Delete Your Data from 23andMe

Summary

The Wirecutter Show – Episode Summary: "Delete Your Data from 23andMe"

Release Date: March 28, 2025

In this compelling bonus episode of The Wirecutter Show, hosts Christine Cyrclassette, Kyra Blackwell, and Rosie Guerin delve into the recent bankruptcy filing of the prominent DNA genetic testing company, 23andMe. The episode provides an in-depth analysis of the potential ramifications for users who have entrusted the company with their genetic data, underscoring critical privacy and security concerns.

---

1. Episode Introduction

The episode opens with Rosie Guerin announcing a special bonus edition dedicated to the unprecedented news of 23andMe filing for bankruptcy. The hosts immediately address the gravity of the situation, highlighting the profound impact this development may have on individuals who have previously utilized the company's genetic testing services.

Christine Cyrclassette (00:03): "Oh, so bad. It has a lot of knockdown effects for people who've taken these tests."

Rosie Guerin (00:38): "It's scary and it's a lot of information. Arguably the most vital, private, important information any person has."

---

2. 23andMe's Bankruptcy: Background and Context

Rosie Guerin elaborates on the bankruptcy filing, explaining that 23andMe has been grappling with declining fortunes for some time, exacerbated by a significant data breach in 2023 that compromised the genetic information of approximately seven million customers. This breach, coupled with ongoing rumors of a potential sale since the previous year, culminated in the Chapter 11 filing as the company seeks a buyer.

Max Eddy, a Wirecutter writer specializing in privacy and security, provides critical insight into the situation:

Max Eddy (04:44): "This week 23andMe filed for Chapter 11 bankruptcy and they are currently looking for a buyer to take over the company. This was not a surprise...there was a data breach in 2023 which exposed the information of 7 million customers and it has just been down since then."

---

3. Risks to Customers: Privacy and Data Security Concerns

The core of the discussion centers on the privacy implications for users who have submitted their genetic information to 23andMe. Unlike traditional medical information, the genetic data handled by 23andMe is not protected under HIPAA (Health Insurance Portability and Accountability Act), leaving it vulnerable to misuse.

Christine Cyrclassette (02:11): "Misused left and right."

Max Eddy (05:25): "This information is not covered by HIPAA...the data that 23andMe holds is deeply, deeply personal...there's perhaps nothing more personal than your genetic information."

The hosts emphasize that the sensitivity of genetic data extends beyond the individual to potentially include extended family members, creating a network effect of privacy vulnerabilities.

---

4. Deleting Your Data: A Step-by-Step Guide

Given the bankruptcy and the uncertain future of data handling by potential new owners, the episode provides a comprehensive guide for users to delete their genetic data from 23andMe. The steps outlined by Max Eddy are as follows:

1. Log into the 23andMe website and navigate to the Settings section.

2. Scroll to the bottom of the page to find the "23andMe Data" option and click "View".

3. Download Your Data: Users are advised to download their genetic information before deletion. However, this process can be time-consuming and may require multiple attempts due to website lag.

   Rosie Guerin (09:16): "It took almost the entire evening... their website was really, really laggy."

4. After downloading, select "Delete Data" and then "Permanently Delete".

5. Complete any additional authentication steps sent via email to finalize the deletion process.

6. Revoke Consent for Future Research: Under Product Consents in the Settings, users can revoke permission for their data to be used in future research.

7. Opt for Sample Destruction: Users have the option to have their physical genetic samples destroyed through the Settings menu.

Max Eddy (09:16): "You're going to log into the site... you will have to follow the instructions that come in an email after the fact."

---

5. Potential Consequences if Data is Not Deleted

The episode explores the worst-case scenarios should users opt not to delete their data. Max Eddy speculates on possibilities such as unauthorized access by companies with dubious intentions, including the misuse of genetic data for creating bioweapons or unwarranted surveillance.

Max Eddy (07:56): "They could be used for tracking individuals, tying it to law enforcement databases... it's hard to say because we don't know... what happens next is unclear."

Additionally, he highlights the concern that once data is sold, the original consent and safeguards might not transfer to the new owners, potentially exposing users to unforeseen risks.

---

6. Broader Privacy Implications: Law Enforcement and Family Connections

The conversation broadens to address how genetic data can influence not just the individual but also their relatives. Max Eddy references the Golden State Killer case, where genetic information from public databases was instrumental in identifying the perpetrator after decades.

Max Eddy (12:36): "In 2018, the so-called Golden State Killer was found after 40 years using a combination of genetic information and traditional genealogy research."

While this case demonstrates the positive applications of genetic data, it also raises alarms about potential abuses. The hosts discuss the fine line between beneficial uses and intrusive surveillance, urging listeners to remain vigilant about how their genetic information is utilized.

