GEOFF BENNETT: The genetic testing company 23andMe has filed for bankruptcy.

And its potential sale has raised alarms about what could happen to the DNA data of its millions of users.

23andMe was once a pioneer in the DNA testing kit industry, allowing customers to send in samples to get information about their heredity and genetics.

Yet the company faced backlash after hackers leaked the genetic data of millions of users in 2023.

More than 15 million people have provided genetic information to the company.

Privacy and cybersecurity experts are now concerned about what this could all mean.

Ginny Fahs is watching this closely for "Consumer Reports," and joins us now.

Thanks for being with us.

So what does the sale of 23andMe mean for people's privacy?

GINNY FAHS, "Consumer Reports": Well, there are 15 million people who have used 23andMe to create DNA data.

People are interested in understanding their family history and their genetics, but the mere creation of this data means that there is highly sensitive information out there.

And because 23andMe is going through bankruptcy and that data could be changing hands, it means that some of the most sensitive data that a consumer can create may be at risk.

GEOFF BENNETT: Are there any rules or protections about what could happen to the data if a sale does take place?

GINNY FAHS: There are.

So, in the United States, many states have passed privacy laws.

And what these privacy laws allow is the ability to delete your data entirely from a company.

And so what that means is, if you are a 23andMe customer and you are worried about this sensitive information being out there and possibly changing hands, you can initiate a deletion of your data with 23andMe.

And you would do that by going to their Web site.

GEOFF BENNETT: And it's also true that the company has already used and even shared some of the data before now.

What more do we know about that?

GINNY FAHS: Well, according to 23andMe's privacy policy, in addition to genomic data, which is the A's, C's, T's, and G's that we all learn about in science classes, they also collect a lot of personal information about their customers.

So that's things like your home address, your family history, your payment information, those sorts of things.

So they're sitting on a pretty robust amount of data for each of their customers.

And because the privacy policy gives them dispensation to use that data in lots of different ways, it's hard to know as a customer how exactly that data is being used.

You would have to read a multipage privacy policy with a lot of legalese to understand.

And in the case of this bankruptcy, it's possible that that data will change hands and be beholden to different policies.

So there's a lot of uncertainty out there.

And that's why we are advising 23andMe customers to delete their data as soon as possible.

GEOFF BENNETT: How would people do that?

GINNY FAHS: So, if you want to delete your data from 23andMe, you should log into your account on their Web site and go to settings, where you can navigate to deleting your data.

In some states, that deletion of data will also allow the actual original test sample to be deleted.

And there's a way to specify that you want that removed on the 23andMe site as well.

GEOFF BENNETT: Should consumers of other DNA testing companies be concerned?

GINNY FAHS: Well, something I will say is that, when you create DNA data, it is hard to know what will happen to the institution that you have given that data to.

So, even if you feel really good in the moment about a company having access to this sensitive information, that company could fold, that company could sell, that data could change hands, and it's hard to know where it will end up.

Imagine a world where the 23andMe data is somehow acquired by an insurance company.

That data could be used to deny you insurance coverage.

It could be used to charge you higher premiums for life insurance, for long-term care insurance, for disability insurance.

And so if you're going to create DNA data or genetic data, it's important to think through everything that could happen in the future, even if you trust the group that you would be working with.

GEOFF BENNETT: That, in fact, is my next question for you.

I mean, how might this information be used?

Beyond the example you just gave of an insurance company, what are the other possible uses and concerns?

GINNY FAHS: Well, something about this data is, DNA data is unique to every person.

And so what that means is, there's a lot of clues that can be read as far as your health in this data.

So this data may reveal diseases you already have or diseases you can be predisposed to.

It can often reveal who you're related to, possibly even where your relatives live, other information about your relatives.

It could reveal family secrets.

There's a lot that could come from this data falling into the wrong hands.

And so that's why, if you have created your DNA data with 23andMe, especially, we advise you to delete that as soon as possible.

GEOFF BENNETT: Ginny Fahs, director of product and R&D at "Consumer Reports," thanks for joining us this evening.

We appreciate it.

GINNY FAHS: Thank you.