Delete Your 23andMe Data Before It's Too Late: Step-by-Step Guide

23andMe filed for bankruptcy and is selling its assets — including the genetic data of approximately 15 million customers — to TTAM Research Institute. If you have ever used 23andMe, your DNA data is part of that sale. State attorneys general across the country are urging users to delete their accounts immediately. Here is exactly how to do it and why the deadline matters.

What Is Happening with 23andMe?

In March 2025, 23andMe filed for Chapter 11 bankruptcy protection after years of declining revenue and a devastating data breach in late 2023 that exposed the personal information of 6.9 million users. The company's co-founder and CEO Anne Wojcicki resigned from the board, and the company entered a sale process.

TTAM Research Institute, a newly formed entity, emerged as the winning bidder. The acquisition includes 23andMe's most valuable asset: its massive database of customers' genetic information, health data, and ancestry records. This is not just names and email addresses — it is your DNA, the most permanent and sensitive personal data that exists.

Unlike a password or credit card number, you cannot change your genetic code. Once it is in someone else's hands, it is there permanently. That is why this situation is fundamentally different from a typical corporate acquisition.

Why State Attorneys General Are Sounding the Alarm

California Attorney General Rob Bonta was among the first to publicly urge 23andMe customers to delete their accounts. He was joined by attorneys general from multiple states who issued similar warnings to their residents. Their concerns center on several critical issues:

• Privacy policy changes: A new owner can modify the privacy policy, potentially allowing uses of your genetic data that the original terms did not permit
• Unknown buyer intentions: TTAM Research Institute is a newly formed entity with limited public track record, making it difficult to assess how it will handle genetic data
• Irreversibility: Unlike other personal data, genetic information cannot be changed if misused
• Research consent scope: Data previously shared under 23andMe's research agreements may be used in ways users never anticipated

If you live in a state with comprehensive data privacy laws, you may have additional legal protections. But legal protections take time to enforce — deleting your data now is the most direct action you can take.

How to Delete Your 23andMe Account and Data

Follow these steps in order. Do not skip step 1 — once your account is deleted, you lose access to your data permanently.

1. Download your data first. Log in to your 23andMe account. Go to Settings > 23andMe Data and click Download next to your raw genetic data file. Also download any health or ancestry reports you want to keep. Save these files to an encrypted folder on your local device — not to cloud storage services where they could be accessed by third parties.
2. Revoke research consent. Before deleting your account, go to Settings > Research and Product Consents. Withdraw your consent from all research programs. This tells 23andMe to stop including your data in future research studies, though it does not recall data already shared with research partners.
3. Request data deletion. Navigate to Settings > 23andMe Data and select Delete Data. This specifically requests the destruction of your biological sample (if 23andMe still has your saliva kit) and the deletion of your genetic data from their servers.
4. Delete your account. Go to Settings > Account and select Permanently Delete Account. Confirm the deletion. 23andMe states this process may take up to 30 days to complete.
5. Confirm via email. You will receive a confirmation email. Click the verification link to finalize the deletion request. Without completing this step, your request may not be processed.
6. Document everything. Take screenshots of each step, including the confirmation screens and emails. If there is ever a dispute about whether your data was deleted before the acquisition, this documentation is your proof.

What About Data Already Shared with Research Partners?

This is the part most guides leave out. Even if you successfully delete your 23andMe account, your genetic data may already exist outside of 23andMe's systems.

23andMe had a $300 million partnership with GlaxoSmithKline (GSK) for drug development research, along with agreements with other pharmaceutical and academic research institutions. If you consented to research participation at any point during your use of the service, your de-identified genetic data was likely shared with these partners.

"De-identified" does not mean anonymous. Multiple studies have demonstrated that genetic data can be re-identified when combined with other publicly available information — the kind of information that data brokers sell openly. A 2013 study published in Science showed researchers could re-identify individuals from supposedly anonymous genetic databases using only a surname and basic demographic data.

While you cannot force third-party research partners to delete data they already received, revoking your consent (step 2 above) prevents future sharing and puts your objection on record.

The Broader Problem: Your Other Personal Data

Deleting your 23andMe account is an important step, but your genetic data is only one piece of the puzzle. Data brokers across the internet already hold your name, home address, phone number, email, employment history, relatives' names, estimated income, and more — all available to anyone willing to pay.

This matters in the context of genetic privacy because that broker data is precisely what makes de-identified genetic data re-identifiable. When a bad actor can purchase your personal details from a people-search site, cross-referencing those details with genetic databases becomes straightforward.

Removing your personal information from data broker sites reduces the risk that your genetic data — wherever it now resides — can be linked back to you. GhostVault monitors and removes your data from 500+ data brokers continuously for $3.99 per month, closing the gap between your DNA data and the personal details that make it identifiable.

What to Watch For Next

The 23andMe situation is still developing. Here is what to monitor in the coming weeks:

• June 10, 2026: The court-appointed privacy ombudsman will file a report assessing whether the TTAM acquisition adequately protects consumer privacy
• June 17, 2026: The bankruptcy court hearing will determine whether the sale proceeds as structured
• State AG actions: Several state attorneys general have indicated they may intervene or impose conditions on the sale
• FTC review: The Federal Trade Commission may weigh in on whether the transfer of genetic data to a new entity requires additional consumer protections

Regardless of how the court proceedings unfold, deleting your data now gives you the strongest possible position. If the sale is blocked or restructured, you lose nothing. If it goes through, you will have removed your data before a new entity takes control.

Protecting Your Privacy Beyond 23andMe

The 23andMe bankruptcy is a case study in why proactive privacy protection matters. Companies change hands. Privacy policies get rewritten. Data collected under one set of promises can end up governed by entirely different rules.

The same principle applies to every piece of personal data you have shared online. Your social media profiles, public records, and the hundreds of data broker listings bearing your name all represent potential exposure. Addressing your 23andMe data is urgent, but it should be part of a broader strategy to minimize your digital footprint.

Frequently Asked Questions

Can I still delete my 23andMe data after the TTAM acquisition closes?

It is unclear. Once TTAM Research Institute takes ownership, your data may be governed by new privacy policies. The safest approach is to delete your data now, while 23andMe's current deletion process is still operational. After the acquisition closes, you may lose the ability to request deletion entirely.

Does deleting my 23andMe account also delete my genetic data from research partners?

No. If you previously consented to research, your de-identified genetic data may have already been shared with third-party partners including pharmaceutical companies. Deleting your 23andMe account removes data from their systems but does not recall data already shared externally. Revoke research consent separately before deleting.

What happens to my 23andMe data in the bankruptcy sale?

23andMe's database of approximately 15 million customers' genetic data is being sold to TTAM Research Institute as part of the bankruptcy proceedings. A court-appointed privacy ombudsman is reviewing the transaction, with a report due June 10, 2026, and a hearing scheduled for June 17. Multiple state attorneys general have urged customers to delete their data before the sale is finalized.

How long does it take 23andMe to delete my data?

23andMe states that account deletion and data destruction may take up to 30 days. Given the pending acquisition timeline, submit your deletion request as soon as possible to ensure it is processed before any ownership transfer occurs.

Should I download my 23andMe data before deleting my account?

Yes. Before deleting, download your raw genetic data file and any health reports you want to keep. Once your account is deleted, you permanently lose access to your results. Store the downloaded file in an encrypted location on your own device, not in cloud storage.