What happens to your DNA data now that 23andMe has filed for bankruptcy?

The struggling genetic testing company 23andMe has filed for bankruptcy, and its co-founder and CEO has resigned. Now, its millions of customers are wondering what happens to their genetic data — and whether it's secure.

CBC News heard from readers this week who had concerns about the security of their data, how they can delete their personal information, and what new ownership could mean for them. We've tried to answer as many as we can.

CBC News reached out to 23andMe. The company responded by pointing to its news release and its open letter to customers.

San Francisco-based 23andMe announced on Sunday that it will look to sell "substantially all of its assets" through a court-approved reorganization plan. Co-founder Anne Wojcicki, who made multiple failed takeover bids, resigned as CEO. 23andMe did not say whether there are other interested bidders.

23andMe was founded in 2006, with a promise to revolutionize the future of genetics and health care. The company became known for its saliva-based DNA testing kits — purchased by millions of customers eager to learn more about their ancestry — and later dived further into health research and drug development.

But it has faced an uncertain future for some time. Beyond battles to go private, the company struggled to find a profitable business model since going public in 2021. Then in 2023, hackers exposed the personal data of nearly seven million 23andMe customers over a five-month period, dealing a major blow to the company's reputation and compounding its growth problems.

In November, the company laid off 40 per cent of its workforce.

Yes. 23andMe says it plans to continue operating. 

In an open letter to customers posted Sunday, the company wrote that "orders and subscriptions will continue as normal, and any purchases or genetic testing kits sent in for processing will be handled without disruption."

23andMe added that customers still have full access to their accounts, reports and stored data.

Though the company's privacy policies say that the data could be sold to other firms, 23andMe says customer data will remain protected.

In its recently updated privacy policies, the company writes that if it is involved in a bankruptcy, merger, acquisition, reorganization or sale of assets, "your Personal Information may be accessed, sold or transferred as part of that transaction and this Privacy Statement will apply to your Personal Information as transferred to the new entity."

However, the company said the bankruptcy process will not affect how it stores, manages or protects customer data. Its open letter to customers stated that "any buyer of 23andMe will be required to comply with applicable law with respect to the treatment of customer data."

John Bringardner, the executive editor of the newsletter Debtwire, notes that any new buyer of 23andMe will have to comply with regulatory approvals that ensure "customer data won't end up in unscrupulous hands."