A giant biotechnology company could be on the verge of bankruptcy. What happens to the DNA of millions of people stored in it?

Since its founding nearly two decades ago, 23andMe has grown into one of the largest biotechnology companies in the world. Millions of people have used the simple genetic testing service, in which a saliva test is ordered, spit into a tube and sent back to the company for detailed DNA analysis.

But now the company is on the verge of bankruptcy. This has raised concerns about what will happen to the stockpiles of genetic data in its possession.

The company’s chief executive, Anne Wojcicki, said it was committed to customer privacy and would “maintain our current privacy policy.”

But what can 23andMe customers do to ensure that their highly personal genetic data is protected? And should we worry that other companies are also collecting our DNA?

What is 23andMe?

23andMe is one of the largest companies in the crowded direct-to-consumer genetic testing market. The company was founded in California in 2006 and launched its spit test and personal genome service the following year with an initial price of $999. This test was named invention of the year by Time Magazine in 2008.

Customers eagerly took advantage of the opportunity to order a saliva collection kit online, spit into the tube and send it back. When the results came back in a few weeks, they were able to find out about their health, their ancestry and other things like food preferences, fear of public speaking and cheek dimples.

The price of testing kits dropped rapidly (now it is $79). The company expanded worldwide and had 1 million customers in 2015. The company went public in 2021 and the share price initially skyrocketed. According to the company, 14 million people will have taken a 23andMe DNA test by 2024.

23andMe rode the wave of general excitement and investor interest in genetics. It wasn’t alone. By 2022, the direct-to-consumer genetic testing market was estimated to be $3 billion. The three biggest players – 23andMe, AncestryDNA and MyHeritage – together have the genetic data of almost 50 million people worldwide.

There are also dozens of smaller providers, some focused on emerging markets, such as MapMyGenome in India and 23mofang and WeGene in China.

What happened to 23andMe?

23andMe experienced a rapid decline after its listing peaked in 2021.

Its value has fallen by more than 97%. In 2023, the company suffered a major data breach affecting nearly seven million users and settled a $30 million class action lawsuit.

Last month its seven independent directors resigned amid news that the original founder planned to take the company private again. The company has never made a profit and is reportedly on the verge of bankruptcy.

What this might mean for the vast repositories of genetic data is unclear.

When people sign up for a 23andMe trial, the company assures them that “your privacy comes first.” It promises to never share people’s DNA data with employers, insurance companies or public databases without consent. It gives consumers a choice as to whether their spit sample will be retained by the company and whether their anonymized genetic and other data will be used for research. Four out of five people who purchased a 23andMe test agreed to have their data used for research purposes.

However, if you look a little closer, it becomes clear that 23andMe uses people’s data in many different ways, such as sharing it with service providers. Perhaps most importantly, if the company goes bankrupt or is sold, people’s data could also be “accessed, sold or transferred.”

In a statement to The Conversation, a 23andMe spokesperson said Wojcicki is “unwilling to consider third-party acquisition proposals” and that in the event of a future change in ownership, the company’s existing privacy agreements with customers “will remain in effect unless and until.” “Customers will be presented with and agree to new terms and conditions and representations – and only upon receipt of appropriate notice of any new terms and conditions in accordance with applicable data protection laws.”

Tips for people to protect their genetic data

With 23andMe in the spotlight, people may want to take steps to protect their genetic data (though experts say the risk isn’t actually any greater than ever right now).

The easiest way is to delete your account. This will exclude you from any future research and your saliva sample will be discarded. However, if your data has already been anonymized and used for research purposes, it cannot be restored. And even if you delete your account, 23andMe says it will retain information such as your genetic data, date of birth and gender to comply with its own legal obligations.

Purchasing a DNA test online can be fun and rewarding, and it is certainly marketed that way. There is a lot of good news about how receiving these test results has helped people connect with lost family members or learn more about their health risks. People just need to buy tests and be aware of what that might mean.

First, the results may not all be positive. It can be scary to learn about health risks without guidance from a healthcare professional. Up to one in 20 people who have purchased a DNA test online will learn that the person you thought was your mother or father is actually not.

Second, any company that sells DNA testing comes with numerous legal requirements. People click through without hesitation, but researchers have shown that it’s worth taking a closer look. Consider what the company says about what it will do with your data and sample, how long it will keep it, who else will have access to it, and how easy it will be to delete it later.

There are guidelines from organizations such as Australian Genomics that can help. And keep in mind that if a company that owns your DNA profile is sold, it may be difficult to ensure data protection.

Maybe reconsider giving a DNA test as a Christmas gift.