7 ms·
How to Delete Your 23andMe Data
- YooLi 2y agoThis feels as hopeless as trying to keep your email/contacts from social media sites. Even if you are vigilant about never allowing an app/service to download your contacts, your friends will share theirs and it is trivial to recreate your contact list. If I keep my DNA from these companies, my relatives will share theirs and they basically have my DNA.
- CharlesW 2y ago> This feels as hopeless as trying to keep your email/contacts from social media sites. The cynic in me agrees, but the process was quick and easy, and I know I'm not safer by not deleting my information from 23andMe. I recommend it.
- deleted 2y ago[deleted]
- drdaeman 2y agoNote that despite any requests the genetic data and some personal information (DOB and sex) probably won't be deleted, at least because of CLIA requirements: https://news.ycombinator.com/item?id=41781879 https://news.ycombinator.com/item?id=41781879 (more details in https://bourniquelaw.com/2024/10/09/data-23-and-me/ https://bourniquelaw.com/2024/10/09/data-23-and-me/, linked from the thread there)
- CharlesW 2y agoHere's a great post by a lawyer, linked to further down in that thread: https://bourniquelaw.com/2024/10/09/data-23-and-me/ https://bourniquelaw.com/2024/10/09/data-23-and-me/ It suggests a way to challenge them on their assertions that they must keep your data and samples.
- bpodgursky 2y agoI'm sorry but this lawyer has absolutely no idea what he is talking about with regards to CLIA compliance. And he even admits as much, but keeps talking anyway.
- CharlesW 2y agoCLIA is one of the excuses 23andMe uses to explain why they retain your genetic information, date of birth, and sex. The author cites the code sections he believes 23andMe are referencing to make this claim, then explains why he believes it doesn't apply. As a CLIA expert, do you mind explaining what he's getting wrong for our benefit?
- nelox 2y ago23andMe does not operate as a laboratory itself but contracts with U.S.-based labs that are certified under CLIA and accredited by the College of American Pathologists (CAP). According to their website, all saliva samples are processed in CLIA-certified and CAP-accredited labs, ensuring compliance with federal standards for accuracy and reliability. This certification is crucial, as it aligns with FDA requirements for certain health-related genetic tests. This distinction is significant, as CLIA primarily regulates labs, not the companies that contract them, potentially affecting the applicability of retention requirements to 23andMe’s broader operations. CLIA’s record retention requirements, as per Section 493.1105, states labs must retain test requisitions, authorizations, and reports for at least 2 years, with longer periods for specific tests like pathology (10 years for slides). CLIA Laboratory Record Retention Requirements: - Test requisitions and authorizations: 2 years minimum. - Test reports: 2 years minimum, 10 years for pathology reports. - Cytology slide preparations: 5 years. - Histopathology slides: 10 years. - Pathology specimen blocks: 2 years. - Tissue: Until diagnosis is made. Notably, these requirements focus on test-related records, such as requisitions (which may include patient details like date of birth and sex) and reports (which for genetic tests would include interpreted results). However, there is no explicit mention of retaining raw genetic data, such as the full genotype data, in the CLIA regulations. This raises questions about whether 23andMe’s assertion to retain raw genetic information is strictly required by CLIA or if it extends beyond the regulation for other reasons, such as research or quality control.
- ahmedfromtunis 2y agoTo be honest, this is more like "requesting the data to be deleted". There's nothing that guarantees that the personal information will be physically wiped out of the hard drives used to store them.
- throwaway48476 2y agoBut it creates legal grounds for lawsuits if they don't.
- ahmedfromtunis 2y agoOf course. And I'm not saying that they might do it in malice. All I'm suggesting is that tapping some pixels on your backlit rectangular glass won't necessarily translate into pulses of electrons that'll eradicate the 0s and 1s representing your data. I'm sure that corner of the codebase is one of the least visited parts, so bugs may lurk in, or misconfigurations, etc.
