How to Delete Your 23andMe Data

https://www.eff.org/deeplinks/2025/03/how-delete-your-23andme-data

by hn_acker • 1 year ago

222 120 1 year ago

YooLi• 1 year ago

This feels as hopeless as trying to keep your email/contacts from social media sites. Even if you are vigilant about never allowing an app/service to download your contacts, your friends will share theirs and it is trivial to recreate your contact list. If I keep my DNA from these companies, my relatives will share theirs and they basically have my DNA.

CharlesW3• 1 year ago

This feels as hopeless as trying to keep your email/contacts from social media sites.

The cynic in me agrees, but the process was quick and easy, and I know I'm not safer by not deleting my information from 23andMe. I recommend it.

drdaeman• 1 year ago

Note that despite any requests the genetic data and some personal information (DOB and sex) probably won't be deleted, at least because of CLIA requirements: https://news.ycombinator.com/item?id=41781879 (more details in https://bourniquelaw.com/2024/10/09/data-23-and-me/, linked from the thread there)

CharlesW3• 1 year ago

Here's a great post by a lawyer, linked to further down in that thread: https://bourniquelaw.com/2024/10/09/data-23-and-me/ It suggests a way to challenge them on their assertions that they must keep your data and samples.

bpodgursky• 1 year ago

I'm sorry but this lawyer has absolutely no idea what he is talking about with regards to CLIA compliance. And he even admits as much, but keeps talking anyway.

nelox• 1 year ago

23andMe does not operate as a laboratory itself but contracts with U.S.-based labs that are certified under CLIA and accredited by the College of American Pathologists (CAP). According to their website, all saliva samples are processed in CLIA-certified and CAP-accredited labs, ensuring compliance with federal standards for accuracy and reliability. This certification is crucial, as it aligns with FDA requirements for certain health-related genetic tests. This distinction is significant, as CLIA primarily regulates labs, not the companies that contract them, potentially affecting the applicability of retention requirements to 23andMe’s broader operations.

CLIA’s record retention requirements, as per Section 493.1105, states labs must retain test requisitions, authorizations, and reports for at least 2 years, with longer periods for specific tests like pathology (10 years for slides).

CLIA Laboratory Record Retention Requirements:

- Test requisitions and authorizations: 2 years minimum. - Test reports: 2 years minimum, 10 years for pathology reports. - Cytology slide preparations: 5 years. - Histopathology slides: 10 years. - Pathology specimen blocks: 2 years. - Tissue: Until diagnosis is made.

Notably, these requirements focus on test-related records, such as requisitions (which may include patient details like date of birth and sex) and reports (which for genetic tests would include interpreted results). However, there is no explicit mention of retaining raw genetic data, such as the full genotype data, in the CLIA regulations. This raises questions about whether 23andMe’s assertion to retain raw genetic information is strictly required by CLIA or if it extends beyond the regulation for other reasons, such as research or quality control.

ahmedfromtunis2• 1 year ago

To be honest, this is more like "requesting the data to be deleted". There's nothing that guarantees that the personal information will be physically wiped out of the hard drives used to store them.

throwaway48476• 1 year ago

But it creates legal grounds for lawsuits if they don't.

ahmedfromtunis2• 1 year ago

Of course. And I'm not saying that they might do it in malice.

All I'm suggesting is that tapping some pixels on your backlit rectangular glass won't necessarily translate into pulses of electrons that'll eradicate the 0s and 1s representing your data.

I'm sure that corner of the codebase is one of the least visited parts, so bugs may lurk in, or misconfigurations, etc.

Cheer2171• 1 year ago

Sure, you can sue the hollowed out shell of a bankrupt limited liability corporation that will soon have no assets for a court to sieze for whatever paltry damages a court finds.

pavel_lishin• 1 year ago

A lawsuit costs money, and doesn't un-sell the data.

deepsun• 1 year ago

How you lawyer is going to prove the data is not deleted?

