<\/p>\n
\n This 2018 image shows a 23andMe saliva collection kit used for DNA testing. The California-based company announced this week that it was going into bankruptcy.<\/p>\n
Eric Baradat\/AFP\/Getty Images<\/p>\n
hide caption\n <\/p>\n
toggle caption<\/p>\n
Eric Baradat\/AFP\/Getty Images<\/p>\n
The genetic testing company 23andMe \u2014 which allows users to spit in a tube and send away the sample for a detailed DNA analysis \u2014 is filing for bankruptcy.<\/p>\n
The California biotech firm announced<\/a> in a statement this week that it had entered the federal bankruptcy process with the goal of finding a buyer to address its ongoing money troubles. Co-founder Anne Wojcicki also has stepped down as CEO, and said in a post on X<\/a> she hopes to purchase the company herself. The board rejected<\/a> an offer she made earlier this month, according to a press release. <\/p>\n 23andMe has faced financial hardship for years, struggling to overcome<\/a> the fact that many people who went to the website for a one-time DNA test didn’t become repeat customers. In November, the company laid off<\/a> more than 200 employees, or roughly 40% of its staff. <\/p>\n The bankruptcy announcement also comes less than two years after 23andMe suffered a massive data breach<\/a> affecting 6.9 million customer accounts. <\/p>\n The possibility that the company, once valued at $6 billion after it went public in 2021, could be sold has raised concerns about what would happen to the sensitive information of its more than 15 million users.<\/p>\n In its bankruptcy announcement,<\/a> 23andMe said the data privacy of its customers would be an “important consideration” in any sale. But federal law does little to secure genetic information given over to a private company, two legal experts on data privacy said.<\/p>\n “Often, if there’s so much personal data that a group has, it’s maybe in a hospital setting or a research setting and can be governed by more meaningful safeguards,” said Suzanne Bernstein, counsel at the nonprofit Electronic Privacy Information Center.<\/p>\n “The scale of how much highly sensitive data 23andMe has is unique,” she said.<\/p>\n Is your DNA data protected by law? It depends <\/p>\n For many 23andMe customers, the company holds two sensitive pieces of information: the user-provided saliva sample, and the detailed genetic profile created from it.<\/p>\n In an FAQ about the bankruptcy<\/a> posted on its website, 23andMe said a new owner would have to abide by “applicable law” governing the use of user data, but data privacy experts say there isn’t much on the books.<\/p>\n The Health Insurance Portability and Accountability Act, or HIPAA, applies to health care providers and insurers but not direct-to-consumers companies like 23andMe, according to Anya Prince, a University of Iowa law professor who studies health and genetic privacy. Another law called the Genetic Information Nondiscrimination Act bars<\/a> employers and health insurance companies from discriminating against people due to genetic information. <\/p>\n “That’s pretty much it on the federal level,” Prince said.<\/p>\n Some states have adopted their own laws covering genetic privacy. At least 11 U.S. states have enacted laws giving consumers a say in how their genetic data is used, according to an article published by Prince<\/a> in 2023. Those laws typically let users request that the companies delete their data and require law enforcement agencies to get a warrant or subpoena to access genetic information, Prince said. 23andMe already adheres to both of those policies, she added.<\/p>\n 23andMe also says any genetic data it shares with researchers is stripped of identifying information<\/a>, such as names and birth dates. In its bankruptcy FAQ, the company said it hopes to “secure a partner who shares in its commitment to customer data privacy.”<\/p>\n How to protect your data, according to experts <\/p>\n 23andMe will remain in operation through the bankruptcy proceedings, and the company says customers can still delete their data and shutter their accounts.<\/p>\n![\"Chenedy](\"https:\/\/npr.brightspotcdn.com\/dims3\/default\/strip\/false\/crop\/2001x2001+567+0\/resize\/100\/quality\/100\/format\/jpeg\/?url=http%3A%2F%2Fnpr-brightspot.s3.amazonaws.com%2Fe0%2F9d%2F76d2708743e3a288b2b48d777968%2F2024-10-02-chenedy-tglascock-003.JPG\")
<\/a> <\/p>\n