23andMe customers struggle to delete their data

The computer systems of 23andMe have been struggling to cope with the sheer volume of customers racing to delete their data, after the DNA-testing company announced that it was filing for bankruptcy protection.

The firm says it has now resolved the IT problems caused by increased traffic on its website at the start of the week.

But users have reported ongoing difficulties as they scrambled to protect their genetic information, health histories, and ancestry details.

A number of those who have successfully removed their data have also told the BBC of their ongoing anxieties about 23andMe’s future.

The company filed for Chapter 11 bankruptcy protection on Sunday in order to sell itself through a court-supervised process.

“If 23andMe is going to be sold, then my data can be sold, from what I hear,” said 52 year old Danielle Landriscina of Maryland. Ms Landriscina signed up for 23andMe in 2018 to connect with members of her father’s side of the family.

“What’s stopping something like a health insurance company from buying my data and then using it to determine if I get health insurance or how much I have to pay for it?,” added Ms Landriscina, who works in tech sales.

For now, 23andMe “will not voluntarily share your Personal Information” with insurance companies, the company’s current privacy statement says.

But the future is less certain. 23andMe’s proposed May 14 auction of its assets could include the genetic data of its millions of customers.

To protect herself, Ms Landriscina said she tried multiple times to log into her 23andMe account starting on Tuesday morning, both on her phone and through a web browser.

She was among the many customers asked to complete the login process by email using two-factor authentication to verify her identity.

She said she didn’t receive a verification code until the evening, and only saw it after a ten-minute window to use the code had expired.

Earlier in the day, the company’s online chat service advised her to try again later due to a surge in traffic to the website. It wasn’t until Tuesday night that she was able to remove her account from the company’s database.

“If anyone has any issues in regards to accessing their account or deleting their data, they can go to our customer care site for support,” a 23andMe spokesperson said in reply to a BBC inquiry.

The company did not reply to subsequent emails detailing the customer complaints the BBC learned about.

Pauline Long of Alabama also said she made multiple attempts to access her account starting early on Tuesday morning.

“This has been a nightmare and I am now going to be more cautious about doing anything online,” Ms Long told the BBC in an email.

She said she waited for two hours to chat with a customer service agent. She was finally able to delete her account by Tuesday evening but expressed scepticism about whether the company had actually deleted her information.

“I am concerned that 23andMe will hold onto data,” Ms Long said.

According to 23andMe, deleting an account and associated data will permanently delete the data associated with all profiles within the account.

Attorneys General from multiple US states – including California, Arizona, South Carolina, and New York – have advised 23andMe customers to purge their information from the firm’s database given the sensitivity of the material it has amassed during its years in operation.

“Every individual will have a different appetite for risk and will value their own private information differently,” California Attorney General Rob Bonta told the BBC by phone Monday.

“It’s up to them what they do, but I wanted to advise them of their right to delete.”

On Friday, Mr Bonta issued a consumer alert offering users a step-by-step guide on what to do as signs of 23andMe’s financial distress mounted.

“It’s exactly a moment like this when a reminder of the rights and protections you have is appropriate, so you can determine if and how you want to exercise those rights,” Mr Bonta said.

According to 23andMe, any buyer of the company will have to abide by laws that apply to how customer’s data is treated, and any transaction will be subject to customary regulatory approvals.

Customers who previously asked 23andMe to store a DNA sample can ask that it be destroyed.

For users who opted into 23andMe’s research programme, personal information will no longer be used in future research projects, the company said.

23andMe’s said it would continue to protect customer data as laid out in its privacy policy.

But it acknowledged that if it was “involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction.”

It says its privacy statement will apply to personal information when transferred to the new entity.

“A new company would have to continue to manage customer data under the privacy policy,” said Anya Prince, a professor at the University of Iowa College of Law.

But, Prince notes, the company also says it “may make changes” to its privacy statement “from time to time,” leaving the door open to a new company altering how it manages customer data.

62-year old genealogist Michele Lewis of Georgia said she found the process of deleting her data more straightforward than another attempt she made a few months ago when she was subjected to a waiting period.

“It was much easier and it was deleted almost immediately,” Ms Lewis told the BBC in an email Tuesday. “I have never really been too worried about privacy issues or hacking or anything, but this isn’t the first time 23andMe has had issues.”

In 2023, millions of 23andMe customer accounts were compromised in a massive data breach. The company reached a $30 million settlement stemming from the breach in September.

Ms Lewis, who used a 23andMe test kit in 2008, said it wasn’t hard to part with the company.

“I very rarely access 23andMe anymore anyways,” she said.

Some customers have said the experience offers a lesson.

“If I had to do it all over again, I would not have done this,” said Ms Landriscina. “The benefit does not outweigh what I think now is the harm of having my DNA out there having it possibly sold. It’s very concerning.”