New York CNN —
Many 23andMe customers signed up to the genetic testing service in hopes of learning fun or interesting information about their past. But consumer advocates are now urging those users to request the deletion of their accounts and data from the site, to prevent their genetic information from ending up in unexpected hands.
San Francisco-based 23andMe filed for Chapter 11 bankruptcy protection on Sunday and said it would pursue a sale, after years of struggling to find a sustainable business model. That means the company — and the genetic information of its 15 million customers — will likely soon be up for grabs to the highest bidder.
At least while the company goes through the sale process, it says it won’t change how it manages or protects customer data. And 23andMe board chair Mark Jensen said in a statement that “data privacy will be an important consideration in any potential transaction.”
But a new owner could still mean big changes in how user data is handled and what it’s used for.
“There’s health insurance companies that are interested in this data, there’s life insurance companies that are interested in this data,” California Attorney General Rob Bonta told ABC News7 on Monday. Bonta issued a consumer alert on Friday urging users of the site to consider deleting their accounts.
Here’s how to delete your 23andMe account — and why it matters.
23andMe has tried to reassure customers by pointing to its privacy policy, which currently states that the company won’t sell customers’ identifiable genetic data, and that they’ll only share data with researchers if customers opt in.
The privacy policy states that if users’ data is sold as part of a bankruptcy or acquisition, the same provisions will apply to that personal information under the new entity. But the policy also states that it can be changed at any time.
“That’s just standard language in companies’ privacy policies,” Anya Prince, law professor at the University of Iowa College of Law, said in an interview with CNN’s Terms of Service podcast.
And that matters because people’s DNA can reveal more than just insights into their family history — it could also be used, for example, to tell something about their future health outlook. Data from online genetics services have also been used by law enforcement to help solve crimes, although 23andMe’s current policy says it won’t share information with police without a legally valid warrant.
There is a federal law, the Genetic Information Nondiscrimination Act, that prohibits employers and health insurances companies from discriminating based on genetic information, but the law is not “foolproof” and doesn’t apply to life insurance companies and other types of services, Prince said.
“Theoretically, the new company could have a similar ethos that the consumer feels good about, but the new company might have a completely different ethos,” Prince said.
To delete data from 23andMe, customers should log in to their account and navigate to the “Settings” section of their profile. At the bottom of the page, click on “23andMe Data,” and then “View.” Users can then download their genetic data for their own, personal use before scrolling to the “Delete Data” section and clicking “Permanently Delete Data.”
If customers previously opted to have their saliva sample retained by 23andMe, they can also request that it be discarded under their account settings page, under “Preferences.” And users can also withdraw consent to have their genetic information used by third-party researchers under “Research and Product Consents.”
In an interview with ABC News on Monday, Bonta warned that consumers could encounter a slow or glitchy website when they go to delete their information, but encouraged them to keep trying.
“I was attempting to delete my data today, and the website was down today at times,” Bonta said, adding that the outage may have been caused by heavy traffic to the site with many people seeking to delete their data.