- Cheer2171 2y agoSure, you can sue the hollowed out shell of a bankrupt limited liability corporation that will soon have no assets for a court to sieze for whatever paltry damages a court finds.
- wyldfire 2y agoIdeally the court can compel the purchaser(s) to destroy the data.
- HankB99 2y ago> > this is more like "requesting the data to be deleted". > Ideally the court can compel the purchaser(s) to destroy the data. I suppose a court order holds more weight than checking a box on a web site, but I'm not sure how much I'd trust the eventual purchaser. Worse yet, if the seller drops their guard (due to lack of funding for proper security) will someone steal the data? At that point web requests and court orders are moot. I guess I'm seeing a black hat behind every bush. I'm not sure if this kind of data has any value on the black market.
- ks2048 2y agoHas anyone tried to export their ancestry data? I've notice the PDF summary lists broad regions, but the data in the App shows more details (e.g. specific counties of countries). Anyone know how to export that data? I'll just take some screenshots, but maybe this info is somewhere else in the export.
- dahinds 2y agoClick on the "Scientific Details" instead of the Summary.
- pmarreck 2y agoWhy? If it's already out there, it's kind of too late, is it not?
- deleted 2y ago[deleted]
- rglover 2y agoThe data has already been sold off to the real customers (i.e., not you and me) [1]. You can (and should) request a deletion, but the damage has already been done. [1] https://gizmodo.com/23andme-is-selling-your-data-but-not-how-you-think-1794340474 https://gizmodo.com/23andme-is-selling-your-data-but-not-how...
- dahinds 2y agoThis is false, we've sold data with PII to no one. Or it is misleading: the page you linked to even says, "It is selling de-identified, aggregate data for research, if you give them consent."
- EA-3167 2y agoTo what extent and using what method is it "de-identified"? Plenty of such schemes are very easy to circumvent, especially with a large enough pool of data. Given the nature of genetics in particular positively identifying a single case can be used to unmask whole families. In particular depending on the anonymization this would be a task suited to 'AI' very well.
- dekhn 2y agohttps://www.23andme.com/about/individual-data-consent https://www.23andme.com/about/individual-data-consent Basically, if you imagine this as a table of "user's name, date of birth, and address" keys mapping to genomic and other data, the key was replaced with a random identifier that could not be trivially joined to recover the user name, date of birth, and address. These systems are not robust against motivated and capitalized adversaries.
- dahinds 2y agoI can go to a data broker and purchase access to de-identified EMR data for most of the U.S. population. There are much more useful de-identified datasets around than ours, if someone is motivated to try to re-identify those datasets. That data is all bought and sold without anyone's consent and this is all fine under HIPAA.
- yoaviram 2y agoBetter yet, send them a legally binding data deletion request (if you live in a jurisdiction that has strong data protection laws): https://yourdigitalrights.org/d/23andme.com https://yourdigitalrights.org/d/23andme.com
- brian-armstrong 2y agoThe distinction isn't super important, but 23andMe doesn't have your whole genome, just some specific locations from it. Roughly 750k base pairs or so. https://www.quora.com/How-much-of-the-genome-does-23andMe-sequence-Can-their-data-be-used-to-study-disease https://www.quora.com/How-much-of-the-genome-does-23andMe-se...
- echelon 2y agoEnough to be denied insurance, have job offers rescinded, or be targeted by scams. And they don't even have to have your DNA. Just a close enough relative will do.
- echoangle 2y ago> have job offers rescinded, or be targeted by scams Can you expand on this? I understand the insurance thing due to genetic diseases and so on, but which jobs would I be denied for based on genetic information which wouldn’t be checked anyways? I can only come up with stuff like colorblindness but that would probably be checked anyways if it were a strict requirement for the job so keeping the DNA secret wouldn’t help. And what’s the scam angle when the DNA is known?
