23andMe declares bankruptcy. What you need to know about your data
LEILA FADEL, HOST:
The genetic testing company 23andMe is filing for bankruptcy. Customers spit in a tube and send it to the company for DNA analysis to learn about their health or family history. NPR's Joe Hernandez reports there are privacy concerns about what could happen to all that data.
JOE HERNANDEZ, BYLINE: 23andMe said over the weekend that it's entering bankruptcy proceedings in the hope of finding a buyer. The announcement comes just a few months after the California company laid off roughly 40% of its staff. Now the big question is who that buyer will be, and what they will do with the sensitive information of over 15 million 23andMe users. Suzanne Bernstein is counsel at the nonprofit Electronic Privacy Information Center.
SUZANNE BERNSTEIN: The scale of how much highly sensitive data that 23andMe has is unique.
HERNANDEZ: Several states have passed their own genetic privacy laws, but legal experts say federal law has little to say on the subject. And some laws, such as HIPAA, don't apply to direct-to-consumer companies like 23andMe. Here's Anya Prince, a University of Iowa law professor who studies health privacy.
ANYA PRINCE: It's really hard to control what happens to your information when it's outside the health care space.
HERNANDEZ: She says 23andMe customers worried about a potential sale should consider asking the company to delete their genetic data. 23andMe suffered a major data breach two years ago, which impacted nearly 7 million customer accounts. In an open letter to customers on its website, the company now says it's looking for a buyer who, quote, "shares in its commitment to customer data privacy." Prince says that while there are open questions about what a potential buyer would do, 23andMe already shares anonymized data, including with pharmaceutical companies.
PRINCE: Everybody's worried about what a new company can do with the data. And that is a concern. But frankly, some of the things that people are worried about 23andMe already can do or already does.
HERNANDEZ: The company says it'll remain in operation through the bankruptcy proceedings and that customers can still delete their data and shutter their accounts.
Joe Hernandez, NPR News.
(SOUNDBITE OF MUSIC)
Copyright © 2025 NPR. All rights reserved. Visit our website terms of use and permissions pages at www.npr.org for further information.
Accuracy and availability of NPR transcripts may vary. Transcript text may be revised to correct errors or match updates to audio. Audio on npr.org may be edited after its original broadcast or publication. The authoritative record of NPR’s programming is the audio record.