“The scale of how much highly sensitive data 23andMe has is unique,” said Suzanne Bernstein, the attorney for the Electronic Privacy Information Center. Her comment contributes to the foreboding sentiment regarding 23andMe’s bankruptcy, a company that was going to revolutionize the science of personal genetics but now potentially possesses the foreboding capability of selling its enormous database of genetic information to the highest bidder. With over 15 million subscribers worldwide, the battle has begun and privacy-aware consumers are waging war to peek at their information behind a shroud.
23andMe was established in 2006 as a company whose name was on everyone’s lips with the promise of saliva DNA kits so that customers can have a glimpse of their heritage and genetics vulnerability. The company leaped to $6 billion value after its 2021 IPO, but now it has gone from worse to worst. A massive 2023 data breach of nearly 7 million customers’ profiles was only the beginning of its downfall. With declining sales, reductions, and increasing liabilities, the company submitted voluntarily to Chapter 11 bankruptcy protection in March 2025, endangering an obscuring fate to its un-covered genetic data.
The filing also came amid reports of the sale of “substantially all of its assets,” including genetic data on millions of consumers. While 23andMe promised consumers that privacy would be top of mind if it were to be sold, experts are not convinced. “What you might have thought was safe and secure is clearly not,” said NYU Grossman School of Medicine professor of bioethics Arthur Caplan. He said circumstances in the company hold to itself the right to alter at whim could subject users to acquirers who are data abusers. There is minimal defense for genetic data under federal statute held by direct-to-consumer entities like 23andMe.
Genetic data is consumer data and not HIPAA-protected clinical data. It is therefore consigned to minimal protection. “The privacy law we have applies to information in health care settings. It doesn’t apply to protecting information that you gave freely to a private company,” said Caplan. Certain states, like California, enacted genetic privacy statutes, but the coverage that is afforded is vastly disproportionate and is too narrow to cover the fineries of covering genetic data. The crisis prompted California Attorney General Rob Bonta to issue a consumer alert, asking 23andMe consumers to delete their data and incinerate stored genetic material samples. Bonta referred to citing sections of the Genetic Information Privacy Act (GIPA) and California Consumer Privacy Act (CCPA), under which consumers have a right to have the information deleted and agree to stop its use in research.
These are most relevant to people who worry about future ownership and potential exploitation of their genetic data. To ask for your data to be deleted, users can log into their 23andMe account, navigate to the “Settings” and initiate permanent deletion of their genetic data. To people who decided to store saliva samples on reserve, individuals can update changes for destruction to be requested.
Subscribers are also not losing rights to withdraw permission for their data to be utilized in research studies. Controls such as these are not absolute despite a measure of control involved. The company admitted. The bigger fallout of 23andMe’s bankruptcy is experienced by more than its current consumers. The genetic data is shared with the family, and hence the individuals who never used the service can indirectly be impacted in the event the family members had their DNA shipped. This would most likely produce consent issues along with privacy issues for ordinary family members.
As Bernstein departed, “We would recommend taking those actions and advocating to your state and federal representatives to pass strong consumer privacy laws,” she added, “as this is just the first example of a company like this with tremendous amounts of sensitive data being bought or sold.” 23andMe’s failure also reflects a larger trend in the consumer genetic testing industry. Once hailed as revolutionary technology, the market has been sharply undercut by privacy issues, market saturation and uselessness. The 2017 and 2018 sales of the DNA kits set record figures that then fell through the floor, and online transactions on 23andMe platforms dropped by 54% in 2019. The industry was left reeling that has brought forth gargantuan redundancies and strategic reorientation as the businesses grapple with issues on how to be able to sustain customers’ trust and build sustainable models of business.
Even with this obstacle, the possibility of users’ gene data being responded to negatively has been a subject of debate. Law enforcement units have already begun utilizing DNA profiles to track criminal perpetrators, as seen in the Golden State Killer case. While 23andMe so far has maintained a technical subpoena or court order before they will release information to the powers that be, a prospective owner can reverse such requirements and expose members to risk of ill of uncertain origin. For progressive concerned citizens, the 23andMe scandal is an eye-opener to the vulnerability of having their genetic information under the control of private institutions. For the future of the company itself, consumers need to move quickly and protect their data and call upon their governments to make their privacy laws stronger so that they can protect their genetic information from being in the wrong hands.
