A giant biotechnology company might be about to go bust. What will happen to the millions of people’s DNA it holds?

Since it was founded nearly two decades ago, 23andMe has grown into one of the largest biotechnology companies in the world. Millions of people have used its simple genetic testing service, which involves ordering a saliva test, spitting into a tube, and sending it back to the company for a detailed DNA analysis.

But now the company is on the brink of bankruptcy. This has raised concerns about what will happen to the troves of genetic data it has in its possession.

The company’s chief executive, Anne Wojcicki, has said she is committed to customer privacy and will “maintain our current privacy policy”.

But what can customers of 23andMe themselves do to make sure their highly personal genetic data is protected? And should we be concerned about other companies that also collect our DNA?

What is 23andMe?

23andMe is one of the largest companies in the crowded marketplace for direct-to-consumer genetic testing. It was founded in 2006 in California, launching its spit test and Personal Genome Service the following year, at an initial cost of US$999. This test won Time magazine’s Invention of the Year in 2008.

Customers eagerly took up the opportunity to order a saliva collection kit online, spit in the tube and mail it back. In a few weeks when the results were ready they could find out about their health, ancestry, and other things like food preferences, fear of public speaking and cheek dimples.

The price of testing kits dropped rapidly (it’s now US$79). The company expanded globally and by 2015 had 1 million customers. The firm went public in 2021 and initially the stock price soared. As of 2024, the company claims 14 million people have taken a 23andMe DNA test.

23andMe rode the wave of popular excitement and investor interest in genetics. It wasn’t alone. By 2022 the direct-to-consumer genetic testing market was valued at US$3 billion. The three largest players – 23andMe, AncestryDNA and MyHeritage – together hold the genetic data of almost 50 million people globally.

There are dozens of smaller players too, with some focusing on emerging markets such as MapMyGenome in India and 23mofang and WeGene in China.

What happened to 23andMe?

23andMe has had a rapid downfall after the 2021 high of its public listing.

Its value has dropped more than 97%. In 2023 it suffered a major data breach affecting almost seven million users, and settled a class action lawsuit for US$30 million.

Last month its seven independent directors resigned amid news the original founder is planning to take the company private once more. The company has never made a profit and is reportedly on the verge of bankruptcy.

What this might mean for its vast stores of genetic data is unclear.

When people sign up for a 23andMe test the company assures them: “your privacy comes first”. It promises it will never share people’s DNA data with employers, insurance companies or public databases without consent. It puts choice in the hands of consumers about whether their spit sample is kept by the company, and whether their de-identified genetic and other data is used in research. Four in five people who bought a 23andMe test have agreed to their data being used in research.

However, if you dig a bit deeper, it’s clear that 23andMe uses people’s data in many different ways, such as sharing it with service providers. Perhaps most importantly, if the company goes bankrupt or is sold, people’s information might be “accessed, sold or transferred” as well.

In a statement to The Conversation, a 23andMe spokesperson said Wojcicki is “not open to considering third-party takeover proposals”, and that in the event of any future ownership change, the company’s existing data privacy agreements with customers “would remain in place unless and until customers are presented with, and agree to, new terms and statements – and only after receiving appropriate notice of any new terms, under applicable data protection laws”.

Tips for people to protect their genetic data

With 23andMe in the spotlight, people might want to take steps to protect their genetic data (although experts say there’s not really any more risk now than there has always been).

The simplest thing is to delete your account, which opts you out of any future research and discards your saliva sample. But if your data has already been de-identified and used in research, it can’t be retrieved. And even if you delete your account, 23andMe says it will keep hold of information including your genetic data, date of birth and sex, to comply with its own legal obligations.

Buying a DNA test online might feel fun and rewarding and it’s certainly been marketed that way. There are plenty of good news stories about how getting those test results has helped people to connect with lost family or understand more about their health risks. People just need to buy tests with their eyes open about what this might mean.

First, the results might not be all positive. Finding out about health risks without guidance from a health professional can be scary. Learning that the person you thought was your mum or dad actually isn’t, is an outcome for as many as 1 in 20 people who’ve bought a DNA test online.

Second, every company selling DNA tests does so with lots of legal conditions attached. People click through these without a second thought but researchers have shown it is worth taking a closer look. Consider what the company says about what it will do with your data and your sample, how long they will keep it, who else can access it, and how easy it will be to delete later.

There are guidelines from organisations like Australian Genomics that can help. And bear in mind that if a company holding your DNA profile is sold, it might be hard to make sure that data is protected.

So maybe reconsider giving a DNA test as a Christmas gift.