California AG warns 23andMe users to 'delete your data' as company files for bankruptcy

California’s Attorney General Rob Bonta is warning 23andMe customers to remove their information from the company’s databases due to uncertainty about where the data may end up as the company has filed for bankruptcy.

He said in a statement Friday, “Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company.”

Late Sunday night, the company filed for Chapter 11 bankruptcy and CEO Anne Wojcicki stepped down effective immediately, per CNBC. Wojcicki, who co-founded the company in 2019, stepped down "so I can be in the best position to pursue the company as an independent bidder," she wrote.

The company has been one of the top at-home genetic testing kits for the last 10 years and has provided more than 15 million customers with personal health and ancestry data. For $200, users received a kit to provide a saliva sample and mail it back to the company for laboratory analysis.

As recently as 2020, the company was valued at $6 billion. However, according to The New York Post, it expanded too fast into drug research and pharmaceutical partnerships and suffered a data breach that caused privacy concerns about users’ information. Its share price dropped from over $320 in February 2021 to less than $2 per share and the company is now in danger of collapsing.

California’s 2022 Genetic Information Privacy Act forces companies to obtain explicit consent for the data collection, use, and disclosure of any genetic information and guarantees consumers have the right to access or delete their data at their own discretion.

Bonta told users they can permanently delete their 23andMe data by logging into their account, accessing the “settings” menu, navigating to the data section, and clicking “view” which will give customers the “delete data” option and they can select “permanently delete data.” This will auto-generate an email from the company confirming the request which users must click to verify before the data will be deleted.