23andMe files for bankruptcy, and customers are worried about their data

PHOENIX - 23andMe announced it filed for chapter 11 bankruptcy on March 24, and the news has left customers with some concerns over the data the company has.

The backstory:

The human genetics and biotechnology company has faced an uphill battle. Two years after going public in 2021, it experienced a data breach.

Now, the company is looking for a new buyer.

There's a lot unknown about what will happen to 23andMe's database as the company looks for the highest bidder. With the sale, the terms of service can change for millions of users and how their genetic information can be used.

What started as a saliva test kit to learn more about ancestry turned into a platform for extensive health research.

What they're saying:

"I don’t think anyone had really any idea how, let’s say, specific and unique and informative, their genetic data was," Jason Kelley of the Electronic Frontier Foundation said. "Genetic information is way more than an identifier, and it can’t be changed."

Kelley works to defend digital privacy, free speech, and innovation. He says with a new buyer comes the potential for users' genetic information to be used in new ways.

"Most of the agreements that you have are with 23andMe and a new company may be able to sort of finagle away from those agreements," Kelley said.

For now, 23andMe requires a warrant from law enforcement to test DNA samples and access users’ data. It’s helped crack many cold cases here in the Valley.

The most notable case is the death of baby Skylar, a newborn found dead in a Phoenix Sky Harbor airport bathroom trash can. Twenty years later, her mother was brought to justice for her death.

"Through genealogy, we identified someone in the family tree. That person consented to a sample and led the investigation further to Ms. Anderson," Dan Horan with the FBI Violent Crime Task Force said in a previous report.

Dig deeper:

With a new owner, that could all change.

"A new company might not do that, right? They might just run requests from police through all the data, all the time. Who knows what they would do with other requests that aren’t from law enforcement," Kelley said.

Users can access their accounts on 23andMe and Kelley advises people to delete their information from the site before they lose access.

"It’s very complicated to know what rights the new company will have, what rights you will have," Kelley said.

The company released a statement on March 24 saying that data privacy will be an important consideration in the sale, and that "any buyer will be required to comply with applicable law with respect to the treatment of customer data and any transaction will be subject to customary regulatory approvals."

This is a court-supervised sale, and bids will be collected for the next 45 days.

Arizona Attorney General responds to latest development

On March 25, the Arizona Attorney General's Office issued a statement on the matter.

What they're saying:

"Attorney General Kris Mayes today warned Arizona residents regarding the recent bankruptcy filing by 23andMe, a direct-to-consumer genetic testing and information company. 23andme filed for Chapter 11 bankruptcy on March 23, 2025. In a press release, 23andMe stated that despite the bankruptcy, "[t]he Company intends to continue operating its business in the ordinary course throughout the sale process. There are no changes to the way the Company stores, manages, or protects customer data." Yet the bankruptcy raises the risk that 23andMe may attempt to sell Arizonans’ genetic data and other private information as part of the bankruptcy proceedings.

"Arizona law allows consumers to take control of their genetic data and request that a company delete it," said Attorney General Mayes. "Because of 23andMe’s current financial situation, I urge Arizonans to consider invoking their rights under Arizona law and request a deletion of genetic data held by 23andMe."

Due to the sensitive consumer genetic data that 23andMe amassed, Attorney General Mayes reminds Arizona residents of their rights under the Arizona Genetic Information Privacy Act. These include the right to delete the consumer’s account and genetic data and the right to request and obtain the destruction of the consumer’s biological sample.

Consumers can delete their 23andMe account and personal information by taking the following steps:

To Delete Genetic Data from 23andMe:

1. Log into your 23andMe account on their website.
2. Go to the "Settings" section of your profile.
3. Scroll to a section labeled "23andMe Data" at the bottom of the page.
4. Click "View" next to "23andMe Data"
5. Download your data: If you want a copy of your genetic data for personal storage, choose the option to download it to your device before proceeding.
6. Scroll to the "Delete Data" section.
7. Click "Permanently Delete Data."
8. Confirm your request: You’ll receive an email from 23andMe; follow the link in the email to confirm your deletion request.

To Destroy Your 23andMe Test Sample:

If you previously opted to have your saliva sample and DNA stored by 23andMe, but want to change that preference, you can do so from your account settings page, under "Preferences."

To Revoke Permission for Your Genetic Data to be Used for Research:

If you previously consented to 23andMe and third-party researchers using your genetic data and sample for research, you may withdraw consent from the account settings page, under "Research and Product Consents.

Background:

Arizona's Genetic Information Privacy Act (House Bill 2069) became effective on September 29, 2021, mandating direct-to-consumer genetic testing companies to adhere to specific consent requirements and privacy policies.

BusinessNewsArizonaU.S.Consumer