DNA testing service 23andMe has undergone serious upheaval in recent months, creating concerns for the 15 million customers who entrusted the company with their personal biological information. After filing for Chapter 11 bankruptcy protection in March, the company became the center of a bidding war that ended Friday when co-founder Anne Wojcicki said she’d successfully reacquired control through her nonprofit TTAM Research Institute for $305 million.

The bankruptcy proceedings had sent shockwaves through the genetic testing industry and among privacy advocates, with security experts and lawmakers urging customers to take immediate action to safeguard their data. The company’s interim CEO revealed this week that 1.9 million people, around 15% of 23andMe’s customer base, have already requested their genetic data be deleted from the company’s servers.

The situation became even more complex last week after more than two dozen states filed lawsuits challenging the sale of customers’ private data, arguing that 23andMe must obtain explicit consent before transferring or selling personal information to any new entity.

While the company’s policies mean you cannot delete all traces of your genetic data — particularly information that may have already been shared with research partners or stored in backup systems — if you’re one of the 15 million people who shared their DNA with 23andMe, there are still meaningful steps you can take to protect yourself and minimize your exposure.

How to delete your 23andMe data

To delete your data from 23andMe, you need to log in to your account and then follow these steps:

• Navigate to the Settings section of your profile.
• Scroll down to the selection labeled 23andMe Data. 
• Click the View option and scroll to the Delete Data section.
• Select the Permanently Delete Data button.

You will then receive an email from 23andMe with a link that will allow you to confirm your deletion request. 

You can choose to download a copy of your data before deleting it.

There is an important caveat, as 23andMe’s privacy policy states that the company and its labs “will retain your Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations.”

The policy continues: “23andMe will also retain limited information related to your account and data deletion request, including but not limited to, your email address, account deletion request identifier, communications related to inquiries or complaints and legal agreements for a limited period of time as required by law, contractual obligations, and/or as necessary for the establishment, exercise or defense of legal claims and for audit and compliance purposes.”

This essentially means that 23andMe may keep some of your information for an unspecified amount of time. 

How to destroy your 23andMe test sample and revoke permission for your data to be used for research

If you previously opted to have your saliva sample and DNA stored by 23andMe, you can change this setting.

To revoke your permission, go into your 23andMe account settings page and then navigate to Preferences. 

In addition, if you previously agreed to 23andMe and third-party researchers using your genetic data and sample for research, you can withdraw consent from the Research and Product Consents section in your account settings. 

While you can reverse that consent, there’s no way for you to delete that information.

Check in with your family members

Once you have requested the deletion of your data, it’s important to check in with your family members and encourage them to do the same because it’s not just their DNA that’s at risk of sale — it also affects people they are related to. 

And while you’re at it, it’s worth checking in with your friends to ensure that all of your loved ones are taking steps to protect their data. 

This story originally published on March 25 and was updated June 11 with new information.

View Bio