DNA and genetic testing firm 23andMe is grappling with significant challenges following a 2023 data breach and its ongoing financial downturn. Once a leader in the industry, the company now faces an uncertain future as it considers going private, raising concerns about the security of genetic data for its 15 million customers.
Known for its saliva-based genetic ancestry tests, 23andMe has seen its market value plummet by over 99% since its $6 billion high in 2021, largely due to unprofitability. This lack of profit is attributed to declining consumer interest in its one-time-use test kits and sluggish growth in its subscription services. Compounding these issues was a lengthy data breach in 2023, where hackers stole genetic data from nearly 7 million users. In September, the company agreed to pay $30 million to settle a lawsuit related to the breach.
Shortly after the settlement, 23andMe CEO Anne Wojcicki mentioned the possibility of third-party takeover offers but later clarified her intent to take the company private. The initial statement, however, led to the immediate resignation of the company's independent board members, amplifying concerns about the future handling of customer data.
Many customers may assume their genetic data is protected by health privacy laws, but 23andMe is not bound by the Health Insurance Portability and Accountability Act (HIPAA). Instead, the company follows its own privacy policies, which it can alter at any time. According to a company spokesperson, 23andMe believes its data management practices are more appropriate and transparent compared to the traditional healthcare model under HIPAA.
The lack of strict federal oversight and varying state privacy laws means that in the event of a sale, the genetic data of millions could be up for grabs. Wojcicki has signaled a shift in the company's business strategy, halting costly drug development programs to focus on monetizing its customer data for pharmaceutical research.
While 23andMe asserts its data privacy policies would remain unchanged even if sold, privacy advocates have raised alarms. The Electronic Frontier Foundation (EFF) has warned that selling the company to entities with law enforcement ties could lead to misuse of sensitive genetic information.
For those concerned about the future of their data, 23andMe allows users to delete their accounts, though some data may still be retained under legal and compliance requirements.
