Archiving and deleting 23andMe

I decided to delete my 23andMe profile. All told it took about a week and I have a copy of everything I care about. Could have gone faster but I was careful and slow about it.

I did the test in 2011 with mixed feelings; genetic data is so super private and yet also so readily available to a determined attacker. I was curious what the reports would say. And I kind of wanted to support the company, I believed their research mission.

The consumer product never quite excited me. Other than one very significant thing (story forthcoming) it’s told me nothing useful. A lot of the stuff they highlight is dubious. I don’t see any reason to continue to pay for access to it.

And then there’s the law enforcement fuckery. Police keep getting more and more aggressive about accessing genetic databases. It’s not clear the courts will protect people. Time to delete the data.

Note that deletion isn’t really deletion. 23AndMe seems to make a good faith effort to remove data and destroy samples. But they may have shared some data and it’s no longer entirely under their control. Also your entire genetic data is stored “to meet CLIA requirements”, apparently some regulatory requirement where the government wants labs to keep data so they can evaluate lab quality. In theory all that stuff should be anonymized but I wouldn’t trust that against a determined attacker. If I’d known all this back at the beginning I never would have done the test.

So, what to do when deleting your 23AndMe account? Here’s what I did. Note I have very old data in their system, from a genetic test in 2011.

  1. Contact any connections you have and let them know you’re deleting your data. If you shared something with a family member it might be nice to give them a couple of days to take one last look at your data.
  2. Download all user data. This page is accessible from Settings, at the bottom under Data. It has buttons for downloading various sections. The reports data wants to print; I printed that to a PDF file.
  3. Be sure to download raw genetic data. It doesn’t download immediately; it creates a request and you get an email when it’s ready. (Mine took just a few minutes and was 24MB). This is the most important data on the site, the raw genetic test output. It’s all your SNPs. It’s possible to analyze this data with lots of tools, both online and offline.
  4. Download your archived reports. This only applies to pre-2016 accounts, before the FDA settlement, and only contains old science reports.
  5. Browse your current reports. One last trip down memory lane. It turns out I do not have the Neanderthal trait that makes people sneeze after eating dark chocolate. Thanks, 23AndMe, that’s definitely worth risking my genetic privacy to know!
  6. Consider downloading / printing any detailed reports you are interested in. They seldom contain any more personal data than is in the summary report but the surrounding context may be useful.
  7. Consider downloading Profile Data. This is a record of inputs you’ve given the site, like address changes and your self-reported phenotype. You have to request a download; it took two days for me. Mine was a few uninteresting tiny CSV files so I’m not sure it was worth the bother.
  8. Request account closure. That’s the final step, the deletion. The big red button is at the bottom of this page. They send you an email to confirm with some caveats.

Once I submitted the final deletion my account looked inaccessible the moment I tried to log in. Well I could log in, but it looked like an empty profile. The site didn’t promise any final notification when the deletion is completed, no idea whether I’ve simply been marked as status: deleted or they actually scrubbed my data. Presumably destroying biological samples takes some time.

As noted above, various copies of your genetic data will be kept for years and there’s nothing you can do to delete it. I believe these are all anonymized and won’t be easy to associate with your name, but that still seems pretty crappy to me.

I will give 23AndMe credit, nowhere in this process was there some retention process slowing me down. They never even asked why I was deleting! I appreciated that; it’s much harder to, say, cancel cable TV.

23AndMe’s deletion details

This is the disclosure in the email from 23AndMe about what deletion means. Note the third bullet item about “will retain your Genetic Information”; despite my request they are not actually deleting my data.

We received your request to permanently delete your 23andMe account and associated data. The following apply when you submit your deletion request:

  • If you chose to consent to 23andMe Research by agreeing to an applicable 23andMe Research consent document, any research involving your data that has already been performed or published prior to our receipt of your request will not be reversed, undone, or withdrawn.
  • Any samples for which you gave consent to be stored (biobanked) will be discarded.
  • 23andMe and the contracted genotyping laboratory will retain your Genetic Information, Date of Birth, and sex as required for compliance with legal obligations, pursuant to the federal Clinical Laboratory Improvement Amendments of 1988 and California laboratory regulations.
  • 23andMe will retain limited information related to your data deletion request, such as your email address and Account Deletion Request Identifier, as necessary to fulfill your request and for the establishment, exercise or defense of legal claims.

Once you confirm your request to delete all of your data, 23andMe will begin processing your request. This decision cannot be cancelled, undone, withdrawn, or reversed.