM on March 25 [2 favorites]
I do not know if it is—or will ever be—possible to create a biological weapon that targets people with certain genetic markers, but I’m reasonably certain some people are trying, and if they succeed they will target genetic markers that I have.
posted by Jon_Evil at 7:51 PM on March 25 [1 favorite]
posted by Jon_Evil at 7:51 PM on March 25 [1 favorite]
Also I don’t think insurance companies are going to follow the law, and they are trying to (or already are) using genetic data to inform their decisions to dent coverage and just not telling us that’s what they’re doing.
posted by Jon_Evil at 7:53 PM on March 25
posted by Jon_Evil at 7:53 PM on March 25
It's also not an impossible future scenario where a company sells this data to insurance companies to use in some way to deny coverage, deny coverage of specific care, or otherwise use in some way that benefits them financially at the cost of a person's health. I know the pre-existing condition part of the ACA is blocking some (all?) of that, but we're in a spot where there are no guarantees on anything protective for the public at large to stay in place.
It's not the ACA, but an older law - the Genetic Information Nondiscrimination Act (GINA), which explicitly bans the use of genetic information in insurer decisionmaking.
posted by NoxAeternum at 7:54 PM on March 25 [6 favorites]
It's not the ACA, but an older law - the Genetic Information Nondiscrimination Act (GINA), which explicitly bans the use of genetic information in insurer decisionmaking.
posted by NoxAeternum at 7:54 PM on March 25 [6 favorites]
Why would any of you give a corporation your genetic data in the first place? NOW you're worried? They already gave it to every flavor of cop imaginable, I don't doubt they've already sold it or given it away or leaked it elsewhere.
posted by wafehling at 9:58 PM on March 25 [2 favorites]
posted by wafehling at 9:58 PM on March 25 [2 favorites]
I guess you had to be there in the 90s to appreciate how awe inspiring the human genome project was. Because I grew up with that on my mind, the opportunity in the mid-aughts to participate in what I thought was the most spectacular science ever (and for such a low price) felt genuinely special.
That’s why, wafehling.
posted by BuddhaInABucket at 11:29 PM on March 25 [20 favorites]
That’s why, wafehling.
posted by BuddhaInABucket at 11:29 PM on March 25 [20 favorites]
23andFlee?
posted by Calvin and the Duplicators at 11:53 PM on March 25 [2 favorites]
posted by Calvin and the Duplicators at 11:53 PM on March 25 [2 favorites]
This is the 24th comment
posted by DeepSeaHaggis at 12:15 AM on March 26 [1 favorite]
posted by DeepSeaHaggis at 12:15 AM on March 26 [1 favorite]
Give an enormocorp, especially a US one, my genetic data? Haha yeah no.
posted by GallonOfAlan at 12:40 AM on March 26 [2 favorites]
posted by GallonOfAlan at 12:40 AM on March 26 [2 favorites]
Over on the orange site discussion thread about the California AG 23andme consumer alert, Animats made the following insightful comment:
> The problem, not stated, is that a bankruptcy can wipe out the obligations of a company to its customers. This includes privacy obligations.[1] Especially if the assets are sold to a company outside California or outside the US.
[1] https://harvardlawreview.org/print/vol-138/data-privacy-in-bankruptcy-the-consumer-privacy-ombudsman/
posted by are-coral-made at 3:57 AM on March 26 [6 favorites]
> The problem, not stated, is that a bankruptcy can wipe out the obligations of a company to its customers. This includes privacy obligations.[1] Especially if the assets are sold to a company outside California or outside the US.
[1] https://harvardlawreview.org/print/vol-138/data-privacy-in-bankruptcy-the-consumer-privacy-ombudsman/
posted by are-coral-made at 3:57 AM on March 26 [6 favorites]
Why would any of you give a corporation your genetic data in the first place?
It's helpful in cases where there has been an adoption. My father was adopted, and all my life people have asked me that ”what are you?" question. I didn't really have a complete answer to that, but now I do.
I have a friend who was made a ward of the state and subsequently fostered then adopted as a little girl. Her bio parents were estranged from their extended family, and when the bio parents died, any potential connection to that family was lost. Adopted family was also a garbage fire. Friend took a 23andme test, and found out the extended family had been trying to find her. It was (and is) a happy ending
posted by surlyben at 5:43 AM on March 26 [14 favorites]
It's helpful in cases where there has been an adoption. My father was adopted, and all my life people have asked me that ”what are you?" question. I didn't really have a complete answer to that, but now I do.