---

7. Conclusion and Recommendations

As the episode wraps up, the hosts reiterate the importance of taking control of personal genetic data in light of 23andMe's bankruptcy. They encourage listeners to proactively delete their data to safeguard their privacy and recommend consulting Wirecutter’s detailed guides for further assistance.

Rosie Guerin (15:14): "If you want to find out exactly how to delete your data, you can check out Max's coverage on the Wirecutter website."

The episode serves as a crucial reminder of the persistent and evolving challenges surrounding genetic data privacy, emphasizing that such decisions have far-reaching implications beyond the individual.

---

Key Takeaways:

• 23andMe's Bankruptcy: Signals potential risks for users regarding their genetic data.
• Privacy Concerns: Genetic data is highly sensitive and not protected under HIPAA.
• Action Steps: Users should download and delete their data promptly, revoke research consents, and opt for sample destruction if desired.
• Broader Implications: Genetic information affects not only individuals but also their relatives and can be misused in various ways.
• Proactive Measures: Staying informed and taking control of personal data is essential in the digital age.

For a detailed, step-by-step guide on deleting your 23andMe data, visit the Wirecutter website and refer to Max Eddy's comprehensive coverage.

Transcript

[Christine Cyrclassette]

I'm Christine Cyrclassette.

[Kyra Blackwell]

I'm Kyra Blackwell.

[Rosie Guerin]

I'm Rosie Guerin and you're listening to the Wirecutter Show. Kyra, Christine. We are popping in for a quick bonus episode this week to talk about some news that broke about the DNA genetic testing company 23andMe. It filed for bankruptcy.

[Christine Cyrclassette]

Oh, so bad. It has a lot of knockdown effects for people who've taken these tests.

[Rosie Guerin]

It's scary and it's a lot of information. Arguably the most vital, private, important information any person has access to your genetic makeup.

[Christine Cyrclassette]

Have you guys taken a DNA test?

[Rosie Guerin]

I just, funnily enough, got my results back from 23andMe last week.

[Christine Cyrclassette]

Ooh, what's timing? Wow.

[Rosie Guerin]

Bizarre timing. We knew when we opted into doing it that there was a chance that bankruptcy could happen because it's been in the news for months. But it was still important for a variety of reasons to do it. But we went back and forth for a long time questioning the safety versus, you know, the benefits of getting some information. I was adopted. It was a closed adoption. I don't have family history and I don't have health history, which, I'm sorry to have to tell you this, I'm not actually getting any younger, so. No way. I know, I know. I'm shocked, too. And so the older I get, the more important it becomes to get some access to my health history.

[Kyra Blackwell]

And that puts you in such a vulnerable position because you have to trust this company to handle your very precious information.

[Rosie Guerin]

It was a choice for sure.

[Max Eddy]

Yeah.

[Kyra Blackwell]

I remember My parents did a 23andMe, both of them, about two years ago, and all of us kids rioted because many black people have trust issues with stuff like that. Genetic history is really important and it's been used against us for law enforcement.

[Christine Cyrclassette]

Misused left and right.

[Max Eddy]

It's scary.

[Rosie Guerin]

Well, it's also, if your parents did it, that necessarily means your genetic information to a certain extent is also.

[Kyra Blackwell]

We're all implicated.

[Rosie Guerin]

Implicated. Yeah.

[Christine Cyrclassette]

Well, you know, we have covered these DNA test kits for years at Wirecutter, and it's been kind of, you know, controversial, even internally for us. I mean, we obviously, we reviewed them, we did a very, very rigorous job, but we've always had data privacy, security questions about DNA kits. Right. Like, once you send off that information, it's out there, a company owns it and you kind of don't know what's going to happen afterwards. And this is what we're going to talk about today because there's been some, some news this week about 23andMe. There are reasons why if you have used the service or anyone in your family has used the service, you probably want to think about deleting your information. So we got in touch with Max Eddy, who's a writer for Wirecutter covering privacy, security and software. He knows a lot about data privacy. And Rosie, I think you're going to take it away and find out what people need to know.

[Rosie Guerin]

Yeah, I want to talk to Max about what happened, what's at stake, what are the risks, and how to go about deleting the data. So we're going to take a quick break and Max will be with me on the other side.

[Christine Cyrclassette]

This podcast is supported by Instagram.

[Instagram]

Introducing Instagram teen accounts. A new way to keep your teen safer as they grow. Like making sure they always have their seatbelt on.

[Christine Cyrclassette]

Alright, sweetie pie, buckle up.

[Max Eddy]

Good job.

[Instagram]

Or ring the bell on their bike.

[Christine Cyrclassette]

Okay, kid, give it a try.

[Max Eddy]

Nice.

[Instagram]

Or remember their elbow pads.

