In 2017, no one could escape the genetic testing craze. Unboxing DNA test kits and reacting to the results became an algorithmic goldmine across lifestyle, beauty, and YouTube vlogging channels, drawing in countless viewers. Every day, we watched creators spit into tubes, and it was just the beginning of the influencer era. Soon enough, as prices became more affordable, everyone seemed eager to jump on the 23andMe bandwagon. And admittedly, we can’t deny its benefits. From finding long-lost family members to discovering more about your ancestry, it’s both interesting and fun. But as these tests grew in popularity, questions about their ethical implications quickly appeared. Who had access to this information? Was it being shared with third parties? Was it ending up in every lab’s database? After all, your genetic information is deeply personal, making these concerns entirely valid. These concerns grew into even bigger fears in 2025, when 23andMe filed for bankruptcy after financial struggles and a massive 2023 data breach. So, what does this mean for your personal information as a consumer? Why are these companies so interested in your genetic data? Let’s break down everything you need to know about these services. magnific / magnific (not the actual photo) In 2006, Anne Wojcicki, a former healthcare analyst, co-founded 23andMe with Linda Avey, a biologist and business development executive, and Paul Cusenza, a business executive. Their goal was to give people a way to access, read, and understand their own genetic code. Ultimately, the company also aimed to build a database of genotype and phenotype data that could support pharmaceutical research and drug discovery. The idea was appealing, to say the least. People were curious to learn more about their ancestry, discover potential genetic predispositions to certain diseases, and understand what their DNA could reveal about their health. On top of that, the data collected could potentially contribute to medical research and new discoveries. Ideally, it made genetics and biology more open and accessible to the public. But as the company grew, concerns appeared about how it handled people's highly sensitive genetic information. Unlike ordinary consumer software, genetic data is deeply personal and cannot simply be changed if it is compromised. And while direct-to-consumer genetic testing made this information more accessible, it also raised questions about whether the industry was keeping pace with medical regulations. In fact, concerns grew even more in 2013, when the FDA ordered 23andMe to stop marketing its health-related genetic tests without authorization. A decade later, a major data breach added to users' concerns about the privacy and security of their genetic information. serenajae But what exactly made this product so interesting? As mentioned earlier, genetic testing became a major trend on YouTube, with influencers like Lilly Singh and the Try Guys sharing their own DNA with the company to learn more about their ancestry. Some even turned their ancestral pie charts into dramatic clickbait, claiming that their entire lives had been a lie. Ultimately, it felt like harmless, futuristic fun. You could learn about your heritage, discover why cilantro tastes like soap, and maybe even find out you were part Viking. And frankly, Americans were a particularly receptive audience for this. Exploring their backgrounds and tracing their ancestry became a popular way to connect with family history. After all, we've all heard the classic American response: they're part Italian, part Swedish, part Irish, et cetera. This is because, compared with countries like Japan and Greece, which have long-established cultural and historical traditions, the United States is a relatively young nation built around a shared civic identity rather than a single ethnic or ancestral background, although Indigenous peoples have much deeper roots in the land. As a result, many American families have diverse origins and their own stories of immigration, sometimes dating back just a few generations. Being American describes their nationality, but it doesn't necessarily tell them much about their ancestry. So it's hardly surprising that these tests became particularly popular in the U.S. In fact, DNA testing kits became a popular holiday gift during the 2017 and 2018 seasons. And there's something oddly funny about the idea of gathering around the Christmas tree with your family, only to spend the morning or evening spitting into plastic tubes. Shiuly Suherni / Unsplash (not the actual photo) Laboratories have been processing DNA for decades, but how does it actually work? Essentially, the so-called “spit kit” contains a plastic collection vial. By depositing saliva into the kit, people provide cells from the inner lining of their cheeks, along with white blood cells and other cells found in their saliva. The vial itself contains a preservative solution that protects the genetic material. Once the vial is sealed, this chemical solution helps keep the DNA stable at ambient temperatures for weeks, allowing it to reach a processing facility without significant degradation. Once it arrives, automated laboratory equipment extracts and purifies the DNA, removing cellular debris and other unwanted material until only clean DNA remains. But here's where these tests differ from more comprehensive genetic analyses, making them more affordable and accessible to the public. Instead of sequencing all three billion DNA base pairs in a person's genome, which can be much more expensive, 23andMe uses a custom microarray chip containing thousands of microscopic probes. These probes detect specific genetic markers where people commonly differ. A scanner then reads the resulting fluorescent signals, allowing the laboratory to identify genetic variations and generate the raw data used to produce your results. JeepersMedia Whatever sparked people's interest in genetic testing, millions