23andMe files for bankruptcy. What does this mean for your genetic data?

• Experts urge 23andMe costumers to delete their data after genetic company files for bankruptcy.
• Even if 23andMe costumers delete their data, the company will still retain some of your genetic information.

DNA testing firm 23andMe filed for bankruptcy on Sunday, and experts are warning users to take action now.

The Sunday announcement stated the genetics testing firm entered voluntary Chapter 11 restructuring and sale process. The company states it intends to continue operations as normal, with no changes to how it stores, manages or protects customer data.

23andMe is looking to "sell substantially all of its assets" and is seeking authorization from the court to do so, according to a press release. This is raising concerns with experts, who are telling customers to delete their data now rather than later if they don't want their data potentially sold to another company.

“If 23andMe goes bankrupt, these data will most likely be sold to the highest bidder, a successor company that customers might not want to entrust with their genetic data,” three law professors wrote in an article in the New England Journal of Medicine.

They described the issue as “a structural problem in a legal system relying heavily on privacy policies to protect consumer data, while also treating those data as a valuable asset.”

23andMe has stated that it will continue to protect its clients' data even during the bankruptcy process.

“We remain committed to our users’ privacy and to being transparent with our customers about how their data is managed,” it said. “Any buyer of 23andMe will be required to comply with applicable law with respect to the treatment of customer data.”

Here's a look at what's happening and what you can do to protect your information.

23andMe hack, bankruptcy leave customers' info vulnerable

In 2023, 23andMe was hacked, reporting that "threat actors" used about 14,000 accounts to access the ancestry data of 6.9 million.

The breach resulted in a class action lawsuit and in September 2024 the company agreed to pay a $30 million settlement. Six months later, 23andMe filed for bankruptcy.

The authors of the New England Journal of Medicine article raised concerns that 23andMe reserves the right to transfer customer data in case of sale or bankruptcy, and customers can’t fully protect their data from being “accessed, sold or transferred as part of that transaction.”

They've also urged Congress to step in to help do more to shield consumer data from such corporate changes.

Can I delete my 23andMe data?

Yes, but it could be a process and not all of it might be deleted.

Tennesseans who have used 23andMe can remove personal information by opting out of the 23andMe data section of account settings. The data is deleted once a user submits and confirms the request, according to the company's website.

The company's website states that it is legally required to retain certain data, though.

"23andMe and/or our contracted genotyping laboratory will retain your Genetic Information, date of birth and sex as required for compliance with applicable legal obligations … even if you chose to delete your account," the company's privacy statement says.

Meaning your genetic information will still remain with the company.

“The filing shows how dangerous it is to provide your DNA directly to a large, for-profit commercial genetic database,” wrote Jason Koebler, a co-founder of post on technology-focused 404 Media. “Once you give your genetic information to a company like 23andMe, there is no way to have any clue what is going to happen to that data, how it is going to be analyzed, how it is going to be monetized, how it is going to be protected from hackers, and who it is going to be shared with for profit.”

USA TODAY contributed to this article.