I have a friend who was made a ward of the state and subsequently fostered then adopted as a little girl. Her bio parents were estranged from their extended family, and when the bio parents died, any potential connection to that family was lost. Adopted family was also a garbage fire. Friend took a 23andme test, and found out the extended family had been trying to find her. It was (and is) a happy ending
posted by surlyben at 5:43 AM on March 26 [14 favorites]
> Also I don’t think insurance companies are going to follow the law, and they are trying to (or already are) using genetic data to inform their decisions to dent coverage and just not telling us that’s what they’re doing.
Feed the genetic database as one part of the feedstock to some AI algorithm, then ask it if someone should be given "expedited" insurance coverage or asked for more paperwork.
The data is not clearly being used, they just happened to use a commercial database that contained it, oh my, how did that happen. And it wasn't causing denials, it just was advising enough caution that a large percent of people flagged don't get the coverage.
Throw a few levels more obfuscation on top of that, and you'd need a huge complex legal case to prove the genetic data is begin used to effectively deny coverage, but still drive profit. And this relies on the genetic data being in some pseudo-public database that "happens" to be hoovered up by the AI selling the assistant.
How big it the penalty multiplier on damages with the no genetic data law?
posted by NotAYakk at 6:40 AM on March 26 [6 favorites]
Feed the genetic database as one part of the feedstock to some AI algorithm, then ask it if someone should be given "expedited" insurance coverage or asked for more paperwork.
The data is not clearly being used, they just happened to use a commercial database that contained it, oh my, how did that happen. And it wasn't causing denials, it just was advising enough caution that a large percent of people flagged don't get the coverage.
Throw a few levels more obfuscation on top of that, and you'd need a huge complex legal case to prove the genetic data is begin used to effectively deny coverage, but still drive profit. And this relies on the genetic data being in some pseudo-public database that "happens" to be hoovered up by the AI selling the assistant.
How big it the penalty multiplier on damages with the no genetic data law?
posted by NotAYakk at 6:40 AM on March 26 [6 favorites]
If you seriously believe (a) this data hasn't already covertly been sold to/shared with other companies and law enforcement no matter what their policies or the law says, and (b) that "deleting" the data actually deletes it, I have a bridge in Brooklyn to sell you.
posted by star gentle uterus at 7:45 AM on March 26 [1 favorite]
posted by star gentle uterus at 7:45 AM on March 26 [1 favorite]
Requesting data deletion will only mean that you no longer have visibility. For the data and all copies and backups to be withdrawn and erased or even the provision of full anonymisation requires diligence on their part that it would be cretinous to expect. The data has value, I would be shocked if it hadn't already been sold and wasn't going to be sold again.
Edit: I am in agreement with the post above.
posted by epo at 7:49 AM on March 26 [1 favorite]
Edit: I am in agreement with the post above.
posted by epo at 7:49 AM on March 26 [1 favorite]
the opportunity in the mid-aughts to participate in what I thought was the most spectacular science ever
I guess people need to be reminded anew that science, no matter how spectacular, does not obviate ethics.
posted by splitpeasoup at 7:57 AM on March 26
I guess people need to be reminded anew that science, no matter how spectacular, does not obviate ethics.
posted by splitpeasoup at 7:57 AM on March 26
Why would any of you give a corporation your genetic data in the first place? NOW you're worried?
This is an arrogant and ignorant comment.
Me, I paid 23AndMe to analyze my DNA because I was interested in the science they were doing early on, both in general and for me personally. That turned out to be not very useful to me. But what did turn out to be useful was it helped me confirm that I had a surprise half brother, helping me understand a whole lot of family history that was previously unknown to me. If I hadn't checked a privacy box 23andMe would have told me about his existence. As it was, our genetic profiles was the key part of me understanding the guy on the other end of the phone was for real and not a scammer.
More generally, corporate genetic testing is very popular for lots of reasons. I'm particularly moved by the stories of African Americans for whom genetic testing is the only means to reconstruct family histories broken by slavery. That's more of an Ancestry thing and other genealogy services but it still requires trusting a corporation. Everyone I've talked to who has done it has a very thoughtful understanding of the tradeoffs and risks.
They already gave it to every flavor of cop imaginable
That is not true. 23andMe has had a policy of resisting law enforcement and government requests. According to their February 2025 transparency report had received 15 requests for user data and given user data away in zero of them.
