It’s not too late to delete your 23andMe data.
Twenty-seven states and the District of Columbia sued the DNA testing company on Monday to prevent it from selling customers’ genetic data without requiring “explicit consent.”
In the complaint, filed on Monday in the US Bankruptcy Court in the Eastern District of Missouri, the states said they want to enforce consumer protection and data privacy laws on behalf of their residents.
“Virtually all of this personal information is immutable. If stolen or misused, it cannot be changed or replaced. Furthermore, this data is exclusively personal and unique, representing that customer’s identity and no other human being,” the complaint says. “In addition, this exclusively personal data carries with it significant, sensitive information about others who share DNA and/or familial relationships.”
The complaint comes nearly three months after 23andMe initiated voluntary Chapter 11 bankruptcy and put the company up for sale. The company had weathered a series of challenges in recent years, including a data breach.
News of a potential sale concerned some consumers and lawmakers who questioned how 23andMe could ensure that any new owner protects the sensitive data. Although 23andMe said in March that any interested parties needed to adhere to their consumer privacy policy and applicable laws to be considered, there’s little preventing new owners from changing those policies after a sale, and some customers remain uneasy.
Regeneron Pharmaceuticals said it would acquire 23andMe for $256 million last month. The company develops therapeutics based on antibodies.
“The customer’s genome could remain in existence in corporate hands and subject to use (ranging from research to cloning) long after future generations of 23andMe’s consumers have passed away,” the complaint says.
A 23andMe spokesperson told Business Insider that the arguments in the complaint are “without merit, and we will address them at the sales hearing.” Representatives for Regeneron Pharmaceuticals did not respond to a request for comment from Business Insider.
Customers can still delete their data from 23andMe if they’re worried. Here’s how.
How to ask 23andMe to delete your data
Users who want their personal information removed from 23andMe can opt out in the “23andMe Data” section in Account Settings. But 23andMe says it is legally required to retain some information.
“While we will delete the majority of your Personal Information, we are required to retain some information to comply with our legal obligation,” the company’s website says.
“23andMe and/or our contracted genotyping laboratory will retain your Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations… even if you chose to delete your account,” the company’s privacy statement says.
The privacy statement says 23andMe will also retain some information associated with user accounts, like email addresses.
For users who participated in 23andMe Research, their genetic data and self-reported information won’t be used in future research projects.
“Customers always have the option to delete their account at any time, and once the request is confirmed, we will immediately and automatically begin the deletion process,” the spokesperson said. “Deleting an account and associated data will permanently delete the data associated with all profiles within the account. If a customer asks us to store their genetic samples, they will be discarded.”