And what damages are you going to claim in court.

Lawyers are not cheap, no lawyer will work on a case less that even $1k. My only hope is donating to privacy fighting organizations like EFF that file class actions.

dragonwriter3• 1 year ago

Yeah, and if you spend all the effort and end up winning your lawsuit, you can get a fresh new claim against an already bankrupt entity.

dylan604• 1 year ago

Also, what prevents new owners from restoring from backups because "we were hacked" or any other reason for retrieving backup data for something that is currently "deleted"?

switch007• 1 year ago

Exactly. Once you give your data, you no longer have any control over it, forever.

patrickwalton• 1 year ago

I deleted my data a few months ago and it happened fast enough that it didn't seem like there was a human in the loop.

internetter• 1 year ago

yes, but the implementation may, as far as you know, look like

if (userRequestsToDeleteAccount || user.deactivated) { user.deactivated = true; showDeletionSuccessfulPage(); }

In this implementation, the user believes their data is deleted, but it has not.

ks2048• 1 year ago

Has anyone tried to export their ancestry data? I've notice the PDF summary lists broad regions, but the data in the App shows more details (e.g. specific counties of countries). Anyone know how to export that data? I'll just take some screenshots, but maybe this info is somewhere else in the export.

dahinds8• 1 year ago

Click on the "Scientific Details" instead of the Summary.

pmarreck• 1 year ago

Why? If it's already out there, it's kind of too late, is it not?

rglover• 1 year ago

The data has already been sold off to the real customers (i.e., not you and me) [1]. You can (and should) request a deletion, but the damage has already been done.

[1] https://gizmodo.com/23andme-is-selling-your-data-but-not-how...

dahinds8• 1 year ago

This is false, we've sold data with PII to no one. Or it is misleading: the page you linked to even says, "It is selling de-identified, aggregate data for research, if you give them consent."

EA-31672• 1 year ago

To what extent and using what method is it "de-identified"? Plenty of such schemes are very easy to circumvent, especially with a large enough pool of data. Given the nature of genetics in particular positively identifying a single case can be used to unmask whole families. In particular depending on the anonymization this would be a task suited to 'AI' very well.

ziddoap• 1 year ago

It is selling de-identified, aggregate data

Just a note that re-identifying aggregate data is a whole field of study that is decently successful.

dekhn4• 1 year ago

Providing another company access to deidentified data is "selling your data", to argue otherwise is just semantics.

Note that selling deidentified data (genomic, health, etc) is common in the industry already and 23&Me is hardly unique in this respect.

ezfe• 1 year ago

There are clearly labeled consent options in the settings page. They are all off for me.

yoaviram• 1 year ago

Better yet, send them a legally binding data deletion request (if you live in a jurisdiction that has strong data protection laws):

https://yourdigitalrights.org/d/23andme.com

brian-armstrong• 1 year ago

The distinction isn't super important, but 23andMe doesn't have your whole genome, just some specific locations from it. Roughly 750k base pairs or so.

https://www.quora.com/How-much-of-the-genome-does-23andMe-se...

echelon4• 1 year ago

Enough to be denied insurance, have job offers rescinded, or be targeted by scams.

And they don't even have to have your DNA. Just a close enough relative will do.

echoangle• 1 year ago

have job offers rescinded, or be targeted by scams

Can you expand on this?

I understand the insurance thing due to genetic diseases and so on, but which jobs would I be denied for based on genetic information which wouldn’t be checked anyways?

I can only come up with stuff like colorblindness but that would probably be checked anyways if it were a strict requirement for the job so keeping the DNA secret wouldn’t help.

And what’s the scam angle when the DNA is known?

consumer451• 1 year ago

Enough to be denied insurance...