Other companies are not so respectful of their customers: GEDmatch and FamilyTreeDNA have been aggressive about sharing genetic data with law enforcement.
posted by Nelson at 7:58 AM on March 26 [15 favorites]
This is an arrogant and ignorant comment.
Me, I paid 23AndMe to analyze my DNA because I was interested in the science they were doing early on, both in general and for me personally. That turned out to be not very useful to me. But what did turn out to be useful was it helped me confirm that I had a surprise half brother, helping me understand a whole lot of family history that was previously unknown to me. If I hadn't checked a privacy box 23andMe would have told me about his existence. As it was, our genetic profiles was the key part of me understanding the guy on the other end of the phone was for real and not a scammer.
More generally, corporate genetic testing is very popular for lots of reasons. I'm particularly moved by the stories of African Americans for whom genetic testing is the only means to reconstruct family histories broken by slavery. That's more of an Ancestry thing and other genealogy services but it still requires trusting a corporation. Everyone I've talked to who has done it has a very thoughtful understanding of the tradeoffs and risks.
They already gave it to every flavor of cop imaginable
That is not true. 23andMe has had a policy of resisting law enforcement and government requests. According to their February 2025 transparency report had received 15 requests for user data and given user data away in zero of them.
Other companies are not so respectful of their customers: GEDmatch and FamilyTreeDNA have been aggressive about sharing genetic data with law enforcement.
posted by Nelson at 7:58 AM on March 26 [15 favorites]
Mod note: One comment deleted, let's avoid personal attacks and calling another MeFite "sucker". Please refer to the content policy.
posted by loup (staff) at 8:54 AM on March 26 [2 favorites]
posted by loup (staff) at 8:54 AM on March 26 [2 favorites]
I got my deletion request in hours before this news. Supposedly my data is already gone, but who can really say?
posted by 1adam12 at 11:01 AM on March 26 [1 favorite]
posted by 1adam12 at 11:01 AM on March 26 [1 favorite]
I wonder about exposure for those whose relatives bought in. I'm not particularly fussed about it - anybody who wants my DNA need only grab my garbage, and the city does that twice a week. If the government wants it, I can't keep them from it without a degree of daily care that I'm just not interested in.
I'm actually quite happy that a couple of my cousins did 23andme. Nobody in my immediate family had, but just that connection helped my surprise sister find dad, and she's great.
People that were suspicious and didn't give? Yay for you, being right. People that have and found interesting or important info about themselves and maybe unknown family? Yay for you, being right.
Here, as most places, there's nuance.
posted by Vigilant at 1:31 PM on March 26
I'm actually quite happy that a couple of my cousins did 23andme. Nobody in my immediate family had, but just that connection helped my surprise sister find dad, and she's great.
People that were suspicious and didn't give? Yay for you, being right. People that have and found interesting or important info about themselves and maybe unknown family? Yay for you, being right.
Here, as most places, there's nuance.
posted by Vigilant at 1:31 PM on March 26
I do not know if it is—or will ever be—possible to create a biological weapon that targets people with certain genetic markers, but I’m reasonably certain some people are trying
I'm not being snarky when this sounds like another James Bond bit (see: No Time to Die) about to come to life in the "real world" (right alongside the crazy billionaire doing Evil Things).
posted by gtrwolf at 2:06 PM on March 26
I'm not being snarky when this sounds like another James Bond bit (see: No Time to Die) about to come to life in the "real world" (right alongside the crazy billionaire doing Evil Things).
posted by gtrwolf at 2:06 PM on March 26
Why would any of you give a corporation your genetic data in the first place?
I've been a genealogist for over 25 years (ever since reading an article in Wired about the LDS church putting their records online; I found a family tree back to the 1600's that turned out to be mostly accurate, and discovered what turned out to be long-term hobby), and DNA was a way to supplement and verify the paper records--or in some cases, to upend what I thought I knew; I discovered thanks to DNA that the father of one of my great-grandmothers was not, in fact, the man on her birth certificate, but instead a man who, on paper, was her uncle-by-marriage...who was also the younger brother of her husband's grandmother, which means those particular great-grandparents were first cousins once removed and almost certainly never knew they had a blood relationship.
