Although the ICO ultimately chose not to treat 23andMe's limited cooperation as an aggravating factor—largely due to the company's financial distress and related loss of key personnel —it was clear that the regulator was dissatisfied with the level of engagement. 23andMe failed to provide information in the requested format, missed deadlines, and seemed to prioritise responses to US regulators. Some of the information provided was insufficiently detailed, and at times inaccurate and requiring substantial revision. There were also delays in disclosing key facts including the risk to raw genetic data; the existence of threatening messages sent to the former CEO which were sent by the cyber criminal; and the defects in IP logging. The company also delayed interviews with staff and failed to make its Chief Product Officer available at all.