By Alicia McElhaney and Alexander Gladstone

23andMe filed for bankruptcy on Monday, proposing to try to sell all of its assets. For consumers who have provided genetic data to the company for testing purposes, here's what to know:

What happened to 23andMe?

The DNA-testing company was a hit with consumers who bought its DNA testing kits but never managed to turn that success into a viable business model. Efforts to use DNA to develop pharmaceutical drugs ran into costly delays and an attempt to move to subscription-based services failed to draw enough interest.

What has the company said about its plans?

In an open letter to its customers, 23andMe said that there will be no changes to how it stores, manages and protects customer data. "Any buyer of 23andMe will be required to comply with applicable law with respect to the treatment of customer data," the company said. For the time being, 23andMe plans to continue operations in the ordinary course of business, which means consumers can continue to order test kits and the company will continue to process samples.

In court documents, 23andMe said that it plans to try to sell all of its assets. It has already received early interest from certain potential buyers, including former chief executive and co-founder Anne Wojcicki. The company says those offers are "not actionable."

How do I delete my 23andMe account data?

Log in to your 23andMe account and go to the "Settings" section of your profile. Then scroll to a section labeled "23andMe Data" at the bottom of the page. Click "View" next to "23andMe Data." You can download your genetic data if you want a copy for personal storage, according to the instructions from California Attorney General Rob Bonta's office.

After that, scroll to the "Delete Data" section and click "Permanently Delete Data." You'll receive an email from 23andMe. Follow the link in the data to confirm your deletion request.

Certain state authorities are encouraging 23andMe customers to delete any personal information that may be held by the company. Bonta said last week that in light of 23andMe's financial distress, his agency urged consumers to delete their genetic data and destroy any samples of genetic material held by the company.

Bonta's office also said that if you previously opted to have your saliva sample and DNA stored by 23andMe, it suggests destroying it by changing your preference under your account settings page, under "Preferences."

What can happen to my genetic data in a bankruptcy sale?

For consumer data, a bankruptcy sale may offer more protections than a transaction outside of the legal framework of chapter 11.

In certain bankruptcy cases, a judge can appoint a consumer privacy ombudsman, who makes a recommendation on whether a bankrupt company should be allowed to sell consumers' private information. For example, when lab testing startup uBiome filed for bankruptcy in 2019, the court appointed one such ombudsman, who ultimately recommended approval of the sale of personal data, pending certain restrictions.

A debtor can argue that an ombudsman isn't necessary when their privacy policy is not violated, leaving many cases without official oversight of consumer data.

What are the legal protections and guardrails for my data?

In the U.S., consumer data is protected primarily via company privacy statements that consumers sign onto, and a patchwork of state laws.

According to 23andMe's privacy statement, if the company is involved in a bankruptcy, merger, or sale, customers' personal information will be sold as a part of that transaction. The privacy statement will continue to apply to customers after the new owner takes over.

Although 23andMe deals with genetic information, saliva samples, and self-reported health and family information from its customers, it is not subject to HIPAA, or the Health Insurance Portability and Accountability Act, according to Shannon Hartsfield, partner at Holland & Knight who specializes in health data privacy.

A patchwork of state consumer privacy laws, including California's Consumer Privacy Act and the Illinois Genetic Information Privacy Act, can help reign in companies when it comes to personal data.

"When you're outside of HIPAA regulation, I don't know that the government is going to necessarily fill that gap," Hartsfield said. "You have to look at what you're signing. If privacy is important to consumers, they need to read before they sign."

Write to Alicia McElhaney at alicia.mcelhaney@wsj.com and Alexander Gladstone at alexander.gladstone@wsj.com

(END) Dow Jones Newswires

March 24, 2025 11:23 ET (15:23 GMT)

Copyright (c) 2025 Dow Jones & Company, Inc.