When direct-to-consumer genetic testing company 23andMe Holding Co. and its affiliates (together, “23andMe”) filed for chapter 11 bankruptcy on March 24, 2025, they possessed data from over 15 million customers. Specifically, 23andMe possesses genetic data obtained from analysis of DNA in saliva samples customers provide for analysis and interpretation of their ancestry traits and genetic health risks. 23andMe uses data from certain consenting customers – about 80 percent of those eligible – for research and extrapolates even more information from customer DNA.
Genetic data in 23andMe’s possession is no doubt valuable. Indeed, in collaboration with GlaxoSmithKline, it has been used to develop drugs, and it can also be used to study diseases.
In 2023, however, a data breach exposed the vulnerability of 23andMe’s data and customers. The perpetrator accessed information for about 7 million customers. Media outlets reported that information obtained through the breach was used to compile and publish online lists of customers with specific types of ancestry.
Upon entry into bankruptcy, 23andMe announced efforts to sell all or portions of its assets, including its databases of genetic information. The Office of the United States Trustee (a division of the Department of Justice) and dozens of state attorneys general raised an alarm, stressing the need for privacy protection in connection with the sale of genetic data and personally identifiable information. The attorneys general point out in filings that 23andMe’s records are not subject to HIPAA, though a variety of state laws apply to health information in 23andMe’s possession.
On April 29, 23andMe agreed to the appointment of a consumer privacy ombudsman (“CPO”) to assist the bankruptcy court in evaluating proposed sales or leases of customers’ genetic data, health, and personal information. The CPO is tasked with understanding 23andMe’s privacy policies and whether proposed uses of assets violate those policies or applicable laws, evaluating the privacy policies and cybersecurity programs of potential purchasers, and evaluating a proposed sale or lease in light of customer privacy concerns.
On May 19, 23andMe announced that Regeneron Pharmaceuticals, Inc. is the successful bidder for substantially all of 23andMe’s assets, for a purchase price of $246 million. A hearing for the bankruptcy court to consider approval of the sale is currently scheduled for June 17, and a report by the CPO regarding the proposed sale is currently due on June 10.
23andMe’s bankruptcy has spurred a bipartisan effort to protect consumer genetic information in bankruptcy cases. On May 22, Senators John Cornyn (R-TX), Amy Klobuchar (D-MN), and Chuck Grassley (R-IA) introduced the “Don’t Sell My DNA Act.” The bill proposes to amend the Bankruptcy Code to: (1) include genetic information as personally identifiable entitled certain protections in bankruptcy cases; (2) require the affirmative consent of consumers regarding the sale, use, or lease of their genetic information in bankruptcy; (3) require provision of notice regarding proposed use, sale, or lease of genetic information in bankruptcy; and (4) require the destruction of genetic information a bankruptcy estate does not sell, lease, or dispose of during bankruptcy.
If enacted, the Don’t Sell My DNA Act would make selling genetic data in bankruptcy more difficult, because any transaction would require affirmative consent, such as electing in writing to “opt in” to a sale, from individuals whose genetic information is proposed to be sold. Additionally, provision of notice to all such individuals would add expense to bankruptcy sale processes. These measures, if made law, could mean that, like DNA, 23andMe’s proposed sale of genetic data in bankruptcy will be one-of-a-kind.
