ERIC BARADAT/Getty Images
Things have gone downhill for 23andMe.
After the direct-to-consumer genetic testing company launched in 2006, it appeared to be on a steady incline and a notable standout among Silicon Valley ventures. As of 2021, according to Crunchbase, it had raised over $1 billion from investors.
However, a 2023 data hack kicked off a series of problematic hurdles that 23andMe just can't seem to clear.
News that hackers were selling user data — which included birth details and names — on the dark web broke that October. The company confirmed in December that hackers had accessed ancestry data for just under 7 million users. A data breach notification filing in January said it took 23andMe five months to realize hackers had stolen the data.
The incident led to a class action lawsuit, which 23andMe settled this September for $30 million, according to Reuters.
Less than a week later, the independent directors of 23andMe's board resigned in a letter addressed to CEO and cofounder Anne Wojcicki.
The letter said the directors "wholeheartedly support" 23andMe's mission, but "it is also clear that we differ on the strategic direction for the Company going forward."
Steve Jennings/Getty Images/TechCrunch
The Wall Street Journal reported that despite earning $299 million in revenue in 2023 and $219 million in 2024, the company never made a profit. Its stock price peaked in February 2021 but has steadily declined since, reaching an all-time low of 29 cents.
23andMe's reputation took a further hit with consumers in September when Wojcicki said in an SEC filing she was "considering third party takeover proposals." She walked back that statement later that month in a separate filing, but the damage was done.
Outlets like The Atlantic reported that Wojcicki's potential sale of 23andMe could also mean the sale of user data. The director of cybersecurity at Electronic Frontier Foundation, a nonprofit focused on digital privacy, urged their 186,000 X followers to delete their data from 23andMe. That post garnered more than 531,000 views in three days.
The X post touched on concerns plaguing the DNA test kit industry: Your private DNA data may not stay private.
"Data is data — once it's out there, it's very hard to control," James Hazel, a biomedical researcher, told Business Insider in 2019.
23andMe says the personal data it collects includes registration information like birth date, genetic information like a user's genotype, sample information like saliva, and self-reported information.
"Beyond our contracted laboratory, with which we work to process a customer's sample and deliver their results, customer information will not be shared with any other entity unless they provide us with consent to do so," a 23andMe spokesperson told Business Insider.
The spokesperson said the company doesn't share data with "employers, insurance companies, law enforcement agencies or any public databases."
Users who want their personal information removed from 23andMe can opt-out in the "23andMe Data" section in Account Settings. But 23andMe says it is legally required to retain some information.
"While we will delete the majority of your Personal Information, we are required to retain some information to comply with our legal obligation," the company's website says.
"23andMe and/or our contracted genotyping laboratory will retain your Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations... even if you chose to delete your account," the company's privacy statement says.
The privacy statement says 23andMe will also retain some information associated with user accounts, like email addresses.
For users who participated in 23andMe Research, their genetic data and self-reported information won't be used in future research projects.
"Customers always have the option to delete their account at any time, and once the request is confirmed, we will immediately and automatically begin the deletion process," the spokesperson said. "Deleting an account and associated data will permanently delete the data associated with all profiles within the account. If a customer asks us to store their genetic samples, they will be discarded."
