With 23andMe entering bankruptcy, here’s how to delete your genetic data

23andMe has officially filed for Chapter 11 bankruptcy protection, which means its assets — including its vast genetic database — will soon be up for sale.

The company continues to sell its at-home DNA testing kits, allowing consumers to get insight into their family histories and genetic profiles. DNA data is particularly sensitive because each person’s sequence is unique, meaning it can never be fully anonymized, according to the National Human Genome Research Institute.

If genetic data falls into the hands of bad actors, it could be used to facilitate identity theft, insurance fraud or other crimes. 23andMe has been plagued by privacy concerns in recent years after hackers accessed the information of nearly 7 million customers in October 2023.

As part of the bankruptcy process, the company said it will seek a partner that shares its commitment to customer data privacy, and that there will be no changes to how it stores, manages and protects data through the sale process.

“Our users’ privacy and data are important considerations in any transaction, and we remain committed to our users’ privacy and to being transparent with our customers about how their data is managed,” the company said in an FAQ page about the bankruptcy filing. “Any buyer of 23andMe will be required to comply with applicable law with respect to the treatment of customer data.”

Still, experts and officials are urging 23andMe customers to proceed with caution. California Attorney General Rob Bonta on Friday issued a consumer alert, encouraging residents to consider deleting their genetic data from 23andMe, which is based in his home state.

“Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company,” Bonta said in the release.

Adrianus Warmenhoven, who serves on the security advisory board at NordVPN, described genetic data as the “blueprint of your entire biological profile.” He encouraged consumers to delete their information and be mindful of the companies they chose to share it with going forward.

“Monitor your digital footprint regularly, and you can also sign up for credit monitoring or identity theft protection services,” Warmenhoven said in a statement to CNBC. “Revoke permissions you no longer require, shut down any account you don’t use, and learn about how your data is used.” 

23andMe said customers can still delete their account and accompanying data. Here’s how:

Delete your genetic data from 23andMe

• Go to 23andMe.com and sign in to your account.
• Click on your profile in the upper righthand corner of the site, then click “Settings.”
• Scroll to the section at the very bottom of the page called “23andMe Data” and click the oval button that says “View.”
• Check the boxes of any data you would like to download and click “Request Download.” This step is optional and can take up to 30 days. Pending downloads will be canceled if you  delete your account.
• Scroll to the bottom of the page and click the red button that says “Permanently Delete Data.”
• You will receive an email with the subject line “23andMe Delete Account Request.” Open it, and click the button that says “Permanently Delete All Records.” Your data will not be deleted unless you complete this step.

At this point, your personal information and your account will be permanently deleted from 23andMe, according to the deletion email from the company. Additionally, your data will not be used in any future research projects, and any personal samples the company was storing will be discarded.

Correction: A prior version of this story had incorrect information about what happens to downloaded data if you delete your account.

WATCH: The rise and fall of 23andMe