their own privacy team told me they are bound by regulatory obligations to retain data even after you request deletion. I've notified our attorney general's office to see if anything can be done but it might be too late. I'd love for someone who knows these "regulatory obligations" to chime in.....

Interesting, as that would be a violation of the CCPA/CPRA for customers who are California residents, at least.

The "regulatory obligations" sounds like a fake excuse. Is 23andme even regulated beyond how your regular average business might be?

Federal regulations trump state codes.

Yes, they have been regulated by the FDA for a decade now.

>their own privacy team told me they are bound by regulatory obligations to retain data even after you request deletion

They have to retain data about the person who requested the deletion which seems eminently reasonable. In the future if you sue them because you can't access your account that you paid for, they have a record that you requested said account's deletion.

Similarly they obviously can't withdraw your data from the anonymized research projects they pursued.

Well, purely going on who it is of value to, probably life insurance providers or pharmaceutical companies.

Still waiting for my "deletion confirmation e-mail". Hopefully it arrives.