- echelon 2y agoThis would be wholly illegal, but companies could screen candidates prior to extending offers to them. After they get your primary details and history, they can look you up in the gene database. They could look for a whole host of genetic markers, including but not limited to: - Markers like ADHD and other neurodivergence and performance signals - Disease likelihoods to reduce their insurance burden. Cardiovascular, cancer, neurodegeneration, etc. - Markers for intelligence and tenacity. Personality type. Conversely, dishonesty, neuroticism, etc. They could screen for literally any hypothetical condition that could in theory impact performance, risk, cost, etc. By excluding candidates with "low genetic scores", they might think they're saving margin. There is a ton of literature beyond what 23andMe is legally allowed to report on with respect to the SNP data they collect. These studies report on a wide range of phenotypical states and behaviors that could impact job performance. The stack of research is deep. > And what’s the scam angle when the DNA is known? Look for any markers that indicate IQ, agreeableness, neurodegeneration, schizophrenia, personality type, etc. It gives scammers a hypothetically better hit rate. And again, they don't need your DNA to do this. Just a relative's.
- hammock 2y agoHow do we know it hasn’t already been sold at least once? The OMG expose makes me think
- huxflux 2y agoOr hacked, ha.
- randomNumber7 2y agoHello, I was sent back from the future to tell you there is already a backup.
- goykasi 2y agoAre we related? Are you me?
- ineedasername 2y agoHey—when you get back, tell me it worked. That the branch held. That it’s stable. I’ll merge it all with a pull after that. It’s not true—not yet—but once you say it, it will be. Just… don’t mention that part. Not until after the first.
- Boogie_Man 2y agoMe trying to sequence ppls genomes in my basement doesn't seem so bad now.
- isjustintime 2y agoHah, yes. I used to work at a company that sold a popular DNA product. I built part of the GDPR data deletion pipeline. During my last week there, I submitted a request to delete my data from the systems. The final integration test!
- dineol 2y agolol do you really think they will delete your data?)
- partiallypro 2y agoI know I'm in the vast minority here, but I honestly don't really care what is done with my DNA data as long as it's not used against me for healthcare & insurance purposes (which I believe is already illegal.) If someone wants to use it to make new drugs, research, etc, I just don't care.
- lurkersince2013 2y agoAm sure there’s a very real possibility that some shady data brokers will ultimately gain access to the treasure trove of data before long - and am sure that in our capitalistic world healthcare and insurance companies would happily pay for access.
- simplyinfinity 2y agoIn the USA. In Europe and such, I'm not saying it's zero chance, but it's extremely unlikely. As Europeans don't rely on insurance for healthcare, but we use government for that :) ( the exception being, if you want private insurance if your government provided one isn't enough)
- robwwilliams 2y agoNot to mention it is illegal and not even an illegal money makers.
- nickjj 2y agoI never made an account there or uploaded anything DNA related but what happens if a relative did? Is there the concept of a "ghost" account that gets filled in for people who didn't sign up yet but is likely related? Can this be deleted without making an account?
- scottyah 2y agoYeah, they teamed up with the Mormons mapping out the entire human family tree and have been able to predict every possible child DNA sequence in order to eventually create Paul Atreides. (as for your question, I have no idea)
- windsignaling 2y agoIs anyone having trouble downloading their data? Some data, such as "Raw Data", "Imputed Genotype Data R6", and "Phased Genotype Data" need to be requested, but I haven't heard back from them yet. Would like to download everything first before requesting deletion.
- miquong 2y agoI requested, but gave up and requested deletion after. I still haven’t received the requested data. Still, I figure I have a few trillion backup copies… albeit in very raw format
- Mistletoe 2y agoIf I had to guess they are really behind right now. Everyone I know is doing this. I checked my email and I emailed mine to myself in 2018 thank goodness. Told them to destroy my sample today and delete my data (don’t know if it will be done but at least I did it).
- abracadaniel 2y agoI did it a few months ago and the data sets took about a day to become available.
