How to delete your 23andMe data amid the company's turmoil

[carimura]

I've been dealing with their support trying to delete my data. Here's the latest response [1]. The way I read it, they won't delete your genetic data, and it sure seems personally identifiable to me. Am I reading this wrong?

    [1] This is a follow-up from the 23andMe Team. Your 
    inquiry has been escalated to me for review. To clarify, 
    once you confirm your request to delete your account, we 
    will delete your data from our systems within 30 days, 
    unless we are required by law or regulation to 
    maintain data for a given timeframe.

    For example, your Genetic Information, date of birth, and     
    sex will be retained by 23andMe and our third party     
    genotyping laboratory as required for compliance with     
    applicable legal obligations, including the U.S. Federal     
    Clinical Laboratory Improvement Amendments of 1988 
    (CLIA), California Business and Professional Code 
    Section 1265, and College of American Pathologists 
    accreditation requirements.

    It is important to understand that the information stored     
    is distinct from the raw genotype data available within 
    your account. The raw data we receive from the lab 
    has not been processed by our interpretation software 
    to produce your individual-level genotype data (in 
    your account).

    You can read more about our retention requirements in the 
    retention of personal information section of our Privacy     
    Statement.

[drdaeman]

As I get it, it's a federal requirement for a lab to keep genetic data for a while with no way for the specimen to do anything about it.

So, it's a CDC thing, not exactly 23AndMe fault. Save for the fact that 23AndMe advertised it's easy to delete data on their front page, but with the small print somewhere out there that you can't really delete the actual data. To be entirely fair, it was there somewhere (I think in their help center in some article about data deletion process) when I went to check out their privacy policies - because that's how I learned about it and reconsidered buying a test, but I guess most people don't read the small print until the deed is done.

My understanding is that they will delete your data on their side (leaving only a few things like payment receipts), but the lab won't because they legally can't.

[mikrl]

> For example, your Genetic Information, date of birth, and sex will be retained

Quite possibly the most terrifying thing I’ve read recently.

[cypherpunks01]

I got an identical email, after asking numerous times for them to tell me when all information will be deleted, i.e. when do the compliance requirements expire for my specific account?

They certainly don't seem interested in answering this question, no matter how many ways I phrase it. So much for "you are in control of your data", I guess it was all BS as some people predicted.

[vaurora]

I'm married to a lawyer, so I asked him to look into this and he wrote a blog post:

https://bourniquelaw.com/2024/10/09/data-23-and-me/

Most relevant bit:

"The law requires medical laboratories to retain some testing data and materials for various lengths of time, often 2 years, but as long as 10 years for some kinds of test."

My personal experience: I also failed the birth date test, even with my usual fake birth date. I also refused to provide a copy of my ID. They escalated my request and agreed to delete it anyway. All my samples and data are more than 10 years old, so they have no legal obligation to retain anything, which I pointed out to them in my confirmation.

I'm hoping they delete it but don't have the resources to do anything more than hope.

[csl]

The way I read it, and I may be wrong, is that they will retain the _interpreted_ results, but now the raw and complete data.

[10u152]

So they'll happily delete everything unless it has value to them. Charming.

[roughly]

I’m in a weird spot with 23andMe - when I signed up, I used a fake name as a fig leaf in case they decided to sell to insurance or whatever. Since then, several members of my immediate family have all signed up, so “the child of X and the sibling of Y” means that fig leaf is pretty useless now - except I can’t issue an actual CCPA now, because fake name.

All of this is super predictable, but I wasn’t nearly cynical enough 15 years ago when I mailed my spit to them.

[filchermcurr]

I lied about my birth date and apparently there's no way to delete your data without the fake date or a photo ID... with the fake birth date...

sigh

[bee_rider]

Have you tried emailing them a bit? It is worth a shot I think: you made a typo (people make them all the time), but you don’t really need to fully authenticate, because you are just making a deletion request anyway (not trying to access the data).

(Also keep in mind, customer service people have to argue with assholes all day long, staying polite but clear but on-target can go a long way. Stick to the topic and never give them an excuse to cut off communication).

[j-bos]

Thanks, I want to get my genes sequenced but I'd also like to get my records deleted from the service provider. I guess it'l have to be real name?

