Genetic testing company 23andMe has been in a doom spiral, leaving customers wondering what will happen to their genetic data.
After 23andMe IPO’d in 2021, it was worth $6B. Now, its market cap is just ~$150m, and revenue was down 34% YoY in Q1, per Wired.
But 23andMe has never been profitable — most customers take its standard DNA test once, view their results, and that’s it. The company’s efforts to push expensive subscription services and premium reports, which range from $268 to $999 for the first year, haven’t paid off either.
Other struggles:
- Last year, 23andMe suffered a data breach affecting ~50% of its customers, or 6.9m people. It agreed to a $30m settlement in September.
- In August, 23andMe shut down its in-house drug discovery unit.
- Last month, the company’s board resigned after CEO Anne Wojcicki suggested taking the company private.
Some analysts speculate it could be out of business by 2025, unless a bankruptcy process occurs.
What happens to all the data they’ve collected?
Unclear. The company has been fairly ambiguous about the future of its data.
Law professor Anya Prince told NPR that HIPAA doesn’t apply to 23andMe because it isn’t a health care company, while a 23andMe spokesperson told The New York Times that it is subject to its own similar protocols, as well as state and federal regulations.
It also claims all genetic data shared with research companies is anonymized, and that it doesn’t allow law enforcement access.
In the event of a merger or acquisition, new ownership would receive access to 23andMe’s data, though Wojcicki said she is no longer considering selling the company.
What’s the risk?
The Atlantic detailed a few potential alarming scenarios — insurers using genetic info to deny coverage to people with preexisting conditions, drugmakers using it to target ads — but it’s unclear how likely that is.
It could potentially be used for doxing. Hackers behind last year’s data breach seemingly targeted Jewish and Chinese customers, leaking their personal info including names, addresses, and birth dates.
Concerned customers can delete their data, though 23andMe claims it is legally required to keep some.
