23andMe Bankruptcy Update: DNA Privacy and Data Deletion Guide

23andMe bankruptcy update and DNA privacy data deletion guide

Key takeaways

23andMe filed for Chapter 11 protection in March 2025, and substantially all of its Personal Genome Service and research assets were sold in July 2025.
The buyer, 23andMe Research Institute, formerly TTAM Research Institute, said it would follow the company's privacy policy and add consumer safeguards.
Customers can still review their settings, download available data, request account deletion, request destruction of a stored sample and withdraw research consent.
Genetic information is unusually sensitive and permanent. Consumers should use official account controls and understand that legal rights and retention exceptions vary.

23andMe's bankruptcy created an unusual consumer-privacy question: what happens when a company that stores genetic information sells most of its business through a court-supervised process? The answer is more specific than the early headlines suggested, because the major asset sale has already occurred.

23andMe filed Chapter 11 petitions on March 23, 2025. On July 14, 2025, the company completed the sale of substantially all assets associated with its Personal Genome Service and research businesses to 23andMe Research Institute, previously called TTAM Research Institute. SEC filings describe a $302.5 million cash purchase price for those assets; a related Lemonaid transaction was separately valued at $2.5 million.

What changed after the bankruptcy sale?

The sale transferred operating assets rather than simply shutting the consumer genetics service down. The buyer is a California nonprofit public benefit corporation founded and led by 23andMe co-founder Anne Wojcicki. In the sale announcement, the buyer committed to follow the existing privacy policy, comply with applicable law and adopt additional privacy safeguards.

Those commitments matter, but consumers do not have to make a decision based only on corporate assurances. Account holders can review their own preferences and decide whether to keep using the service, download information, withdraw consent or request deletion.

Why genetic data needs special care

Genetic information differs from an ordinary password or payment card number. A password can be changed after a breach; DNA cannot. Genetic data may also reveal information about biological relatives who never opened an account.

The Federal Trade Commission raised this sensitivity directly in a March 2025 letter to the U.S. Trustee. The FTC highlighted the company's promises about user control, deletion rights and limits on sharing with insurers, employers, public databases and law enforcement except under specified legal circumstances.

Bankruptcy does not erase privacy promises or applicable law. At the same time, the exact protections available to an individual can depend on location, consent history, the type of record and legal retention obligations. Consumers should read the current privacy statement and account notices rather than assuming every category of information is handled identically.

How to review and delete 23andMe data

1. Download anything you want to keep

Before deleting an account, consider downloading available reports or raw data for personal records. Store exported genetic information carefully, preferably in encrypted storage that is not automatically shared with other apps or people.

2. Request permanent account deletion

23andMe's current support guidance says customers can start account deletion through Account Settings. The California Attorney General described the path as Settings, then the "23andMe Data" section, followed by "View" and "Permanently Delete Data."

After a request is submitted, 23andMe sends a confirmation message to the email address associated with the account. The user must follow that confirmation step. The company's support page says the process cannot be canceled after confirmation and the user will lose account access.

3. Review stored-sample preferences

If you previously chose to let 23andMe store a saliva or DNA sample, review the Preferences section and request sample destruction if that is your choice. Account deletion and physical-sample handling are related but distinct concepts, so verify the setting rather than assuming one action automatically covers every item.

4. Withdraw research consent if appropriate

Users who consented to research can review "Research and Product Consents" in account settings. Withdrawing consent can restrict future use, but it may not retract data already used in completed research or already shared in de-identified form under an earlier authorization. Read the consent terms shown in the account for the most precise effect.

5. Secure the account while a request is pending

Use a unique password that is not reused on other websites.
Enable any available multi-factor authentication.
Review connected relatives, sharing settings and third-party integrations.
Be suspicious of emails asking for DNA information, passwords or payment to "protect" an account.
Keep confirmation records for any deletion or sample-destruction request.

What deletion may not mean

"Delete" does not always mean that every trace disappears instantly from every backup or legally required record. Companies may retain limited information for security, fraud prevention, regulatory compliance, dispute resolution or other lawful purposes. De-identified information and data already used in completed research may also be treated differently.

This is why the safest approach is to read the current deletion notice displayed during the request, keep a copy of the confirmation and contact the company if the scope is unclear. Consumers with legal concerns should consult a qualified privacy professional or their state attorney general.

What the sale means for former shareholders

The privacy question is separate from the investment outcome. The former public company entered bankruptcy, sold major operating assets and later proceeded through a Chapter 11 plan. A business continuing under a buyer does not mean the old public shares retain the value of the transferred operations. Investors should rely on bankruptcy-court and SEC records for claims and distribution information, not on the continued existence of the 23andMe brand.

Frequently asked questions

Was 23andMe customer data sold?

The transaction transferred substantially all assets of the Personal Genome Service and research businesses to 23andMe Research Institute. Those operating assets necessarily included data-related systems and contractual rights subject to the court order, privacy commitments and applicable law. It is more accurate to describe a business-and-asset sale than an unrestricted sale of a customer list.

Can customers still delete their accounts?

Yes. 23andMe's support documentation continues to describe an automated account-deletion process through Account Settings, followed by email confirmation.

Should everyone delete their 23andMe data?

That is a personal privacy decision. Some users value ongoing ancestry, relative-matching or health reports; others prefer to minimize long-term storage of genetic information. The important step is to make an informed choice using current settings and official notices.

Does deleting an account remove completed research?

Not necessarily. Withdrawal generally affects future participation, while information already used in completed studies or shared under prior consent may not be retractable. Review the research-consent language presented in the account.

Primary sources

Editorial note: This article reflects official filings and agency guidance available on August 2, 2026. Account controls and privacy terms can change; confirm the current language shown by 23andMe before acting.

Disclaimer: This article provides general educational information and is not legal, medical or cybersecurity advice.