Approximately 1.9 million 23andMe customers—roughly 15% of the company’s total user base—have formally requested the permanent deletion of their genetic data since the firm filed for bankruptcy protection in March. Interim CEO Joseph Selsavage confirmed the figures during a House Oversight Committee hearing on Tuesday, as lawmakers intensified their scrutiny over the privacy risks posed by the company’s potential acquisition.
The Battle Over Genetic Privacy
The congressional House Oversight Committee hearing highlighted significant national security and privacy concerns regarding the sale of sensitive biological information. Public anxiety spiked following the bankruptcy auction, as millions of users feared their DNA profiles could be transferred to entities without their consent.
Regeneron, the pharmaceutical giant, emerged as the winner of the court-approved auction in May with a $256 million bid. The company intends to leverage 23andMe’s massive genetic database to accelerate drug discovery, pledging to uphold existing privacy protocols. A federal bankruptcy court is scheduled to review the final approval of this acquisition later in June.
Legal Challenges and Security Failures
The path to the sale is becoming increasingly litigious. On Tuesday, a coalition of more than two dozen states—including New York, Pennsylvania, and Florida—filed a lawsuit against 23andMe. These states contend that the company lacks the legal authority to sell the private records of 15 million customers without obtaining explicit, individual authorization.
This crisis follows a severe security failure last year, where a data breach exposed the personal and genetic information of 6.9 million users. 23andMe faced heavy criticism for shifting the blame onto customers for failing to use multi-factor authentication, rather than addressing its own delayed detection and structural security lapses.
Managing Your Genetic Footprint
As the legal and financial future of the company remains uncertain, users are increasingly taking control of their digital legacy. For those concerned about the status of their information, there are established procedures to request the removal of genetic data from the company’s servers.