23andMe, the struggling ancestry tracing company, continues to spiral, raising questions about its business prospects and what could happen to its sensitive customer genetic testing data.

23andMe on Tuesday announced it is slashing 40% of its workforce as part of a restructuring plan. The move comes after its entire board resigned in September. Its stock price has since plunged, prompting speculation that the company could be acquired by another buyer and sparking concern among customers about the security of their genetic information. 

CEO Anne Wojcicki has said she intends to take the company private and is not considering third-party takeover proposals. 

Customer data collected from its genetic testing tools makes up the company’s most valuable asset. Because 23andMe is not a health care company, health privacy laws don’t apply, raising questions about what the business might opt to do with its 15 million users’ personal genetic data.

Under 23andMe’s current user agreement, users must opt-in to allow the company to share their personal DNA or data. The agreement states that if the company is acquired, customers’ data may be accessed or sold as part of such a transaction. 

23andMe told CBS MoneyWatch correspondent Kelly O’Grady that while there are no plans for a sale, the current privacy agreement would apply.

Meanwhile, at least 11 states have passed privacy laws that would require customers’ consent before their genetic data is transferred. 

Still, experts say a new owner could change 23andMe’s privacy terms following a sale, potentially putting the onus on consumers to push back against any move to share their data. 

23andMe said that roughly 80% of its customers consent to participate in the company’s research program, which it said has generated more than 270 peer-reviewed publications uncovering new genetic insights into disease. Any data that shared is anonymized and cannot be traced back to individual customers, according to the company.

Still, users can can take additional steps to protect their data, including deleting their 23andMe accounts — a process that is automated and straightforward. 

“If, at any time, you are no longer interested in participating in our Services, you may delete your 23andMe account directly within your Account Settings,” the company states on its website. 

That requires you to log in to your account and submit a request. The company then emails you a data deletion request confirmation, which you must verify. 

“They’ll get rid of your sample, they’ll delete all of your personal information and they will close the account,” O’Grady said.

23andMe, which went public in 2021, has struggled to generate profits, with most buyers of its saliva-based testing kits only needing to make a single purchase. The company reported a net loss of $667 million for its last fiscal year, more than double the loss of $312 million for the year prior.

23andMe posted another loss in quarterly earnings released Tuesday. The company reported a net loss of $59.1 million for the 2025 fiscal year’s second quarter, compared to a loss of $75.3 million for the same year prior.

contributed to this report.