23andMe bankruptcy puts millions of DNA profiles up for sale—should you worry?

23andMe bankruptcy: What happens to your genetic data and how to delete it before it’s sold

23andMe, once a Silicon Valley darling valued at $6 billion, has filed for Chapter 11 bankruptcy—and with it comes a controversial decision: the company has been granted court approval to sell its customers’ genetic and ancestry data.

For the 15 million users who entrusted the company with their DNA, this raises urgent privacy concerns. Who might buy this sensitive information? Could it be used against them by insurers, employers, or law enforcement? And most importantly, how can past customers delete their data before it’s sold?

This article explores the implications of 23andMe’s bankruptcy, the potential buyers of its genetic database, and the steps users can take to protect their privacy.

The fall of 23andMe: From billion-dollar startup to bankruptcy

Founded in 2006 by Linda Avey and Anne Wojcicki (then-wife of Google co-founder Sergey Brin), 23andMe revolutionised at-home DNA testing. By 2012, the company slashed prices from US$399 to US$99, making ancestry and health reports accessible to millions.

At its peak, 23andMe hosted celebrity “spit parties” and helped users uncover hidden family histories, genetic health risks, and even solve cold cases like the Golden State Killer. However, the company struggled to build a sustainable business model. Unlike subscription services, DNA testing is a one-time purchase, and efforts to monetise data through pharmaceutical partnerships failed to generate enough revenue.

After a series of setbacks—including a 2023 data breach affecting 7 million users, lawsuits, layoffs, and executive turmoil—23andMe filed for bankruptcy on March 24, 2025.

Court approves sale of genetic data—what this means for users

A US bankruptcy judge has ruled that 23andMe can sell its genetic database as part of its assets. Bids are due by May 7, with a final hearing in June.

While the company claims any buyer must comply with its privacy policies, experts warn these protections are flimsy.

Who might buy 23andMe’s data?

Potential bidders include:

1. Pharmaceutical companies – Drug developers could use genetic data to tailor medications or identify test subjects for clinical trials.

2. Insurance providers – Life and health insurers might exploit genetic predispositions to adjust premiums or deny coverage.

3. Law enforcement agencies – Police could expand forensic genetic genealogy, raising civil liberties concerns.

4. Private equity firms – Investors may repackage the data for profit without regard for privacy.

California Attorney General Rob Bonta has already warned that insurers are “interested in this data”.

Can 23andMe’s privacy policies be trusted?

The company insists that security measures will remain intact, but its privacy policy allows changes at any time.

Sara Geoghegan of the Electronic Privacy Information Center (EPIC) cautions:

“Genetic information is uniquely sensitive because it reveals immutable characteristics about ourselves. There is little we can do to control what happens to it.”

How to delete your 23andMe data before it’s sold

If you’re concerned about your genetic data being sold, you can permanently delete it. Here’s how:

Step-by-step deletion guide

1. Log in to your 23andMe account.

2. Go to Settings → 23andMe Data (bottom of the page).

3. Click “View” → You can download your data first if desired.

4. Scroll to “Delete Data” → Select “Permanently Delete Data.”

5. Confirm via email (you’ll receive a link to finalise deletion).

Additional steps

Destroy saliva samples: Under “Preferences”, request disposal of stored samples.

Revoke research consent: Under “Research and Product Consents”, opt out of third-party data sharing.

California’s Genetic Information Privacy Act (GIPA) and California Consumer Privacy Act (CCPA) give residents additional rights to demand data deletion.