23andMe bankruptcy could expose customers’ genetic data - Los Angeles Times
▻https://www.latimes.com/business/story/2025-03-29/23andme-bankruptcy-genetic-testing-privacy-dna
By Caroline Petrow-Cohen and Stacy Perman
March 29, 2025 3 AM PT
Once a promising company briefly valued at $6 billion, 23andMe popularized at-home DNA test kits and spawned a cottage industry of ancestry hunters and true crime sleuths.
But the company could not build a sustainable business and many of the 15 million people who gave their genetic information to the platform are worried about where their personal data could end up.
When Christina Snyder Monahan of Irvine first received her genetic results from 23andMe three years ago, she thought there was a mistake.
The DNA sample she had sent to the company revealed that she was nearly 50% Persian, though to her knowledge, she didn’t have any Persian relatives. More than a year later, her mother admitted to having an “encounter” with another man, who was her actual biological father and not the man who raised her.
After adjusting to the shock, Monahan embraced the news, using 23andMe to meet relatives she never knew she had, including a first cousin and four half-siblings. Her biological father died before she learned of his existence.
“I was completely blown away,” Monahan said. “The app gave me meaningful information about the region in Iran my father hailed from.”
“Genetic information is uniquely sensitive because it reveals immutable characteristics about ourselves,” said Sara Geoghegan, senior counsel at the Electronic Privacy Information Center. “I would be very concerned if I had given a swab to 23andMe. There is little we can do to control what happens to it.”
The company’s online terms of service says, “Your sample is processed in an irreversible manner and cannot be returned to you. Any information derived from your sample remains subject to rights we retain as set forth in these Terms.”
23andMe customers are protected by the terms of service, but these terms can be changed by the company or its new owner at any time, Geoghegan said. Terms of service are also often written broadly or vaguely, and “privacy policies are wholly inadequate to protect our personal information,” she said.
The 23andMe website crashed last week as customers rushed to delete their data, the Wall Street Journal reported. As concerns spread, the company issued a statement clarifying that “potential buyers must, among other requirements, agree to comply with 23andMe’s consumer privacy policy and all applicable laws with respect to the treatment of customer data.”
A company spokesperson declined to comment for this story and referred to previous statements.
In 2023, a company data breach affected nearly 7 million customers, and last year, 23andMe agreed to pay $30 million to settle a class-action lawsuit accusing the company of failing to protect its customers.
“I do think people should be worried,” he said. “There’s lots of different actors who would want this data for a lot of different purposes, far beyond what you probably thought you were consenting to when you were just interested in genealogy.”
Pharmaceutical companies, insurance companies or law enforcement might be interested in obtaining the data, Christo said. An insurance company might use genetic information to determine pre-existing health conditions and consequentially raise rates for that individual, he said.