March 24, 2025  — 23andMe has filed for Chapter 11 bankruptcy, raising serious concerns about the future of the genetic data of over 14 million users. As the company begins a court-supervised sale of its assets, customers and privacy advocates alike are asking what happens next to some of the most personal information a company can hold.

Despite the filing, the company will continue operating in the ordinary course of business, buoyed by a $35 million commitment in debtor-in-possession (DIP) financing from JMB Capital Partners. However, behind the formal announcements lies a much more personal question for millions of customers: What happens to our genetic data?

From Silicon Valley Darling to Bankruptcy Court

Founded in 2006, 23andMe rose to fame by offering at-home DNA testing kits that promised to unlock secrets of ancestry, traits, and health risks. It quickly became a household name, collecting genetic data from over 14 million users and striking major pharmaceutical partnerships, including a $300 million collaboration with GlaxoSmithKline.

But recent years have not been kind. A major 2023 data breach compromised information from nearly 7 million users, eroding public trust. Combined with financial struggles and a pivot toward monetizing its genetic database, 23andMe found itself outpaced by both investor expectations and consumer skepticism.

The final blow came this month when the company’s board rejected a non-binding acquisition proposal from co-founder Anne Wojcicki and her affiliates. Wojcicki has now resigned as CEO, though she remains on the board. Joe Selsavage, the company’s CFO, has stepped in as interim CEO, while Matt Kvarda of Alvarez & Marsal will serve as Chief Restructuring Officer.

No Change to DNA Access — For Now

In its statement, 23andMe emphasized that there will be no changes to how it manages or protects customer data during the bankruptcy process. The company also assured the public that any potential buyer of its assets will be required to comply with all applicable privacy laws.

Still, that has done little to quell growing anxiety.

“Even anonymized, genetic data is not truly anonymous,” noted one privacy and cybersecurity advisor, in response to the announcement. “The value of the company lies in the data — and that is what’s being sold.”

The concern is not theoretical. California Attorney General Rob Bonta issued a consumer alert reminding 23andMe customers of their right to delete their genetic data under California’s Genetic Information Privacy Act (GIPA) and the California Consumer Privacy Act (CCPA).

“Given 23andMe’s reported financial distress,” Bonta said, “I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples.”

California has some of the strongest consumer privacy laws in the country. But if you live in another state, your rights to delete or control your genetic data depend on your state’s laws — and many don’t offer the same protections.

Here’s how it breaks down:

California

• Genetic Information Privacy Act (GIPA) and California Consumer Privacy Act (CCPA) allow:
  
  • Deletion of your genetic data and account
  • Destruction of your biological sample (saliva)
  • Revocation of research consent
  • Legal enforcement if the company fails to comply
    

Other States

• A handful of states (like Colorado, Virginia, Connecticut, and Utah) have passed general data privacy laws, but:
  
  • They may not specifically address genetic data
  • They often don’t go as far as California in terms of explicit rights and enforcement
  • Enforcement varies and typically relies on state attorney general action, not individuals
    
• Most states have no specific laws addressing consumer genetic data. That means:
  
  • You may not have the legal right to demand deletion
  • Protections may be limited to what’s in 23andMe’s privacy policy or terms of service, which are subject to change (especially in bankruptcy)

What about Colorado?

In Colorado, the Colorado Privacy Act (CPA) provides residents with specific rights regarding their personal data, including genetic information. Effective since July 1, 2023, the CPA classifies genetic data as sensitive data, thereby granting it enhanced protections. ​Husch Blackwell: Trusted Legal Leaders+2Intuitive Data Privacy+2Eye On Privacy+2

Under the CPA, Colorado residents have the right to:

• Access their personal data held by companies.
• Correct inaccuracies in their data.
• Delete their personal data upon request.
• Opt out of the processing of their sensitive data, including genetic information.
  

Companies are required to obtain affirmative consent before processing sensitive data. ​Husch Blackwell: Trusted Legal Leaders

Additionally, on August 6, 2024, Colorado expanded the definition of sensitive data to include biological data, which encompasses genetic information. This amendment further strengthens the protections around genetic data. ​Colorado General Assembly+3Eye On Privacy+3Hunton Andrews Kurth+3

In the context of 23andMe’s bankruptcy, Colorado residents can exercise their rights under the CPA to request the deletion of their genetic data. It’s advisable to contact 23andMe directly to understand their data retention policies and the procedures for data deletion.​Husch Blackwell: Trusted Legal Leaders+2Hunton Andrews Kurth+2Intuitive Data Privacy+2

For detailed guidance on exercising your rights under the CPA, you can refer to the Colorado Privacy Act Resource Center.

So what can non-California users do?

• Delete your data manually: 23andMe still allows any user to delete their data through account settings, regardless of state laws. But this could change depending on the new buyer’s policies.
• Withdraw research consent: You can still do this from your account — even if your state doesn’t require it.
• Request sample destruction: Same applies here — you can opt out through your preferences if you previously gave 23andMe permission to store your sample.
• Keep a record: If you take these steps, document your actions (screenshots, confirmation emails) in case questions arise later.

An Industry Reckoning

The collapse of 23andMe is more than the downfall of a single company—it marks a critical moment of reckoning for the entire consumer genomics industry. Privacy advocates and biotech experts are urging a shift toward a more responsible and transparent future, one where business models are built around user control and informed consent. They argue that the focus must move beyond novelty reports toward meaningful clinical value, that profit motives must align with the public’s trust, and that stronger regulatory oversight is essential in managing sensitive biological data.

“You can reset your password. You can’t reset your genome,” said one viral comment. That truth is now hitting home for millions of people who willingly shared their most personal information in exchange for curiosity-driven insights.

Looking Ahead

23andMe has 45 days to secure bids for its assets under a court-supervised process. Any sale will require regulatory approval, including from antitrust and foreign investment authorities.

But as the company navigates bankruptcy court, the broader question persists: Can the next wave of biotech companies rebuild the trust that has been lost?

Because while 23andMe’s financial future may still be up for auction, the ethical future of consumer genomics is now in the hands of lawmakers, companies — and the people whose data made it all possible.

23andMe’s bankruptcy highlights a dangerous gap in U.S. consumer protections. Your genome is uniquely yours — but without federal standards or stronger state laws, many Americans are left relying on the goodwill of a bankrupt company or an unknown buyer.

Want to be proactive? Consider reaching out to your state representatives about supporting stronger digital privacy laws, especially those covering biometric and genetic data.

How to Delete Your Genetic Data

For concerned users, here’s currently how to delete your data:

• Delete Your Data: Log into your 23andMe account, go to Settings → 23andMe Data → “Permanently Delete Data.”
• Download a Copy First (Optional): Before deletion, download your data if you want to keep a personal copy.
• Destroy Your DNA Sample: Change your preference in the Settings → Preferences section.
• Withdraw from Research: Opt out of research use of your genetic information from the Research & Product Consents section.

More Info:
To follow updates on the Chapter 11 proceedings or submit claims, visit: https://restructuring.ra.kroll.com/23andMeEditor’s Note: Have you used 23andMe? Are you concerned about what happens to your data? We want to hear your thoughts.