Attorney General Bonta Urgently Issues Consumer Alert for 23andMe Customers

Californians have the right to direct the company to delete their genetic data 

OAKLAND — California Attorney General Rob Bonta today issued a consumer alert to customers of 23andMe, a genetic testing and information company. The California-based company has publicly reported that it is in financial distress and stated in securities filings that there is substantial doubt about its ability to continue as a going concern. Due to the trove of sensitive consumer data 23andMe has amassed, Attorney General Bonta reminds Californians of their right to direct the deletion of their genetic data under the Genetic Information Privacy Act (GIPA) and California Consumer Protection Act (CCPA). Californians who want to invoke these rights can do so by going to 23andMe's website. 

“California has robust privacy laws that allow consumers to take control and request that a company delete their genetic data,” said Attorney General Bonta. “Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company.” 

To Delete Genetic Data from 23andMe:

1. Consumers can delete their account and personal information by taking the following steps:
2. Log into your 23andMe account on their website. 
3. Go to the “Settings” section of your profile.
4. Scroll to a section labeled “23andMe Data” at the bottom of the page. 
5. Click “View” next to “23andMe Data”
6. Download your data: If you want a copy of your genetic data for personal storage, choose the option to download it to your device before proceeding.
7. Scroll to the “Delete Data” section. 
8. Click “Permanently Delete Data.” 
9. Confirm your request: You’ll receive an email from 23andMe; follow the link in the email to confirm your deletion request.

To Destroy Your 23andMe Test Sample:

If you previously opted to have your saliva sample and DNA stored by 23andMe, but want to change that preference, you can do so from your account settings page, under “Preferences.”

To Revoke Permission for Your Genetic Data to be Used for Research:

If you previously consented to 23andMe and third-party researchers to use your genetic data and sample for research, you may withdraw consent from the account settings page, under “Research and Product Consents.”

Under GIPA, California consumers can delete their account and genetic data and have their biological sample destroyed. In addition, GIPA permits California consumers to revoke consent that they provided a genetic testing company to collect, use, and disclose genetic data and to store biological samples after the initial testing has been completed. The CCPA also vests California consumers with the right to delete personal information, which includes genetic data, from businesses that collect personal information from the consumer.   

To learn more about the CCPA, please visit here.