How to delete 23andMe data? Harvard faculty director warns biotech firm's genetic database is not protected by HIPAA amid bankruptcy

On March 23, 2024, DNA testing company 23andMe filed for bankruptcy protection. In addition to this, the company also announced that its Chief Executive Officer, Anne Wojcicki, will step down from her role immediately.

This came after the Attorney General of California advised patrons to delete their data from the company's website due to its "reported financial distress" on March 21, 2025. The company was at the center of a massive data breach in 2023, which exposed the personal information of nearly seven million customers.

I. Glenn Cohen, a faculty director at Harvard Law School, warned users that the company's genetic database is not protected under the Health Insurance Portability Accountability Act (HIPAA) in an article published in The Harvard Gazelle on March 20, 2025.

For the uninitiated, HIPAA was established in 1996 to protect patients' personal health information from being disclosed without their consent.

"The problem is that HIPAA’s definition of covered entities and business associates means that when you have provided information, including your genetic data, not to a hospital system, not to a physician, but to a direct-to-consumer company like 23andMe, you are not covered by HIPAA. You are treated by the law essentially as a consumer, not as the patient," Cohen wrote in the article.

---

How to delete personal data from 23andMe?

On March 21, 2025, California Attorney General Rob Bonta issued a "consumer alert" to 23andMe customers, asking that they "delete their data and destroy any samples of genetic material held by the company.”

“California has robust privacy laws that allow consumers to take control and request that a company delete their genetic data. Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company,” Bonta said.

The official website for the California Department of Justice also instructed patrons on how to delete their personal information from the company's database. According to the website, genetic data can be deleted from the company's database as follows:

1. Log into your 23andMe account.
2. Click on "Settings."
3. Click "View" on the "23andMe Data" section.
4. Click "Download" if you prefer to have a copy of your personal data on your device.
5. Click on "Permanently Detele Data" from the "Delete Data" section.
6. Follow the link sent via email to your registered email ID to confirm your request.

The company uses patrons' saliva samples to track their genetic lineage, with the sample and DNA generally stored in the company database with the customer's permission.

Customers can destroy their saliva samples and DNA stored in the database by updating their preferences in the "Preferences" option under the "Settings" page.

If customers have previously consented to their genetic data being used for research, they can revoke their consent in the “Research and Product Consents” option under the "Settings" page.

---

23andMe laid off 40% of its workforce in November 2024

According to the BBC, the DNA testing company was started in 2006 and gained popularity in 2021, earning endorsements from celebrities like Snoop Dogg and Oprah Winfrey. However, the company laid off nearly 40% of its workforce (amounting to 200 people), in November 2024, two months after it settled a lawsuit regarding its data breach in 2023.

The company's share prices fell over 70% in 2024. Anne Wojcicki, the company's then-CEO, said in a statement at the time:

"We are taking these difficult but necessary actions as we restructure 23andMe and focus on the long-term success of our core consumer business and research partnerships."

In March 2025, the company revealed it had filed for bankruptcy protection, with Wojcicki stepping down as CEO, however, she will remain a board member. Joe Selsavage, the company's finance chief, will succeed Wojcicki as the interim CEO.

During a press release on March 23, the company said it was "committed to continuing to safeguard customer data," adding:

"We want to thank our employees for their dedication to 23andMe’s mission. We are committed to supporting them as we move through the process. In addition, we are committed to continuing to safeguard customer data and being transparent about the management of user data going forward, and data privacy will be an important consideration in any potential transaction.”

The statement added that the company will undergo a "court-supervised sale process" to maximize its value, allowing the court to help the company address its "operational and financial challenges."