Estimated read time: 3-4 minutes

KEY TAKEAWAYS

• 23andMe filed for bankruptcy following weak demand for testing kits after a data breach affected 7 million users.
• Utah’s Department of Commerce issued an alert about genetic data rights and protections, with information on how to delete genetic data, destroy samples, and revoke research permissions.

SALT LAKE CITY — Biotech company 23andMe on Sunday filed for bankruptcy in the U.S. after struggling with the fallout of a data breach and weak demand for its ancestry testing kits.

Predictably, this news left many customers feeling confused and concerned regarding what could happen to their genetic data.

The 5-month data breach in 2023 exposed the personal data of nearly 7 million 23andMe customers. The saga dealt a blow to 23andMe’s reputation, and the company laid off 200 employees and stopped development of all therapies late last year.

This unease and the bankruptcy filing prompted the Utah Department of Commerce’s Division of Consumer Protection and the Utah Attorney General’s Office to issue a consumer alert Monday to inform consumers about their rights and protections regarding genetic data.

Here’s what Utahns need to know:

23andMe uses saliva samples to provide its customers with reports on their ancestral origins and genetic predispositions to certain diseases. The company, in a press release Sunday, said there are “no changes to the way the company stores, manages or protects customer data.”

In recent years, the Utah Legislature has taken steps to provide protective measures when it comes to people’s genetic data. State residents have rights under the Utah Consumer Privacy Act and the Genetic Information Privacy Act, the latter of which was established through the passage of SB227 during the 2021 legislative session.

Utahns have three relevant rights under these acts, including requesting 23andMe to delete their individual account and genetic data. To delete genetic data, consumers should follow these steps:

1. Sign in to your 23andMe account at www.23andme.com.
2. Navigate to your profile’s Settings section.
3. Scroll down to the 23andMe Data section at the bottom of the page.
4. Click View next to the 23andMe Data heading.
5. If you would like to keep a copy of your genetic data, download your data before continuing.
6. Locate the delete data option.
7. Select Permanently Delete Data.
8. Check your email for a confirmation link and follow it to complete the deletion process.

“In light of the company’s financial difficulties and the potential risks to your sensitive information, you may want to consider this,” the Utah consumer alert says.

Another option is to ask the company to destroy a genetic sample. “If you previously chose to allow 23andMe to store your saliva sample and DNA but would now like to opt out, you can update your settings by going to Preferences on your account page,” the alert says.

Finally, consumers can revoke permission for their genetic data to be used for research by withdrawing that consent from the account settings page under Research and Product Consents. You can also delete accounts directly from the account settings page on the company’s website.

“Once submitted, this request (to delete your account) should be followed with a confirmation email to the email address linked to your account. Upon your account’s deletion, 23andMe will automatically opt you out of research and discard your sample,” says the consumer alert.

Utahns can learn more about their rights under the Utah Consumer Privacy Act and the Genetic Information Privacy Act by visiting dcp.utah.gov/upca.