of users eventually turned to 23andMe to discover family connections and learn about potential genetic health risks. It all seemed fine until 2023. That is when hackers accessed the company's user accounts. The breach occurred in late 2023, when hackers used credentials stolen in previous data breaches to access 23andMe accounts. And it worked far too well. What began with around 14,000 compromised accounts eventually exposed personal information linked to approximately 6.9 million customers through the website's “DNA Relatives” feature. Things took an even darker turn from there. Hackers advertised stolen information on forums, with some listings allegedly organized by ethnicity. People of Ashkenazi Jewish and Chinese descent were among those specifically targeted in these listings, raising serious concerns about how genetic information could be exploited to identify and target people based on their ancestry. You might assume that, faced with such a serious security incident, the company would apologize, strengthen its defenses, and work to identify those responsible. However, its initial response sparked even more outrage. 23andMe initially blamed users for failing to protect their accounts, including reusing passwords from other websites and email accounts. The breach was followed by lawsuits and growing scrutiny, adding pressure to a company already facing financial difficulties. Nemuel Sereti / Pexels (not the actual photo) The real problem with biological data isn't just that it can be leaked, but that it can't be changed. When our accounts get hacked, our information is stolen, or we lose a bank card, there are ways to deal with it. We can activate two-factor authentication, change our passwords, or call the bank to cancel our cards. But if our DNA is leaked, what can we do? Well, California Attorney General Rob Bonta urged former customers to “take control and request that a company delete their genetic data.” Reports say more than 15 million people entrusted 23andMe with their genetic information. Because DNA is shared among biological relatives, the implications extend beyond individual customers, potentially affecting their cousins, siblings, parents, and grandparents, even if those relatives never used the service. Cybersecurity expert Cindi Carter, Global Chief Information Security Officer, also agreed with Bonta's recommendation. “I do think it's a wise recommendation [to delete data],” she said on KTLA 5 Weekend Morning News. “Companies buy and sell data all the time, but genetic data is new territory.” Curated Lifestyle / Unsplash (not the actual photo) In March 2025, 23andMe filed for Chapter 11 bankruptcy after years of financial difficulties compounded by the 2023 data breach. After the scandal, the company faced dozens of class-action lawsuits, regulatory scrutiny, and costly legal settlements, putting even more pressure on an already struggling business. Ultimately, the company was also struggling with its core business model. DNA testing kits are essentially a one-time purchase, meaning customers don't need to keep buying them. As demand slowed, sales declined, leaving the company burning through cash without a reliable stream of repeat purchases. On top of data breaches, the market had also become increasingly saturated. Companies like AncestryDNA, arguably 23andMe's biggest direct competitor, built extensive consumer DNA databases, focusing on family trees and connecting DNA matches to billions of historical records. This gave customers another way to explore their family histories in depth. MyHeritage DNA, based in Israel, also became a major player in the genetic testing industry, with a particularly strong international presence, including in Europe and Latin America. Its testing kits were often competitively priced, and the company let users upload raw DNA data from other services to access certain features without buying another test. Getty Images / Unsplash (not the actual photo) The bankruptcy court approved the sale of 23andMe's assets, including its genetic database and laboratory biobank, for $305 million. The buyer was TTAM Research Institute, a nonprofit founded by Anne Wojcicki, 23andMe's original co-founder and longtime CEO. The deal led to a legal battle, as state attorneys argued that transferring millions of people's sensitive genetic records to a new entity without their explicit consent could violate state privacy laws. Ultimately, the sale was allowed to proceed, subject to legal requirements and safeguards to protect customers' genetic data. This means that if you visit 23andMe's website, it may still look like a functioning business. Customers can log in and view their reports, and DNA testing kits continue to be marketed. However, the company's ownership and organizational structure have changed, and a nonprofit led by its original co-founder now controls its assets. PlaceboPill / magnific (not the actual photo) Ultimately, since the website is still operational, you can request that 23andMe delete your account and personal information. Unfortunately, however, the company may not be able to erase everything. As a genetic testing provider, it may be required to retain certain records under applicable laws and regulations. The exact retention requirements depend on the record type and applicable regulations. For example, clinical laboratory records may be subject to federal and state retention rules, but most test records generally must be kept for 3 to 10 years. And if you previously consented to participate in research, there's another complication: data that has already been incorporated into published studies or aggregated research results generally can't simply be withdrawn retroactively. Still, requesting deletion of your account and personal data may reduce the information the company retains, even if it can't erase every trace of your genetic information. So, better than nothing. Albin Biju / Pexels (not the actual photo)
