23andMe's bankruptcy: your customers' data is your reputation
When a company holding millions of DNA profiles goes bankrupt, the question is no longer "is our data secure?" but "who will own it next?" Every business that collects personal data should be ready to answer.
By the Xuru Technologies team · 28 March 2025
Key takeaways
- 23andMe filed for Chapter 11 bankruptcy on 23 March 2025 and announced plans to sell its business.
- Several US state attorneys general urged customers to consider deleting their data.
- Personal data can change hands in a sale, which is why privacy policies and data minimisation matter.
- Health and wellness businesses should collect less, keep it shorter and explain clearly what happens to it.
Most businesses do not hold genetic data. But clinics, gyms, therapists, salons and online shops all hold information customers would not want to see sold or leaked.
What happened
After years of losses and a 2023 data breach, 23andMe sought bankruptcy protection. Michigan's attorney general urged users to consider deleting their accounts, and Arizona's attorney general issued a consumer alert explaining how. Demand for deletions reportedly slowed the company's website.
What it means for businesses
- Data is a liability as well as an asset. The more you hold, the more there is to protect — and to explain.
- Customers read privacy policies when it matters. Vague wording about "business transfers" erodes trust.
- Deletion must be easy. If customers struggle to delete their data, regulators and reviews notice.
- Health data has extra rules in the UK, EU, US states and India.
What to do now
| Step | Example |
|---|---|
| Collect only what you need | Drop "date of birth" from forms that don't need it |
| Set retention periods | Delete enquiry data after an agreed time |
| Offer self-service deletion | A clear "delete my account" route |
| Rewrite your privacy notice in plain English | What you collect, why, who sees it, how long you keep it |
Frequently asked questions
Can customer data be sold if a company is acquired?
Often, yes, subject to privacy law and the company's own policy. That is why clear policies and minimal data collection matter.
Does a small clinic need a privacy notice?
Yes. Any business collecting personal data online should explain what it collects and why, in line with local law.
How long should we keep enquiry form data?
Only as long as needed for the purpose. Many businesses set a fixed period, such as 12 to 24 months for unconverted enquiries.
Forms that collect less and earn more trust.
We build privacy-first websites with clear notices, consent and data retention built in from day one.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed
Leave a Reply