[Christine Cyrclassette]

Knees too. Okay. Yep, There you go.

[Instagram]

New Instagram teen accounts. Automatic protections for who can contact your teen and the content they can see.

[Indeed]

This podcast is supported by dsw.

[G]

This season, let your shoes do the talking. Designer shoe warehouse is packed with fresh styles that speak to your whole vibe without saying a word. From cool sneakers that look good with everything. The easy sandals you'll want to wear on repeat. DSW has you covered. Find a shoe for every hue from the brands you love, like Birkenstock, Nike, Adidas, New Balance and more. Head to your DSW store or visit DSW.com today.

[Rosie Guerin]

Max, thanks for joining us. Thanks for jumping on.

[Max Eddy]

Glad to be here.

[Rosie Guerin]

So 23andMe was in the news this week as we know what happened.

[Max Eddy]

So this week 23andMe filed for Chapter 11 bankruptcy and they are currently looking for a buyer to take over the company. This was not a surprise. The company had been in decline for quite some time. There was a data breach in 2023 which exposed the information of 7 million custom and it has just been down since then. In fact, talk of a sale started last year. So again, this is not really a surprise.

[Rosie Guerin]

So 23andMe filed for bankruptcy. We knew that was a possibility. It's happened. What are the tangible risks for customers who've used the product?

[Max Eddy]

So the concern here is that there's not a lot of regulations around the kind of data that 23andMe and other companies like it are holding. This information is not covered by hipaa, which is legislation limits how far medical information could be spread and that's not the case here. So all those customers who signed up with this service thinking one thing might find out that their information is being used for another thing if it's purchased by another company. And we have to assume that the data that is held by 23andMe is a primary asset of the company, people are not going to be buying this for the brand. They're probably going to be buying it, at least in part for access to that information. And the information that 23andMe holds is deeply, deeply personal. There's perhaps nothing more personal than your genetic information.

[Rosie Guerin]

As personal as it gets.

[Max Eddy]

Yeah, it's entirely. It's immutable. You can't change it. And it links back to one specific person, you. And that is a big concern. And it's also a concern because even if you haven't submitted your genetic information to 23andMe or a company like it, if someone in your extended family has, you can still be linked to them. So there's an enormous network effect here of not just the individuals who could be affected, but everyone that they related to. And I believe that 23andMe has something like 15 million customers. That's a lot of people.

[Rosie Guerin]

Yeah, it's definitely scary. Your piece that you reported and is up on the Wirecutter site right now is called 23andMe just filed for bankruptcy. You should delete your data now with a period at the end that's pretty strong. Why delete data?

[Max Eddy]

Well, I should say that, you know, this is not just me and the people at Wirecutter who believe this. You know, many others have come forward, most notably the California Attorney general actually put a consumer warning a few days before bankruptcy was declared just because it was possible that this would happen. And I think that that really underlines, like, the concern that is felt across the board about this information suddenly being up for grabs. We should say that to the company's credit, they have said that they intend to be transparent about the process and follow the existing rules, regulations, but it's still going to be a new company that takes it over. And what happens next is unclear.

[Rosie Guerin]

Max, I know this is a little bit of a theoretical question, but I am curious, what is the worst that could happen if you don't delete your data?

[Max Eddy]

It's really hard to look at theoreticals, right, because anything could happen. Perhaps the most likely bad outcome would be that this data is purchased by a company that just has radically different views about how to handle it and what to do with it. You know, like a real out there possibility. I don't know. Maybe they're going to, like make bioweapons with it or something. And you don't want your data used for that. It could be used for tracking individuals, tying it to law enforcement databases. You know, it's so hard to say because we don't know whether terms of any potential sale, we don't know what kind of safeguards are going to be put around the data and what safeguards currently exist around the data. The main thing that people should consider is that they opted into this service under one set of experts, that their data would be handled in a specific way, that they would be able to remove it, that they would be able to have it destroyed, and that they would be able to opt out of research, and that there would be certain considerations given to interacting with law enforcement and that that may not be true in the future. And by deleting it now, you are doing the most that you can to keep control over how that information is used.

[Rosie Guerin]

What exact steps do folks need to take to delete their data if they're concerned? What do you.

[Max Eddy]

First off, when you go to delete your data, you will have the opportunity to download it. So, you know, if this is something that's deeply important to you and you're interested in the science, perhaps you can get a copy of it. I have seen some people complaining that the size of the file may be significant, so it could take a while.

[Rosie Guerin]

That was our experience. It took almost the entire evening.

[Max Eddy]

Goodness.

[Rosie Guerin]

There were a lot of screenshots involved. Their website was really, really laggy. But it obviously was important that we did it and downloaded that information for future use.