- spear 2y agoI requested my data three days ago and got "Raw Data" and "Phased [...]" early today. Still waiting for the last set.
- ineedasername 2y agoDelete? How then will I get to hang out with Roko after regenerative AI incorporates their data into its training corpus?
- TuringNYC 2y agoNot sure if others are having this problem, but my login no longer works, and password-reset emails never arrive (tried three times on three days w/o success)
- jbd0 2y agoSame here. My wife and I are both unable to login due to a forced password reset and password-reset emails that never arrive.
- arduanika 2y agoIf only there had been some way to see this coming.
- johnnyballgame 2y agoI just can't understand who in their right mind, and is even remotely concerned about the privacy of their personal information, would upload their own DNA to a business. An internet-based one at that. Lemmings, I tell ya.
- tonymet 2y agoFor those curious about what actual data they are recording, they use Infinium Global Screening Array which records about 650-750k SNPs (single-nucleotide-polymorphisms) . Obviously this data infers heritage, disease risk, relations. It could be used for discrimination, surveillance, potentially poisoning . Everyone should request their data to be deleted, but this is an engineering forum, and we know what that means in practice. Every company like this has hundreds of copies of the data, and has shared it with dozens of providers. Like Rev Tevia said, you can't put the feathers back into an opened pillow.
- briHass 2y agoTheir array of SNPs in ASCII letters is under 10MB compressed, probably well under that using a specialized SNP format/compression algorithm. Less than a complex Microsoft Office file. Yeah, I can imagine they have a few dozen copies strewn over various backup media/blob buckets. There probably isn't much effort from what's left of their IT team to track them all down to delete.
- tonymet 2y agoIt’s not about the size. Every task will have made a copy and a derivative . I doubt the company ever cared to build a dependency tree for removal, certainly not managing copies given to partners. Now the company is bankrupt this is the last thing on their task list to implement.
- kjkjadksj 2y agoPoisoning really? All the risks are pretty sci fi. It’s pretty easy otoh to harm someone without bothering analyzing the snp data if that is your intention.
- tonymet 2y agoricin and polonium-210 have many documented cases, likely 10000+ undocumented. It's only scifi until years later when it becomes declassified
- biker142541 2y agoI've been a broken record about the implications of sending DNA to a corporation for 20 years... it's hard not to have seen this coming.
- juunpp 2y agoIsn't this one of the stupidest versions of capitalism?
- deleted 2y ago[deleted]
- rohan_ 2y agoIf 23andMe is bounded by the legal system - why shouldn't we trust them the same way we trust Dropbox not to sell our personal files? No one has been able to explain this to me.
- cyanydeez 2y agoHave you seen the legal system lately?
- rohan_ 2y agosure - so this isn't a unique complaint with 23andMe then? We should be deleting our data from Dropbox, Google, etc...?
- noman-land 2y agoNow you're getting it.
- Gibbon1 2y agoI never used gmail or Chrome because I didn't want to become dependent on tools controlled by a search and ad company. I definitely feel now that was the correct instinct.
- StefanBatory 2y agoBecause on average your files on Dropbox are worth way less than your DNA.
- ashoeafoot 2y agoOh, the scams i have to show you, such sights to behold : "Dear Sir,Madam while reading a recently acquired db, i came across your brother in law who has disease xy. Now, me being a decent person, i kept things qiet for now. No need to rattle potential love interests , your children or the community with news about this genetic curse. If you want this silence to last, just subscribe by donating 0.01 bitcoin per year to the Mammal & Animal Foundation for Integrity Agency." This right here is the chernobyll of privacy.
- StefanBatory 2y agoIt's a matter of time until some neo-Nazis get access into DNA databases to look for Jews, won't it?
- hermannj314 2y agoI never used 23andme, my brother did, so I get the pleasure of having no legal recourse but all of my data stolen anyway. I am sorry to all of you that gave your family DNA to a SV startup. It must suck to feel like you have no say in what happens to your private information.