Not just you, but your children who never had anything to do with 23andMe as well!

a2dam• 1 year ago

The Genetic Information Nondiscrimination Act makes it illegal to adjust health (but not life) insurance premiums or discriminate for employment based on genetic information. Couples who do genetic testing before having kids have the same protections and they're very effective.

linsomniac2• 1 year ago

Question: How are they going to link the DNA to people?

Some will be easier than others, sure. I'm trying to decide how "safe" my data is, since I created a single-use gmail account, with fictitious name, and paid for it with a gift card. I was afraid that some information in there might lead to being uninsurable, so I decided to row away from the rocks. Thankfully, my genetics didn't pop up any red flags, knock on wood.

I guess if you signed up using your normal e-mail address and your real name and used your credit card, you can still take the Shaggy defense ("It wasn't me"), but I suppose at that point they could ask you to prove it. I mean, most businesses aren't obligated to do business with you, for any or no reason at all.

rendang• 1 year ago

In what country would it be legal to deny someone insurance based on their genes? Has such a thing happened before?

hammock• 1 year ago

How do we know it hasn’t already been sold at least once? The OMG expose makes me think

huxflux• 1 year ago

Or hacked, ha.

randomNumber7• 1 year ago

Hello, I was sent back from the future to tell you there is already a backup.

goykasi• 1 year ago

Are we related? Are you me?

ineedasername2• 1 year ago

Hey—when you get back, tell me it worked. That the branch held. That it’s stable. I’ll merge it all with a pull after that.

It’s not true—not yet—but once you say it, it will be.

Just… don’t mention that part. Not until after the first.

Boogie_Man• 1 year ago

Me trying to sequence ppls genomes in my basement doesn't seem so bad now.

isjustintime• 1 year ago

Hah, yes. I used to work at a company that sold a popular DNA product. I built part of the GDPR data deletion pipeline. During my last week there, I submitted a request to delete my data from the systems. The final integration test!

dineol• 1 year ago

lol do you really think they will delete your data?)

partiallypro• 1 year ago

I know I'm in the vast minority here, but I honestly don't really care what is done with my DNA data as long as it's not used against me for healthcare & insurance purposes (which I believe is already illegal.) If someone wants to use it to make new drugs, research, etc, I just don't care.

lurkersince2013• 1 year ago

Am sure there’s a very real possibility that some shady data brokers will ultimately gain access to the treasure trove of data before long - and am sure that in our capitalistic world healthcare and insurance companies would happily pay for access.

simplyinfinity• 1 year ago

In the USA. In Europe and such, I'm not saying it's zero chance, but it's extremely unlikely. As Europeans don't rely on insurance for healthcare, but we use government for that :) ( the exception being, if you want private insurance if your government provided one isn't enough)

robwwilliams10• 1 year ago

Not to mention it is illegal and not even an illegal money makers.

nickjj• 1 year ago

I never made an account there or uploaded anything DNA related but what happens if a relative did? Is there the concept of a "ghost" account that gets filled in for people who didn't sign up yet but is likely related? Can this be deleted without making an account?

scottyah• 1 year ago

Yeah, they teamed up with the Mormons mapping out the entire human family tree and have been able to predict every possible child DNA sequence in order to eventually create Paul Atreides.

(as for your question, I have no idea)

windsignaling• 1 year ago

Is anyone having trouble downloading their data? Some data, such as "Raw Data", "Imputed Genotype Data R6", and "Phased Genotype Data" need to be requested, but I haven't heard back from them yet.

Would like to download everything first before requesting deletion.

miquong• 1 year ago

I requested, but gave up and requested deletion after. I still haven’t received the requested data.

Still, I figure I have a few trillion backup copies… albeit in very raw format

Mistletoe• 1 year ago

If I had to guess they are really behind right now. Everyone I know is doing this. I checked my email and I emailed mine to myself in 2018 thank goodness. Told them to destroy my sample today and delete my data (don’t know if it will be done but at least I did it).

abracadaniel• 1 year ago

I did it a few months ago and the data sets took about a day to become available.

spear• 1 year ago

I requested my data three days ago and got "Raw Data" and "Phased [...]" early today. Still waiting for the last set.

ineedasername2• 1 year ago

Delete? How then will I get to hang out with Roko after regenerative AI incorporates their data into its training corpus?

