US genetic heritage giant 23andMe has found itself on the brink of complete collapse following a total  crash in the company’s value and the mass resignation of board members prompting the consideration of a sale. But, with the company holding the genetic data of millions of people, many are worried about what happens next when that data goes on the market.

The company is not just known for its genetic heritage services, despite that being the business’ initial draw in its early days. It has since expanded across the wellness and healthcare space, using customer-generated data to present users with multiple forms of diagnostic tools ranging from details of a user’s likelihood to how their genetics impact their specific allergies, muscle composition and weight among others.

The company even received approval from the US Food and Drug Administration last year and they issued a 510(k) clearance to 23andMe to include an additional 41 variants of BRCA1 and BRCA2 genes as part of its cancer screening risk report. All of this amid rapidly growing demand for genomic testing services that in 2023 saw a market estimated by GlobalData to stand at a market value of approximately $32.65m.

At its height last year on 4 December, 23andme’s stock value stood at a respectable $19.47 per share. Skip ahead to nearly one year later and the company’s value has plummeted to $4.89 per share. All of this follows from a turbulent year for the embattled company as it works to undo the damage of a cyberattack that saw the company pay out $30m in lawsuit settlements.

Now, millions of former users  have been urged to delete data from the flagging company’s online infrastructure as one of the US’ formerly fastest-growing genetic data screening companies looks set to be forced to either find a way to make an immediate profit or see its assets sold off as CEO Anne Wojcicki floats the idea of taking the company public.

Medical Device Network examines how 23andme ended up in its current position and what might happen to millions of users’ genetic data now that one of the world's biggest genetic data firms is on the ropes.

How did it come to this?

The beginning of the company’s downfall started one year ago, in October of 2023, when hackers were able to access the accounts of approximately 6.9 million users, gaining access to patient information such as their geographic data, family trees and potentially health data. Whilst the company itself was not hacked directly, the bad actors were able to gain access through passwords taken from users' accounts on other websites and services in previous separate hacks.

On 13 September a class action lawsuit filed to the San Francisco Federal Courts partially came to a close, with Reuters reporting that the company has agreed to pay out $30m in settlements to users as well as pay for at least three years of data security monitoring. Additionally, the lawsuit also found that many of those targeted in the hack were of Ashkenazi Jewish and Chinese ancestry.

A few days following this settlement the company would again be hit with disaster in the form of the mass resignation of the entirety of its independent board of directors. In a 17 September letter written to CEO Anne Wojcicki citing five months of setbacks and poor progress after the turmoil of 2023.

In its letter to the CEO the former board said: “We, the independent directors of the 23andMe Board, hereby tender our resignations, effective immediately.

After months of work, we have yet to receive from you a fully financed, fully diligenced, actionable proposal that is in the best interests of the non-affiliated shareholders. We believe the Special Committee and the Board have provided ample time for you to submit such a proposal. That we have not seen any notable progress over the last 5 months leads us to believe no such proposal is forthcoming. The Special Committee is therefore unwilling to consider further extensions, and the Board agrees with the Special Committee’s determination.”

In July, Anne Wojcicki had offered to buy out the company, effectively taking it private, offering to buy up all of the company’s remaining shares at a value of $0.40 per share. This was roundly rejected by the company’s board, with them later instructing her to withdraw the offer and not oppose any other offers. In the months that have followed, the company has struggled to find buyers. Now, with bankruptcy a possibility, the company may consider selling off genetic and user data either in hopes of saving itself or as part of a potential liquidation process.

What happens to all that DNA data?

In 23andme’s terms and conditions for new users, the company outright states that in the case of a sale or bankruptcy user’s genetic data may well be sold and used other than what was intended.

The terms of service read: “If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction.”

Non-profit group the Electronic Frontier Foundation has urged users to remove their data from the sites, warning that in some US states any sale would require the company to seek consent to sell data from its users. Across the US, the company’s main market, users have the right to request that their data be fully deleted, but in reality only a portion of the company’s user base will go through the multiple steps to have their data deleted, if they remember at all.

Speaking with Medical Device Network, Shannon Hartsfield, healthcare privacy lawyer for US legal firm Holland & Knight detailed that this is already a frequently litigated area, with much of what can and can't be done boiling down to the terms of service signed by the user when first accessing the service.

Hartsfield said: “Genetic data is, I think, viewed by a lot of people as super confidential, potentially it can relate to all kinds of things about your health condition or that of your family members and things like that. But when you are signing up for these kinds of services, you are providing your information to a third party, usually, for profit.

“They are bound by the contract they have with the consumer, it does look like they can sell this data or the whole company, to another company there are options for consumers to opt into research programs. But if the company has drafted its agreement properly, it should be allowed to let someone step in and take over custody of the data.

“The value of the company will depend on what people can and can't do with the data they have acquired and that could present a potential obstacle because they are going to be constrained by the promises that were initially made to consumers. So, if those promises were sufficiently robust such that a company coming in, all they could do is simply come in and house the data, being very limited in what they can do with that data that could really affect the company’s valuation. But if a company was hoping to come in and do whatever it wants with this significant database that’s probably not going to happen.”

It remains to be seen what will happen with the company. CEO Anne Wojcicki is determined to keep a hold of the troubled firm with at least a partial sale still on the table.

However, with so many barriers and impediments to the usefulness of this DNA data it could be that no one wants to spend the money on a cache of biological and customer data so fraught with legal strings and red tape that no one can make viable use of it.

Despite this, the genetic data of millions of American's remains on servers owned by the company. Servers that over time will need to be maintained, paid for and protected to avoid the data being breached again. All of that will require some form of outside funding. Funding that may not come for 23andme. At time of publication Anne Wojcicki has remained quiet on what could happen with user data if a sale does go through.