23andMe’s Financial Freefall Sparks Fears Over Genetic Data Security
23andMe (NASDAQ: ME), which gained fame for providing consumers with insights into their ancestry and genetic makeup, is now on the brink of collapse. With a valuation that has plummeted 99% from its $6 billion peak after going public in 2021, and shares now worth mere pennies, the company faces a grim future.
Amidst financial turmoil and an uncertain path forward, many of its 15 million customers are now questioning the fate of their genetic data and what 23andMe’s potential bankruptcy means for privacy.
For many, the appeal of 23andMe was rooted in the personal nature of its service: uncovering one’s heritage through the DNA contained in a simple saliva sample.
People like Chenedy Wiles, a 27-year-old traveling nurse from Chicago, used the service to learn more about their ancestry.
“One of the reasons I decided to get the test is that as an African American, it’s very common for our heritage to get lost,” Wiles shared. Her results revealed that she was nearly 40% Nigerian, a discovery she found exciting.
Yet, like many other customers, Wiles didn’t find value in the company’s follow-up services or add-ons, which became apparent when 23andMe reached out to entice her to use more of its features.
“The one-and-done nature of Wiles’ experience is indicative of a core business problem with the once high-flying biotech company,” analysts have noted. Many users paid for the testing kit once, received their results, and moved on.
The value—and risk—of genetic data
As 23andMe struggles to survive, the pressing question is what will happen to the massive trove of genetic data the company has collected since its inception in 2006.
“I absolutely think this needs to be clarified,” Wiles emphasized. She reflects a broader customer base concerned about how their personal genetic information may be managed, sold, or accessed, particularly in the event of a corporate downfall.
23andMe spokesperson Andy Kill reiterated the company’s commitment to privacy and transparency, stating that their focus remains on offering customers “choice over how they want their data to be managed.” However, Kill did not provide specifics on what could happen to this data in the event of bankruptcy or acquisition.
Over 80% of 23andMe’s customers have opted in to allowing their genetic data to be analyzed for medical research, a point that Kill says has held steady for years. This data is highly valuable for medical research and pharmaceutical companies, and 23andMe has a notable partnership with the pharmaceutical giant GlaxoSmithKline (GSK), enabling the drugmaker to use the company’s customer data for the development of new treatments.
The legal landscape
Despite its seemingly invaluable nature, DNA data remains largely unprotected by federal privacy laws. Anya Prince, a law professor specializing in genetic privacy at the University of Iowa College of Law, points out that the Health Insurance Portability and Accountability Act (HIPAA) does not cover direct-to-consumer companies like 23andMe.
“HIPAA does not protect data that’s held by direct-to-consumer companies,” Prince said.
In the absence of federal regulation, some states have created their own laws regarding genetic information, such as California and Florida, where consumers are granted rights over their DNA data.
“If customers are really worried, they could ask for their samples to be withdrawn from these databases under those laws,” Prince advised. However, the company’s assurance that all genetic data is anonymized raises additional questions about how effectively customers can retract their information from research databases.
“I couldn’t go to GSK and say, ‘Hey, my sample was given to you — I want that taken out,’ if it was anonymized,” Prince explained. This makes it nearly impossible to revoke consent for data already shared with research partners.
Privacy concerns have only escalated due to two recent incidents. In 2022, a major data breach compromised the accounts of 6.9 million customers, including the exposure of around 14,000 passwords. This breach highlighted the vulnerability of sensitive genetic data and brought into question the strength of 23andMe’s data protection practices.
Additionally, 23andMe has received subpoenas for access to its genetic database from law enforcement authorities. While the company asserts that it has resisted these requests and has not provided any customer data, the possibility remains troubling to privacy advocates.
“Having to rely on a private company’s terms of service or bottom line to protect that kind of information is troubling — particularly given the level of interest we’ve seen from government actors in accessing such information during criminal investigations,” said Vera Eidelman, a staff attorney with the American Civil Liberties Union.
Eidelman referenced high-profile cases such as the capture of the Golden State Killer and the identification of a murder suspect in Idaho, both of which relied on data from genealogical websites, though not 23andMe. Such cases demonstrate the potential for law enforcement to leverage genetic databases without the knowledge or consent of users.
23andMe’s Kill clarified that the company does not allow law enforcement to search its database.
Boardroom drama
Earlier this month, internal company turmoil spilled into the public eye when the board of directors clashed with CEO Anne Wojcicki. Wojcicki’s proposal to buy all outstanding shares and take the company private was met with fierce opposition, eventually leading to the mass resignation of the board.
In their resignation letter, board members expressed frustration over the lack of a detailed plan for the company’s future, adding to the growing uncertainty around 23andMe’s direction.
Wojcicki reassured in a September filing that the company remains committed to its privacy rules and will continue to offer customers the option to delete their data. She also announced that she was no longer pursuing the buyout of the company, adding another layer of ambiguity to 23andMe’s outlook.
Analysts are predicting a bleak future for 23andMe, with some foreseeing bankruptcy or a complete collapse by next year if the company fails to restructure. This raises further questions about what happens to the DNA data of millions of customers. Would it be sold to a third party? Transferred to research organizations? Or perhaps, made vulnerable to misuse?
For customers like Wiles, the lack of clarity is disconcerting. Although she opted out of research, she remains uneasy about what might become of her genetic information.
“Something about that causes me a bit of pause,” Wiles admitted. She voices the anxiety of millions who wonder: “I hope my genetic data isn’t misused in some way. I do wonder what exactly they intend to do with it all.”
Information for this briefing was found via NPR and the sources and companies mentioned. The author has no securities or affiliations related to this organization. Not a recommendation to buy or sell. Always do additional research and consult a professional before purchasing a security. The author holds no licenses.