23andMe

Is 23andMe safe?

23andMe is one of the riskier places to keep sensitive data, mostly because of what has already happened to it. In 2023 an attacker logged into about 14,000 accounts with passwords stolen from other sites, then used the DNA Relatives feature to pull names, ancestry reports and relative matches for about 6.9 million people. Regulators in the UK and Canada found the company had no mandatory multi-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary and was slow to respond. Then in March 2025 it went bankrupt, and the data of millions of customers was sold to a nonprofit set up by its co-founder. We score it 48/100, well below other health apps such as Flo at 66 and BetterHelp at 64.

What happened in the 2023 breach

According to the UK Information Commissioner's Office, the attack ran from April to September 2023. The attacker used credential stuffing, trying username and password pairs leaked in earlier breaches. California's attorney general says those included credentials from MyHeritage, a genealogy site 23andMe had partnered with, and that 23andMe never checked whether customers were reusing those passwords. Once inside, the attacker used a coding flaw in DNA Relatives to collect data about everyone linked to the hacked accounts.

The data included names, birth years, rough locations, profile photos, ethnicity, family trees and, for some, health reports. Data on one million users was then offered for sale on the dark web, advertised as belonging to Jewish and Asian American and Pacific Islander customers, according to California's attorney general. In August 2023, a claim that data on over 10 million users had been stolen was dismissed as a hoax, the ICO said, and 23andMe only confirmed the breach that October. Genetic data cannot be changed like a password, which is why regulators treated this so seriously.

Fines, settlements and the bankruptcy

The ICO fined 23andMe £2.31 million in June 2025 for failing to protect 155,592 UK users, after a joint investigation with Canada's privacy commissioner, who has no power to fine. In the US, 42 state attorneys general settled their claims in July 2026 for $150 million in allowed bankruptcy claims, though only $18 million will be paid because the estate has limited funds. A $46.75 million class settlement covered US customers who claimed by February 2026.

California went further. Its attorney general sued in May 2026, alleging misleading statements about the breach, and objected to the sale because California law requires separate consent before genetic data is transferred. The bankruptcy court and a district court rejected that objection. On 19 October 2026 California announced a $6 million settlement covering both the lawsuit and the appeal, still awaiting court approval.

The buyer was TTAM Research Institute, now renamed 23andMe Research Institute. The sale terms include stronger security requirements, an advisory board, a commitment to follow comprehensive privacy laws without exception and continued deletion rights.

What 23andMe collects and shares now

The privacy statement, last updated in October 2025, says 23andMe will not use genetic information for targeted ads without your explicit consent, and will release data to police only under a valid legal order. Its April 2026 transparency report shows 13 US government requests and no data produced. Research use is opt-in.

Other data is treated more loosely. The policy allows cross-context behavioural advertising through cookies, and Apple's label lists health, fitness and sensitive information as linked to you and used for third-party advertising. On Android, Google Play says device IDs, app activity and the list of installed apps are shared with other companies for analytics.

Should you delete your 23andMe account?

If you no longer use the service, deletion is the cleanest option, and it still works under the new owner. On the website, open Settings, scroll to "23andMe Data", click View, download a copy if you want one, then choose "Permanently Delete Data" and confirm by email. Deletion opts you out of research and discards your saliva sample, and it cannot be undone.

Deletion is not total. 23andMe and its lab keep your genetic data, date of birth and sex to meet US laboratory rules, plus a record of your deletion request. If you keep the account:

1. Turn off DNA Relatives unless you actively want matches. It was the route to most of the 2023 data.
2. Use a unique password; two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary now protects accounts.
3. Opt out of research and choose not to store your sample if you are unsure.
4. Remember that relatives who test can reveal facts about you, even if you never do.

How we scored it

Security (38) and the regulatory record (42) pull 23andMe down most: a breach that reached 6.9 million people through basic failures, then a UK fine, an $18 million settlement with 42 state attorneys general and a pending one with California. Scams and harmful content (65) and transparency and control (62) score best: deletion, sample destruction and research opt-out are easy to find, but the lab keeps some genetic data and customers had no say in the sale.