Companies, 23andMe included, also have a responsibility to notify consumers of changes and get "consumers' affirmative express consent for any new uses of their data," according to the Federal Trade Commission, the government agency that conducts oversight of direct-to-consumer genetic testing companies.

In the wake of a big data breach and a sizable new round of layoffs, 23andMe's handling of sensitive personal data is in the spotlight.

On Tuesday, 23andMe released its latest earnings report, showing revenue dipped 12% in the last quarter and share prices fell. The company has faced additional struggles over the past several months,

Concerns about 23andMe's business prospects is raising questions about the genetic testing company's customer data.