'Have no regulations': Users urged to delete data as 23andMe files for bankruptcy

CINCINNATI (WKRC) — The genetic testing company, 23andMe, has filed for bankruptcy.

As the company seeks new ownership, it said that its users' data and information will be protected. However, Intrust IT cybersecurity consultant Dave Hatter said that there are some real concerns.

"15 million Americans roughly have sent their DNA to a private company," said Hatter. "You go to the hospital, you get blood tests, they do DNA testing, and so forth. Why get them? But they're covered by HIPAA; they're covered by federal regulations."

Regulations and protections, Hatter says, 23andMe doesn't have.

"These private companies essentially have no regulations other than possibly some state law. Nineteen states have some kind of privacy law on the books now; unfortunately, Ohio isn't one yet," said Hatter.

Hatter offered up his advice for those who have used 23andMe.

"My recommendation to you aligns with the state Attorney General of California, who's been very clear that people should go immediately delete their data because there's so much risk here for folks. I totally agree," said Hatter.

He said that people who have used the service can log on to 23andMe's site, go through the menu, and choose to permanently delete their data. An email confirmation will follow to verify the request.

"Then, hope that your data is actually physically removed from their data set. So, that if and when the company's assets are sold, your data, your DNA data, is no longer in that data set that gets sold to another third party or to a third party rather, over which you have probably zero control and no idea what's happening with your data," said Hatter.

This comes after 23andMe was the victim of a data breach in 2023 that affected millions of its customers profiles.