[Max Eddy]

Yeah, yeah, it's great to get that right. Like, if you've already invested the time and effort to get yourself checked out like this, you know, having that is. Is valuable. So the instructions as we understand them. So you're going to go and you're going to log into the site. You're going to navigate to Settings. At the bottom of the page, you're going to see an option that says 23andMe data and then view. You're going to click View. That is your opportunity to download it. And that might take a while. You're then going to select Delete Data and then click Permanently Delete. At this point, the company is probably going to send you an email asking for additional authentication and confirmation from you. So you're going to need your password, you're going to need some more information about your account, and you're going to need to follow the instructions that come in an email after the fact. My understanding is that unless you complete the instructions in the email, your data may not be deleted. Once you've done that, take a look at the section called Product Consents and from there you can revoke consent for future research using your genetic material. It's important to understand that if you already opted in to have your genetic information used in research, it cannot be retroactively taken away. That research is done. It's already been included in there. This is only going forward. Additionally, in the Settings section of the site, you'll be able to opt to have your sample destroyed.

[Rosie Guerin]

Okay, so once your data is deleted, you get the confirmations, you've gone through all the steps. Should you consider yourself in the clear and good to go? Now?

[Max Eddy]

That's a really good question. You know, the thing that's interesting about this privacy problem around not just 23andMe, but services like it is those knock on effects, right? That your genetic information affects not just you, but everyone that you're related to. And it can be used in a variety of different ways. Even when it's been anonymized, obviously it still links back directly to you. So, you know, it's more like a lot of opportunities for there to be privacy problems in the future with this. And I think it's an opportunity to consider how much medical and personal information people are willing to share with companies. This is, as we said, deeply personal information. So I think this is a question that people should be asking not just now, but going forward when they have the opportunity to do something similar in the future.

[Rosie Guerin]

Yeah, it's really, it's a personal choice. We sort of ruminated for a very, very long time and happened to have this bizarro timing as the company is dissolving. But yeah, I mean, part of the reason it took so long was there are, you know, lots of considerations when you are giving such personal, the most personal, as you said, information to a company you don't have control over. I'm wondering from you, is there anything else folks should know or consider or even keep an eye out for?

[Max Eddy]

So two things actually. First off, I want to stress that while there's a, you know, there's a clutch of people out there who believe in like privacy maximalism and will look down on people that, you know, do anything that exposes any part of their privacy, as you know, that that's a foolish thing or that people who use these services are like following a fad and they're just being very cavalier with their personal information. But I don't Think that's true. You know, obviously this provides value to people and it's a personal decision. So I just want to underline that people who use this service are not foolish and they haven't made a mistake. This is a unusual situation and everyone is trying to figure it out going forward. You know, these services offer not just information about your health pot potentially, but also people's backgrounds. It can reconnect people with family that they might not have had access to, and it can complete their knowledge of their family history, which not everyone has. So I just want to underline that. The other thing is that we've seen examples of how genetic information uploaded to services like 23andMe can be used by law enforcement. There's a very great example. In 2018, the so called Golden State Killer was found after 40 years using a combination of genetic information and traditional genealogy research, using open source information. So building family trees, linking that to publicly available genetic information in order to locate an individual. This is obviously like a good story, right? Like we want to see bad people brought to justice. But in privacy and security issues, we should always be thinking about the context. When you change the context slightly, it might not seem so great. You know, would we be comfortable with the same technique used to track down people who are have parking violations or we're in a protest? So. So it's important to understand how these connect with law enforcement. 23andMe, to its credit, was one of the few services that did not proactively cooperate with law enforcement. They required a warrant for any information. The people who wrote our guide at Wirecutter did an incredible job of breaking down the privacy and security considerations of these services. If you go there, you can see their rundown of the whole thing. So that's the other aspect of this. It's not just these sort of amorphous privacy discussions. There's also some very real connections to very real consequences.

[Rosie Guerin]

Max Eddy, staff writer at Wirecutter, really, really appreciate you joining us. Appreciate your reporting. Thank you. If you want to find out exactly how to delete your data, you can check out Max's coverage on the Wirecutter website. Of course, you can check out Wirecutter's guide to home DNA kits. Lots of great information there. And that's on the site. We'll link it in our show notes as well. Max, thank you so, so much.

[Max Eddy]

Thanks for having me.

[Indeed]

You just realized your business needed to hire someone yesterday. How can you find amazing candidates fast? Easy. Just use. Indeed. Join the 3.5 million employers worldwide that use Indeed to hire great talent fast. There's no need to wait any longer. Speed up your hiring right now with Indeed and listeners of this show will get a $75 sponsored job credit. To get your jobs more at indeed.com NYT just go to indeed.com NYT right now and support our show by saying you heard about Indeed on this podcast. Indeed.com NYT terms and conditions apply. Hiring Indeed is all you need.