[FloatArtifact]

They might delete it from their database, but it doesn't change the fact that it's been sold and shared in a way we can't also follow up and remove that information. There's no transparency. It not only implicates you, but your relations and future generations.

Genetic testing done through the hospital for a completely unrelated procedure can impact your life insurance. ( Example genetic testing for a child) Minnesota State Law prevents health insurance from changing. Laws need to protect right to know, not just right to use genetic information.

[marcell]

I used to work at 23andMe, AMA

Previous: https://news.ycombinator.com/item?id=41575685

[resters]

I tried to download my raw data recently and it took days. Seems like a lot of customers are trying to download it and cancel after the turmoil. I think 23andme has always been held hostage by its scientists who have stopped it from offering a lot of entertaining information about health related studies that are not considered methodologically sound enough to constitute health advice. Why not just add a "speculative or insufficiently replicated / peer-reviewed" section and let us have fun with our data!

[AStonesThrow]

I tell ya, it's a great party conversation that begins with "Hey, I'm a Libra, 3% Neanderthal, and I share a haplogroup with Genghis Khan! Let's go out for some tacos with extra cilantro, and a dark chocolate churro!"

[_DeadFred_]

Isn't it because there aren't ways around US laws regarding giving medical advice? That's my understanding why the places that do it are outside the US.

[tamimio]

Glad I never did any of these tests, I refuse to use biometrics in my own iPhone let alone sending my whole DNA to some company.

[jesseendahl]

Your iPhone doesn't even really store your biometric information, it stores mathematical models that can be used to check whether the fingerprint (Touch ID) or face (Face ID) matches the person who enrolled on the device (you).

And that mathematical information is only stored in the Secure Enclave, which means even if the entire Operating System (iOS) is hacked, the attacker still would not have access to your biometric information.

You should read this page. It goes into great detail about how much security there is around Touch ID and Face ID: https://support.apple.com/guide/security/face-id-and-touch-i...

[yoavm]

Just a reminder that you're leaving your biometrics basically on every surface you touch, and your DNA pretty much everywhere you drop a hair.

[more_corn]

As a California company the data is subject to the CCPA. You can download your data but more importantly you can request they delete it. I highly recommend that everyone do so.

I can think of no more sensitive biometric data than your dna.

[tombert]

> I can think of no more sensitive biometric data than your dna.

I dunno, is that actually true? You leave DNA everywhere don't you? If someone really wanted tombert's DNA, they'd just have to follow me onto the train and swab the poll I'm grabbing, or grab the cup I was sipping on at McDonald's, or any number of things that could lead to a number of cells containing my DNA in a state that could be collected being dropped.

[whalesalad]

I feel like that ship has sailed. Every software company I have ever worked for is dysfunctional in this regard. You might think your "delete my data" request succeeded but there is absolutely zero way to guarantee that it actually did, and chances are it didn't.

[davedx]

Agree, this is pointless. For one thing how many companies have the technical ability to remove specific records from all their database backups and logs? None that I’ve worked at

[jakjak123]

I dno, but delete works most places I have worked, just because it saves money

[goalonetwo]

Exactly this. Especially for a currently failing company that got an incentive to NOT delete your data (because that's the only value they still have).

[sfjailbird]

Not in the EU.

[Yhippa]

I feel like at best we'll get a soft delete

[ethbr1]

Historically, yes.

But don't the GDPR and CCPA et al. create liability around failure-to-delete after receiving a request?

[bluetidepro]

100% this. It's laughable if you believe those requests work as expected. Sure they may "delete" some surface level bs like your account or login, but there is no way it's 100% scrubbed in the way it's supposed to work.

[renewiltord]

Don't know why you'd bother. I, and my friends, and soon my family are in All of Us. We'll be in every genomics dataset you want.

[ethbr1]

One instance where I am disappointed to be vindicated.

Considered doing 23andMe at the hype peak, discovered they had avoided HIPAA requirements, read through their privacy policy, and marked them off the possibility list.

It was pretty clear the delta between sequencing costs and price they were charging consumers equaled how much they thought they could make from your genetic information.

And because they don't fall under HIPAA, your data is theirs after they get it.

PS: Sequencing costs were also falling rapidly, so it isn't that expensive to get it done.

