DNA and genetic testing agency 23andMe is in turmoil following a 2023 information breach and its ongoing monetary decline. The once-pioneering big now faces an unsure future as chapter looms over the corporate, intensifying issues about what would possibly occur to the genetic information of 23andMe’s some 15 million prospects.
Greatest identified for its saliva-based take a look at kits that provide a glimpse into an individual’s genetic ancestry, 23andMe has seen its worth plummet greater than 99% from its $6 billion peak since going public in early 2021 after failing to show a revenue.
That lack of revenue was attributed to waning shopper curiosity in 23andMe’s use-once take a look at kits and lackluster progress of its subscription companies. The corporate was additionally floored by a enormous months-long information breach that noticed hackers steal the ancestry information of just about 7 million customers all through 2023. The corporate agreed in September to pay $30 million to settle a lawsuit associated to the breach.
Lower than per week later, 23andMe founder and CEO Anne Wojcicki stated she was “contemplating third-party takeover proposals” for the corporate. Wojcicki shortly walked again the assertion, as a substitute saying she deliberate to take the corporate non-public. However the harm was finished, and the entire firm’s unbiased board members resigned with fast impact.
After submitting for chapter safety in March 2024, the corporate’s property — together with huge banks of DNA information — can be bought by way of a court-supervised sale. Wojcicki additionally resigned from the corporate.
The place does that go away hundreds of thousands of individuals’s genetic information?
23andMe sure largely by its personal guidelines
As evidenced by its 2023 information breach, which noticed hackers steal data reminiscent of customers’ genetic predisposition and ancestry studies, 23andMe collects a ton of knowledge on its customers.
Should you’re one of many many hundreds of thousands which have shipped your saliva to 23andMe to find out about your ancestry, you could have assumed that this information will stay non-public below legislation, such because the Well being Insurance coverage Portability and Accountability Act. HIPAA, because it’s identified, units the requirements for safeguarding delicate well being data from being disclosed with no particular person’s data or consent.
Nonetheless, 23andMe just isn’t an organization lined below HIPAA. As such, 23andMe is essentially sure solely by its personal privateness insurance policies, which it will probably change at any time.
Andy Kill, a spokesperson for 23andMe, advised TechCrunch that the corporate believes this can be a “extra applicable and clear mannequin for the info we deal with, moderately than the HIPAA mannequin employed by the standard healthcare trade.”
An absence of federal regulation and a cluttered mess of state privateness legal guidelines in the end signifies that if 23andMe faces a sale, the info of hundreds of thousands of People can also be on the desk. The corporate’s privateness coverage says that its prospects’ private data “could also be accessed, bought or transferred” as a part of a chapter, merger, acquisition, reorganization, or sale.
The truth that buyer information is a saleable asset has additionally been made clear by Wojcicki, who reportedly advised traders that 23andMe will not pursue its cost-intensive drug improvement applications and can as a substitute deal with advertising and marketing its huge database of buyer information to pharmaceutical corporations and researchers.
23andMe maintains that its information privateness insurance policies wouldn’t change within the occasion of a sale. These insurance policies state that the corporate won’t ever share customers’ data with insurance coverage corporations, or with legislation enforcement with no warrant. The latter have more and more turned to third-party DNA corporations for genetic data, however 23andMe has up to now resisted all U.S. legislation enforcement requests for such information, in accordance to its long-running transparency report.
Potential patrons of 23andMe could have totally completely different concepts about learn how to use the corporate’s doubtlessly worthwhile trove of DNA information. Privateness advocates on the digital rights group Digital Frontier Basis have already urged 23andMe to withstand a sale to any firm with ties to legislation enforcement, warning that prospects’ genetics information could possibly be utilized by police to indiscriminately seek for proof of crimes.
“Our personal dedication to use the phrases of our privateness coverage to the non-public data of our prospects within the occasion of a sale or switch is evident: the 23andMe Phrases of Service and Privateness Assertion would stay in place until and till prospects are offered with, and comply with, new phrases and statements — and solely after receiving applicable discover of any new phrases, below relevant information safety legal guidelines,” Kill advised TechCrunch.
Proactively deleting your account
Now as 23andMe faces chapter, there are requires 23andMe prospects to take motion now to guard their information from being bought.
California’s legal professional common Rob Bonta stated in a press release after 23andMe filed for chapter that state residents have a proper to demand the deletion of their genetic information below state legislation.
Meredith Whittaker, the president of end-to-end encrypted messaging app Sign, stated in a put up on X: “It’s not simply you. If anybody in your loved ones gave their DNA to [23andMe], for your whole sakes, shut your/their account now.”
Eva Galperin, the director of cybersecurity on the EFF, additionally warned customers to take motion. “When you’ve got a 23andMe account, at the moment is an effective day to login and request the deletion of your information,” stated Galperin in a put up on X.
Requesting the deletion of your information on 23andMe is comparatively straightforward.
Log in to your 23andMe account and navigate to Settings > Account Data > Delete Your Account. 23andMe will immediate you to substantiate your choice, warning that deleting your account is everlasting and irreversible.
There is a crucial caveat. As famous in 23andMe’s privateness coverage, account deletion is “topic to retention necessities and sure exceptions,” which implies the corporate could maintain on to a few of your information for an unspecified period of time.
For instance, 23andMe will retain your genetic data, date of delivery, and gender “as required for compliance” and can retain restricted information associated to your deletion request, “together with however not restricted to, your e mail handle, account deletion request identifier, communications associated to inquiries or complaints and authorized agreements.”
Equally, for those who’ve already agreed to 23andMe sharing your information for analysis functions, you possibly can reverse that consent, however there’s no approach so that you can delete that data. Kill tells TechCrunch that round 80% of 23andMe prospects — roughly 12 million individuals — consent to take part in its analysis program.
First revealed on October 19, 2024 and up to date since.
