23andMe users are worried about what might happen to their data. Here’s what the company says.

• 23andMe’s future is uncertain amid potential acquisition talks.
• The company has faced a data breach and board resignations.
• Some have called for users to delete data out of concern policies may change with new ownership.

The future of 23andMe is uncertain, and so is the fate of the data it has collected from millions of users.

The direct-to-consumer genetic testing company has had a rough 12 months. In 2023, it suffered a massive data hack that led to a $30 million class action lawsuit. Then, its entire board resigned this September after founder and CEO Anne Wojcicki said that she was “considering third party takeover proposals” and announced her own interest in acquiring 23andMe. The board cited a “distracting difference of view” among the reasons its directors decided to quit.

Although she later walked back her words about third-party proposals (she said she’s still interested in taking the company private), the upheaval has left users concerned about what would happen to their data if 23andMe was bought.

Business Insider asked the company itself, and a 23andMe spokesperson directed us to its privacy statement. It says, “your Personal Information may be accessed, sold or transferred” in the event that 23andMe is involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets.

Still, “our company privacy policies will remain in effect for the foreseeable future, as Anne indicated in her filing, including following the intended completion of the acquisition she is pursuing,” the spokesperson said.

The spokesperson added that 23andMe’s privacy statement would apply “unless and until customers are presented with a new privacy statement by a new entity.”

As 23andMe weighs its options, people have taken to social media to express concern. The company is known for its genetic tests that allow people to learn more about their heritage.

“what’s the worst 23andme/any entity could do with my dna data? maybe being targeted by malicious govt? what else?” one user wrote on X.

Another responded, saying, “my biggest fear has always been that they sell to health insurance companies.”

Meantime, others urged users to take action. “Just a reminder that if you’ve ever taken a 23andMe test, you should really take a few minutes and go delete your account data right now,” one user said on X.

In a different post, Eva Galperin, director of cybersecurity at Electronic Frontier Foundation, recommended 23andMe users request that their data be deleted.

If you’re concerned, there is an option to have some personal information removed via Account Settings on 23andMe, but the company said it’s legally required to keep some information.

“Because we take the privacy and trust of our customers very seriously, we would fight for the commitments in our Privacy Policy as part of any data transfer,” the 23andMe spokesperson said.