CONSUMER ALERT: Attorney General Miyares Alerts Virginians on 23andMe Bankruptcy and Virginia’s Genetic Data Privacy Law

RICHMOND, VA – Attorney General Jason Miyares today issued a consumer alert regarding 23andMe’s bankruptcy filing and the rights Virginians have concerning their genetic data.

23andMe, a direct-to-consumer genetic testing company that collects and analyzes consumers’ genetic information, announced its bankruptcy filing in a press release on March 23, 2025. The company stated that it intends “to commence a process to sell substantially all of its assets” while continuing to operate “in the ordinary course throughout the sale process.” According to the release, there are no planned changes to how the company stores, manages, or protects customer data.

“Virginians who have sent their genetic data to 23andMe have the right under Virginia law to demand its deletion and destruction,” said Attorney General Jason Miyares. “I urge all 23andMe customers in Virginia to understand their rights to make decisions regarding their personal genetic data. My office will vigorously enforce Virginia’s genetic data privacy law to safeguard the rights and privacy of every Virginian.”

In 2023, Virginia passed a genetic data privacy law that gives Virginians rights regarding the genetic data that they provide to a direct-to-consumer genetic testing company like 23andMe. These companies are required to honor a consumer’s request to delete the consumer’s genetic data and to destroy the consumer’s biological sample within 30 days of receiving such a request. Virginians can read more about their rights under this genetic data privacy law here. 

Consumers currently can delete their 23andMe account and personal information by logging into their 23andMe accounts. As of the timing of this alert, the company has posted information about how consumers' information can be downloaded and permanently deleted here. Consumers can also currently access their accounts to opt out of having their saliva sample and DNA stored by the company and to withdraw consent for their data to be used for research. 

# # #