Matt Katz: It's The Brian Lehrer Show on WNYC. Welcome back, everybody. Matt Katz, keeping the seat warm for Brian today. How many of you have ever completed a 23andMe genetic testing kit? I did. It changed my life. In 2018, as some listeners may know, I found a biological half-sister on 23andMe, who informed me that I was conceived by a sperm donor. This was something I never knew about. It changed my life. I ended up making a podcast called Inconceivable Truth about the search for my real biological father.
Now I'm told that I should delete all of my data off of 23andMe, and that's because the company last week filed for bankruptcy and is now looking for a buyer to keep them afloat. Numerous attorneys general across the country, including Attorney General Letitia James here in New York, have advised users to delete their data from the site in order to protect it from whoever the highest bidder may be. The thing is 23andMe and another genetic site, Ancestry.com, have been such a valuable tool for me. I now have three half siblings that I found through these sites. If I shut it down now, there might be half siblings out there that I never meet, that I can never find. I'm struggling with this.
Joining me now to talk about all of this issue and these concerns and the 23andMe bankruptcy and walk us through the data deletion process is Max Eddy. He covers privacy, security, and software at Wirecutter. Max, welcome to WNYC.
Max Eddy: Very glad to be here.
Matt Katz: Walk us back a little bit. How did 23andMe fall into this predicament? It was a company that took the country by storm, was founded by Anne Wojcicki, former wife of Google founder Sergey Brin, held great promise, had immense influence. What went wrong with the business?
Max Eddy: The company's fortunes have been declining for quite some time. I think one of the biggest events in that decline was in 2023, there was a data breach that exposed the information of seven million customers, probably about half its user base. That just ticked things off in a really bad direction. In fact, the discussion of a sale started last year and was dismissed, but as you've said, that's going on now.
Matt Katz: Listeners, if you have any questions about what to do with your 23andMe genetic testing kit data, give us a call. We should have time for one caller or two. 212-433-WNYC, 212-433-9692. 23andMe files for Chapter 11 bankruptcy. It's important that it's Chapter 11 and not Chapter 7 or any other kind of bankruptcy. Is that right?
Max Eddy: I'm not an expert in bankruptcy, but I do know that some of the discussion around the bankruptcy itself has been better than I think we might have expected. The company has said that any buyer must abide by the company's current privacy policy. That's the big concern here, that people signed up for the service, including yourself, with one understanding of what was going to be done with their genetic information, which we should say is the most private information a person can have. It's everything about you. It only connects back to you and also people in your family. As you said, you were able to find other family members.
There's a lot of effects here, but the company says that they're taking this seriously. I think the need to delete this information is because we don't know exactly what is going to happen next. While a company says that they're going to do one thing, who knows what happens in the future?
Matt Katz: What would be the worst-case scenario? My genetic information ends up with what kind of company, and then what could happen that would be particularly problematic?
Max Eddy: Yes. It's hard to think about the possibilities here because I think it's just so broad. I think a really bad outcome would be that this information is taken up by a company that just has radically different views about how to use this information, views that the people who signed up to use it in the first place perhaps don't agree with.
One thing to consider is that 23andMe, when the reviewers at Wirecutter looked at all of these DNA kits, they actually held up 23andMe as an example because that company said that it would not proactively work with law enforcement. They actually required a warrant before they would give any information to law enforcement about any of its customers, and it had to be a specific warrant. If a company comes in and purchases that and has a different view about how to work with law enforcement, suddenly all that information could be used in ways that people definitely weren't anticipating.
This is not hypothetical. There's an example in 2018 of the California Golden State Killer who was caught using a combination of traditional genealogical research and also genetic information uploaded to public services like 23andMe. That's a good story, right? We can all agree that we want to see bad people brought to justice, but if that context is changed a little bit, it doesn't seem so great. Would people be comfortable with their information being used to help apprehend someone who has parking tickets, for example, or was in a protest? I think it's important to look at that law enforcement aspect as well.
Matt Katz: That feels dystopian and maybe far off. For some, it might not outweigh the benefits of potentially connecting with a loved one.