[outworlder]

They do not do DNA sequencing. They do genotyping. It's far less detailed.

[kulesh]

I moved my DNA data from 23andMe to Genomelink ~5 years ago. Sort of saw it coming.

[iwontberude]

Honestly it doesn't even matter. There is no proof the DNA is yours because they do no validation of users identity.

[bdamm]

Speculative results with statistical likelihood are still highly valuable to the right buyers.

[SoftTalker]

People are convicted all the time without any "proof" of guilt. It all goes to "beyond a reasonable doubt" and with enough circumstantial evidence, that "beyond" can be achieved.

[Jerry2]

The (consumer) company I used to work for also allowed their customers to "delete" their data. Deletion was implemented as a boolean filed in the database "deleted - true/false'. We called it "soft deletion". And why was it implemented like this? It's because actually deleting data is hard. There is no single database and the data is distributed across many servers. It's also backed up in different places. Running the delete operation can be extremely costly and can also create service interruptions and data integrity issues. I think there was a script that was supposed to actually delete the entries but it was not run very often and was there for legal and compliance issues.

Just remember that when you request to delete some data on the internet, it doesn't actually get deleted (right away anyway). The best way to deal with this is not to give random sites your real information in the first place. However, that can be difficult or impossible when dealing with government, financial institutions or shopping sites.

Edit: And just to address questions below, the actual delete script was not run daily. I don't know how often it was run (I was not an SRE) but I presume it was run at least once a month. I have no idea how other companies do this.

[adrianmsmith]

> there was a script that was supposed to actually delete the entries ... was there for legal and compliance issues.

Sounds like the laws worked in this case. They required data to be actually deleted, and it was due to those laws, and only due to those laws.

[ravenstine]

Many businesses would still use soft-deletion even if distributed data wasn't an issue. The company I work for has soft-deletion enabled because they want to be able to help customers who accidentally delete something. I wish we would just tell them "better luck next time", but obviously management will never say that.

What annoys me more is how many companies give next to no insight into or control over data retention. It should be unambiguous how soon or often our data gets hard-deleted, if ever.

[zapkyeskrill]

Heh, I once worked for a company that had an "is_deleted2" field .. it indicated record was "hard" deleted and not accessible anymore via usual means!!

[lm28469]

It's 2024 if you can't delete data without corruption or downtime you're an absolute buffoon of an engineer

If anything gdpr made painfully obvious how sloppy some devs/companies are

[williamdclt]

Let’s be clear that what you describe is absolutely not gdpr compliant, so it would be illegal if you do business in Europe

[CatWChainsaw]

When you ask a company to delete your data, you're actually asking them to pretend they deleted it by making it invisible to you. There's too much $$$ sloshing around for them to behave ethically.

[kanzure]

I don't think I have ever seen a correctly implemented data deletion request system that worked well with the company's backups. If it's backed up, it's likely not getting deleted.

[outworlder]

Note that even if they delete the data, if you have close relatives that submitted their samples a company can still infer quite a lot from that.

[chx]

I still find it astonishing anyone would be so careless of their own and close blood relatives' privacy to hand over their genetic material to a private company. What were you thinking. You can't undo that and you can't change your DNA ever. You have no idea where it ends up any time -- and that "any time" covers your life time and your close blood relatives entire lifetime too. These companies should have never been able to get a single customer but I guess.

And here we are 18 years later and some people still think they can delete this. What else do you believe in? The tooth fairy? Santa Claus? Come on.

Also what have you thought they can tell you? An archaeogenetics teacher described this belief as "they think we throw a bone in the machine which tells us it was half hun, half avar, half bear and spoke slavic".

Y'all surrendered an intrinsic part of the privacy of your, your sister, your brother, even your unborn children for snake oil -- and paid for the privilege. I can't even.

commence the downvotes but you can't put the toothpaste back once it's been squeezed out.

[programjames]

As a twin I've always been extra cautious about this kind of stuff. I don't think I have a right to give people my twin's biometric data. I even refrain from posting images of myself publicly---there are at most two pictures of me from the past five years floating around the internet. It astounds me how reckless others are with their relatives' private information.

[artursapek]

inb4 Blackrock lol