23andMe, the once-booming DNA testing company that brought genetic science into millions of homes, has officially filed for Chapter 11 bankruptcy.
Now, as the company pursues a sale of its assets, over 15 million customers face a sobering question: What happens to their most sensitive personal data?
23andMe Bankruptcy: DNA for Sale?
With the bankruptcy filing by 23andMe, comes the potential sale of company assets – including genetic data, family lineage profiles, and stored biological samples. While 23andMe maintains that any buyer must comply with applicable privacy laws, legal experts warn that protections are thin, particularly in the absence of a federal data privacy law in the U.S.
In its privacy policy, 23andMe states that customer data may be transferred in the event of “bankruptcy, merger, or acquisition.” That includes genetic information tied to ancestry, health traits, and disease markers – some of the most intimate data a person can share.
Experts Sound the Alarm
I. Glenn Cohen, a health law expert at Harvard, says users have “very little say” over what happens next. “You may have trusted 23andMe, but you don’t get to choose who owns your DNA tomorrow,” he told The Harvard Gazette. And if a buyer has weaker data security standards? “There’s real risk of breach or misuse.”
Compounding those concerns is the reality that 23andMe isn’t covered by HIPAA, the federal law that protects medical data. Customers aren’t “patients” under the law – they’re consumers. That distinction removes key safeguards normally expected in healthcare data management.
Your Options: Delete or Be Sold?
California Attorney General Rob Bonta has urged residents to act now. “Consumers should invoke their right to delete their data before it’s part of a sale,” he said in a March 22 statement.
23andMe customers can delete their accounts by navigating to “23andMe data” in account settings and requesting deletion. This includes discarding biological samples, though some data may be retained to meet legal obligations. Once research using your data is published, however, it cannot be reversed.
Over 6.9 Million Records Already Compromised
This privacy crisis comes on the heels of another: a 2023 breach that saw the personal information of 6.9 million customers stolen by hackers. Now, with a sale pending and trust eroded, privacy advocates say the stakes are higher than ever.
What Happens Next?
The bankruptcy proceedings for 23andMe are expected to move quickly. The company previously rejected a takeover bid from CEO and co-founder Anne Wojcicki, leaving the door open to outside buyers – including private equity firms and data-centric tech companies.
The concern? A future buyer could revise terms of service and reframe what consent means. “Even if you’ve opted out of research, your genetic data might still be included in the deal, just anonymized,” one legal analyst told Axios.
Answering Popular Questions
- Is my 23andMe data safe after bankruptcy? – It depends. The company says it will follow the law, but a buyer could create new terms.
- Can I delete my 23andMe account now? – Yes. Log in, go to account settings, and follow deletion steps. You’ll receive a confirmation email.
- Is my genetic data covered by HIPAA? – No. 23andMe users are considered consumers, not patients, so HIPAA does not apply.
- Can my DNA be sold? – It can be transferred in a bankruptcy or sale, though identifiers are usually stripped.
- Ford Stock Climbs After Dividend Announcement for Q2 2025 - April 30, 2025
- GM Recalls Over 720,000 Trucks and SUVs for Potential Engine Failures - April 30, 2025
- The IRS Just Fired the People Making Your Taxes Easier—Here’s Why - April 30, 2025