Also, at this point, If you're an American or Canadian with pre-1900 immigrant ancestry, then it's very likely that enough of your relatives both near and distant have taken commercial DNA tests to render you identifiable through public DNA databases, whether or not any of the companies maintaining those databases have your DNA, specifically.
posted by Pseudonymous Cognomen at 3:31 PM on March 26 [1 favorite]
I've been a genealogist for over 25 years (ever since reading an article in Wired about the LDS church putting their records online; I found a family tree back to the 1600's that turned out to be mostly accurate, and discovered what turned out to be long-term hobby), and DNA was a way to supplement and verify the paper records--or in some cases, to upend what I thought I knew; I discovered thanks to DNA that the father of one of my great-grandmothers was not, in fact, the man on her birth certificate, but instead a man who, on paper, was her uncle-by-marriage...who was also the younger brother of her husband's grandmother, which means those particular great-grandparents were first cousins once removed and almost certainly never knew they had a blood relationship.
Also, at this point, If you're an American or Canadian with pre-1900 immigrant ancestry, then it's very likely that enough of your relatives both near and distant have taken commercial DNA tests to render you identifiable through public DNA databases, whether or not any of the companies maintaining those databases have your DNA, specifically.
posted by Pseudonymous Cognomen at 3:31 PM on March 26 [1 favorite]
Why would any of you give a corporation your genetic data in the first place?
I was conceived in the early 1970s with the use of an anonymous sperm donor. My parents kept that information a secret from me for more than four decades. They intended to take that secret to their graves, but I participated in National Geographic's Genographic Project when I was 45. My ethnic heritage results were very different than what I'd been told since childhood and the truth was out.
Finding out in middle age that I am not the human being I believed myself to be, and that the two people I trusted most in the world had orchestrated a decades-long deception at my expense, is the single most destabilizing and traumatic thing that's ever happened to me (and I say that as a nurse who worked at the bedside through the entire pandemic so I know a little bit about being traumatized). Even after lots of introspection and therapy I have yet to discover a silver lining to this overwhelmingly distressing experience.
Genetic testing via one of the commercial direct-to-consumer tests is the only thing that might change that. It's definitely the only way I could learn whose DNA makes up half of me. It's the only hope I have of getting any medical history on my paternal side. It's the only way to fill in the blanks.
I have, and many other donor-conceived people have, carefully and thoughtfully considered the potential risks and benefits of using these services. I don't know anyone who feels great about it. But it's our only option.
posted by jesourie at 3:59 PM on March 26 [6 favorites]
I was conceived in the early 1970s with the use of an anonymous sperm donor. My parents kept that information a secret from me for more than four decades. They intended to take that secret to their graves, but I participated in National Geographic's Genographic Project when I was 45. My ethnic heritage results were very different than what I'd been told since childhood and the truth was out.
Finding out in middle age that I am not the human being I believed myself to be, and that the two people I trusted most in the world had orchestrated a decades-long deception at my expense, is the single most destabilizing and traumatic thing that's ever happened to me (and I say that as a nurse who worked at the bedside through the entire pandemic so I know a little bit about being traumatized). Even after lots of introspection and therapy I have yet to discover a silver lining to this overwhelmingly distressing experience.
Genetic testing via one of the commercial direct-to-consumer tests is the only thing that might change that. It's definitely the only way I could learn whose DNA makes up half of me. It's the only hope I have of getting any medical history on my paternal side. It's the only way to fill in the blanks.
I have, and many other donor-conceived people have, carefully and thoughtfully considered the potential risks and benefits of using these services. I don't know anyone who feels great about it. But it's our only option.
posted by jesourie at 3:59 PM on March 26 [6 favorites]
My relatives did the genetic testing and at that point, I figured mine was already out of the bag as is. Also I was rooting for secret interesting ancestry or surprise relatives, neither of which actually happened.
posted by jenfullmoon at 10:28 PM on March 26
posted by jenfullmoon at 10:28 PM on March 26
Had another teevee news interview about this today -- said that I felt really bad for 23andMe users in general, and in particular for adoptees and folks investigating genetic risks. Nobody deserves this betrayal of trust. (In fact I said -- not on camera! -- "this is bullshit.")
Turns out the reporter I was talking to is an adoptee. So yeah, I feel even better about what I said.
posted by humbug at 1:05 PM on March 28 [1 favorite]
Turns out the reporter I was talking to is an adoptee. So yeah, I feel even better about what I said.
posted by humbug at 1:05 PM on March 28 [1 favorite]
« Older What Even Is a Mental Image? | Stanley Donen's "Saturn 3" Newer »
posted by rhizome at 2:10 PM on March 25 [16 favorites]