23andMe filed for Chapter 11 bankruptcy in March 2025. Its genetic database — 15 million profiles — became a corporate asset. That means it went on the balance sheet next to the lab equipment and the office furniture.
California Attorney General Rob Bonta issued public guidance: delete your data now.
The company was subsequently acquired through the bankruptcy process. A new owner controls that database today. Whatever the old privacy policy said, bankruptcy resets the terms. A buyer can renegotiate. Your consent was given to a company that no longer exists in the same form.
If you’ve been putting this off, stop putting it off.
The short answer: Log in to 23andMe, open Account Settings, and use Delete Data to erase your genetic, health, and ancestry results. Download your raw DNA first if you want a local copy. Withdraw research consent separately. In the EU or UK, send a formal Article 17 erasure request for a paper trail. This takes about five minutes and stops further exposure, though it can’t retrieve data already breached in 2023.
Why is genetic data different in a bankruptcy?
Most data breaches or corporate acquisitions involve records you could theoretically replace. You change your password. You get a new credit card. You move to a new email address.
You cannot get new DNA.
Genetic data identifies you permanently. It also identifies your relatives — people who never agreed to share anything with 23andMe. Your cousin’s ancestry. Your sibling’s disease markers. Your children’s inherited conditions. One person’s consent decision affects an entire biological network.
Privacy policies are not legally binding contracts in bankruptcy. A buyer isn’t obligated to honor a seller’s commitments to users. The Federal Trade Commission has challenged such transfers before. The clearest case was RadioShack’s attempt to sell customer data in its 2015 bankruptcy. But enforcement is not guaranteed, and it is certainly not fast.
Then there’s the breach. In October 2023, 23andMe disclosed that 6.9 million profiles had been accessed by attackers using credential stuffing — reusing login credentials stolen from other breached sites. That data is already out. Deleting your account doesn’t retrieve what’s already circulating. But it does stop the clock on further exposure.
How do you delete your 23andMe data?
This takes about five minutes. Do it now, before you read the rest.
- Go to 23andme.com and log in.
- Click your name or avatar in the top right corner → Account Settings.
- Scroll down to the section labeled 23andMe Data.
- Click Delete Data. This initiates deletion of your genetic data, health reports, and ancestry results.
- 23andMe will send a confirmation email. You have 30 days to cancel if you change your mind.
- If you want to keep a local copy of your raw DNA: before you start the deletion, go to Settings → Browse Raw Data → Download. Save the file somewhere you control — an encrypted drive, not a cloud service.
- If you joined the 23andMe Research program: go to Consent & Agreements in your account settings and withdraw your research consent separately. This is a distinct step from deleting your account.
The deletion request applies to data held by 23andMe on their servers. It does not reach back to data already shared with research partners under previous consent, and it does not affect the breach data from 2023 that’s already in other hands.
What about other genetic testing companies?
23andMe isn’t the only one worth thinking about.
Ancestry (ancestry.com) offers a data deletion option under Privacy → Manage My Personal Information. The path is ancestry.com/privacy/options. Their database is larger than 23andMe’s and they operate across multiple business lines — genealogy, subscription services, consumer DNA.
MyHeritage allows account deletion at myheritage.com/delete-account. They had their own breach in 2018 — 92 million email addresses and hashed passwords were exposed. If you have an account there, delete it.
FamilyTreeDNA disclosed in January 2019 that they had voluntarily shared user data with the FBI for law enforcement matching purposes without user notification. They later updated their terms to disclose this practice. Know what you’re agreeing to before using their service.
A general rule for all of these: do not upload raw DNA files to third-party analysis sites — GEDmatch, Gedmatch Genesis, or any similar service — without reading their law enforcement sharing policies first. GEDmatch became the basis for the Golden State Killer identification in 2018. That was a murder case. The matching technology works equally well on any DNA in the database, for any purpose, by anyone with access.
Can you delete your DNA data from outside the US?
23andMe’s privacy policy covers users globally. But what that means in practice depends on where you are.
If you’re in the EU or UK, you have a right to erasure under Article 17 of the GDPR. Don’t just use the standard deletion flow — send a formal erasure request citing Article 17 explicitly. This creates a paper trail and triggers specific obligations. Direct it to 23andMe’s data protection contact, which is listed in their privacy policy.
If you’re in India, the Digital Personal Data Protection Act treats genetic data as sensitive personal data. 23andMe holds data about Indian residents on US servers. Extraterritorial enforcement against a US company in bankruptcy is genuinely difficult — there’s no clear mechanism to compel compliance from this distance. The practical answer is the same as everywhere else: delete the account, withdraw research consent, and don’t rely on legal protection that can’t be enforced quickly.
If you’re elsewhere: check whether your country has a right to erasure in its data protection law. Exercise it in writing, not just through the in-app flow.
What you can’t undo
Deleting your 23andMe account now is the right call. But some things are already done.
If you participated in their research program, data contributed to studies may already be incorporated into published research or shared datasets. That doesn’t mean you shouldn’t still withdraw consent — stopping further sharing matters — but it means the research use of past data is largely irreversible.
The 6.9 million profiles from the October 2023 breach are in the wild. If your data was among them, it exists somewhere outside any company’s deletion policy. A data exposure check won’t find your raw DNA. But it can show you what other personal information about you is already circulating on people-search sites that buy and resell it.
The broader lesson: genetic databases are permanent liabilities. Every company holding this data is a future bankruptcy, acquisition, breach, or regulatory failure waiting to happen. The safest genetic database is one you’re not in.
Frequently asked questions
Can I still delete my DNA after 23andMe was bought? Yes. The new owner still has to honor deletion requests through the same Account Settings flow. Delete now, because a buyer can renegotiate the old privacy terms.
Does deleting my account remove the 2023 breach data? No. The 6.9 million profiles exposed in October 2023 are already circulating and outside any company’s deletion policy. Deletion stops further exposure, not past exposure.
Should I download my raw DNA before deleting? Only if you want a personal copy for medical use. Save it to an encrypted drive you control, never a cloud service. If you don’t need it, skip this step.
Do I have to withdraw research consent separately? Yes. Withdrawing research consent is a distinct step from deleting your account. Do both in Account Settings under Consent & Agreements.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.