TuringNYC• 1 year ago

Not sure if others are having this problem, but my login no longer works, and password-reset emails never arrive (tried three times on three days w/o success)

jbd0• 1 year ago

Same here. My wife and I are both unable to login due to a forced password reset and password-reset emails that never arrive.

arduanika• 1 year ago

If only there had been some way to see this coming.

johnnyballgame• 1 year ago

I just can't understand who in their right mind, and is even remotely concerned about the privacy of their personal information, would upload their own DNA to a business. An internet-based one at that. Lemmings, I tell ya.

tonymet3• 1 year ago

For those curious about what actual data they are recording, they use Infinium Global Screening Array which records about 650-750k SNPs (single-nucleotide-polymorphisms) .

Obviously this data infers heritage, disease risk, relations. It could be used for discrimination, surveillance, potentially poisoning .

Everyone should request their data to be deleted, but this is an engineering forum, and we know what that means in practice. Every company like this has hundreds of copies of the data, and has shared it with dozens of providers.

Like Rev Tevia said, you can't put the feathers back into an opened pillow.

briHass• 1 year ago

Their array of SNPs in ASCII letters is under 10MB compressed, probably well under that using a specialized SNP format/compression algorithm. Less than a complex Microsoft Office file.

Yeah, I can imagine they have a few dozen copies strewn over various backup media/blob buckets. There probably isn't much effort from what's left of their IT team to track them all down to delete.

tonymet3• 1 year ago

It’s not about the size. Every task will have made a copy and a derivative . I doubt the company ever cared to build a dependency tree for removal, certainly not managing copies given to partners.

Now the company is bankrupt this is the last thing on their task list to implement.

kjkjadksj• 1 year ago

Poisoning really? All the risks are pretty sci fi. It’s pretty easy otoh to harm someone without bothering analyzing the snp data if that is your intention.

tonymet3• 1 year ago

ricin and polonium-210 have many documented cases, likely 10000+ undocumented. It's only scifi until years later when it becomes declassified

biker142541• 1 year ago

I've been a broken record about the implications of sending DNA to a corporation for 20 years... it's hard not to have seen this coming.

juunpp• 1 year ago

Isn't this one of the stupidest versions of capitalism?

rohan_2• 1 year ago

If 23andMe is bounded by the legal system - why shouldn't we trust them the same way we trust Dropbox not to sell our personal files?

No one has been able to explain this to me.

cyanydeez• 1 year ago

Have you seen the legal system lately?

rohan_2• 1 year ago

sure - so this isn't a unique complaint with 23andMe then? We should be deleting our data from Dropbox, Google, etc...?

StefanBatory3• 1 year ago

Because on average your files on Dropbox are worth way less than your DNA.

ashoeafoot2• 1 year ago

Oh, the scams i have to show you, such sights to behold :

"Dear Sir,Madam

while reading a recently acquired db, i came across your brother in law who has disease xy. Now, me being a decent person, i kept things qiet for now. No need to rattle potential love interests , your children or the community with news about this genetic curse. If you want this silence to last, just subscribe by donating 0.01 bitcoin per year to the Mammal & Animal Foundation for Integrity Agency."

This right here is the chernobyll of privacy.

StefanBatory3• 1 year ago

It's a matter of time until some neo-Nazis get access into DNA databases to look for Jews, won't it?

hermannj314• 1 year ago

I never used 23andme, my brother did, so I get the pleasure of having no legal recourse but all of my data stolen anyway.

I am sorry to all of you that gave your family DNA to a SV startup.

It must suck to feel like you have no say in what happens to your private information.

How to Delete Your 23andMe Data

Related Stories