23andMe’s business is built on taking saliva samples from its customers. The DNA from those samples is processed and analyzed in its labs to produce personalized genetic reports detailing a user’s unique health and ancestry. The uncertainty swirling around the company’s future and potential new ownership has prompted privacy campaigners to urge users to delete their data.
“It’s not just you. If anyone in your family gave their DNA to 23&Me, for all of your sakes, close your/their account now,” Meredith Whittaker, president of the encrypted messaging platform Signal, posted on X after the board’s resignation.
“Customers should consider current threats to their privacy as well as threats that may exist in the future—some of which may be magnified if 23AndMe were sold to a new owner,” says Jason Kelley, activism director at the Electronic Frontier Foundation. “23AndMe has protections around this much of this. But a potential sale could put your data in the hands of a far less scrupulous company.”
A spokesperson for 23andMe said that the company has strong customer privacy protections in place, and does not share customer data with third parties without customers’ consent. “Our research program is opt-in, requiring customers to go through a separate, informed consent process before joining,” they say. “We are committed to protecting customer data and are consistently focused on maintaining the privacy of our customers. That will not change.”
Why deleting your account comes with a caveat
Deleting your data from 23andMe is permanent and cannot be reversed. But some of that data will be retained to comply with the company’s legal obligations, according to its privacy statement.
That means 23andMe and its third-party genotyping laboratory will hang onto some of your genetic information, plus your date of birth and sex—alongside data linked to your account deletion request, including your email address and deletion request identifier. When MIT Technology Review asked 23andMe about the nature of the genetic information it retains, it declined to answer.
Any information you’ve previously provided and consented to being used in 23andMe research projects also cannot be removed from ongoing or completed studies, although it will not be used in any future ones.
Beyond the laboratories that process the saliva samples, the company does not share customer information with anyone else unless the user has given permission for it to do so, the spokesperson says, including employers, insurance companies, law enforcement agencies, or any public databases.