Max Eddy: Absolutely. Actually, I was really glad you brought that up in this segment because while there are absolutely privacy concerns about this, and people should be aware of them and make intelligent choices based on that information, I don't think that people should take away from this that they made a mistake by signing up with one of these services, or that it was a foolhardy thing to do, that they were following a fad or whatever.
These services provide really valuable information for people about themselves, about their histories. If you're someone who has a spotty family history where you don't know about where you came from or where you belong, something like this provides that value. I just want people to know that you haven't made a huge mistake, you weren't tricked in any kind of way, but now that we know more about what's happening with 23andMe specifically, to make a judgment about what to do with their information.
I should say that 23andMe does let you download your information. You could potentially take it somewhere else, potentially put it on another service, or maybe even-- I'm not sure, but maybe even 23andMe's potential buyer in the future could take that on if you agree with the privacy protections that they put in place.
Matt Katz: Part of my skepticism, though, is-- Ancestry, I believe, is owned by BlackRock. I don't know why I would-- [chuckles] I shouldn't necessarily trust any other companies out there. I don't know why I trust them and don't trust the hypothetical 23andMe buyer, but let's say I don't. How do you go about taking your data down if you already have a 23andMe account? What do you do?
Max Eddy: What you're going to want to do is log into the service, go to the Settings section, and at the bottom of that page, select the 23andMe data and then View. From there you'll be able to download a copy, and I should say that that could take some time. I've heard from some people that it can take anywhere between an entire evening to several days. It's a lot of information.
Then you select Delete Data and then click Permanently Delete. At this point, you're probably going to be asked to authenticate again, provide a password, and then you will receive email instructions on what to do next. My understanding from reading the 23andMe documentation is that you must follow the instructions that are sent via email or else you will not be able to complete that deletion process.
Once you've done that, take a look at the Research Product and Consents section, and you can revoke consent for your genetic information to be used in future research. I understand that about 85% of 23andMe's 15 million customers have agreed to have their information used in research, so that's a lot of people who'll probably want to take a look at that. Also, keep in mind, though, that when you revoke the consent for research, you're revoking for future research; anything that your information has already been used in has already been done and can't be taken back retroactively. Finally, in the Settings section, you'll also be able to opt to have your sample destroyed.
Matt Katz: Destroyed. The company will actually-- What does that mean, they digitally destroy it?
Max Eddy: Well, I believe that this refers to actually the physical sample that was sent in, so they'll actually-
Matt Katz: Oh, got it.
Max Eddy: -destroy the sample itself. I should say that I've received-- Since we published our story on Wirecutter and talked about it on the Wirecutter podcast, which is available wherever podcasts are listened to, we've heard from a lot of readers saying that they've had a lot of trouble with this process. That it's taking a long time, that they don't understand the instructions, that the instructions aren't coming through clearly, so people probably need to be very patient. I imagine that when they set this system up, they didn't anticipate millions of people trying to use it at the same time.
Matt Katz: Are you hearing some resistance from people who say, you know what? I understand the risk, but I'm going to keep it on there?
Max Eddy: I haven't, personally, but I'm sure that there's lots of people out there who feel that way. Again, if they're getting something valuable from the service, I think that that's the choice that they get to make. Again, the important thing here is that people understand how sensitive this information is, that they understand how it can be used by law enforcement, and that they can make choices about the privacy in the future.
I would hope too that people also consider the network effect. Just because you make this choice for yourself, that doesn't mean that you're-- you're making a choice for everyone in your family as well, because genetic information is shared between families. If you've never signed up for this service but someone else in your family has, they do have a part of your genetic information. Consider that when you're signing up for these services. If you know someone in your family [crosstalk]--
Matt Katz: Thank you, Max.
Max Eddy: Go ahead.
Matt Katz: Yes, no, we got to wrap up. Appreciate your article, appreciate the reporting. Max Eddy, writer at Wirecutter, covering privacy, security, and software.
Max Eddy: Thanks for having me.
Copyright © 2025 New York Public Radio. All rights reserved. Visit our website terms of use at www.wnyc.org for further information.
New York Public Radio transcripts are created on a rush deadline, often by contractors. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of New York Public Radio’s programming is the audio record.
