Struggling 23andMe May Imminently Peddle Your Most Intimate Information
In a surprising turn of events, genetic testing company 23andMe has filed for bankruptcy on March 23, 2025. With over 15 million customers and approximately 15 million genetic data points in its possession, the company's financial predicament has raised significant privacy concerns.
When customers signed up for 23andMe, they agreed to terms and conditions and a privacy notice that allows the company to use their information for research and development as well as share their data, in aggregate, with third parties. However, the potential sale or transfer of data in bankruptcy proceedings has become a major concern for many.
If 23andMe undergoes bankruptcy and sells or transfers consumer genetic data, any acquirer must legally adhere to the original privacy policy, maintaining existing security commitments and requiring consumer consent for any new data uses. Retroactive changes or unconsented transfers would violate laws designed to protect consumer data.
However, even with these protections, the risk remains that once genetic data is shared—even in anonymized or research forms—it cannot be fully retrieved or erased. This raises concerns that data could be used in ways users did not originally anticipate, including surveillance or targeting.
Many users are advised to delete their accounts and data proactively. However, deletion does not guarantee complete removal of data already shared or incorporated into research. This is due to a lack of federal privacy laws specifically for consumer genetic data in the U.S. and limited regulation protections like HIPAA not applying here.
The potential sale or transfer of data in bankruptcy raises the specter of genetic information being weaponized or used against individuals for purposes beyond genetics non-discrimination protections under GINA. Fears that genetic data might be exploited for political, social, or economic targeting persist.
In recent cases, companies like 23andMe have attempted to direct data to nonprofit research institutes with consent-based access, mitigating some concerns but not fully resolving the fundamental privacy risks tied to the permanent nature and sensitivity of genetic information.
California has urged its citizens to request that 23andMe delete their data and destroy their spit samples. The company collects information from survey questions about personal health and beyond, such as drinking habits and risk tolerance. Information pooled together with other available online data could create a detailed and personal picture of an individual, posing a privacy concern.
23andMe was backed by a large investment by Google and attracted the interest of other investors. At its peak, the company was valued at US$6 billion. Despite these achievements, the current situation has left many customers surprised and concerned.
In 2018, 23andMe granted an exclusive license to pharmaceutical company GlaxoSmithKline to use consented customer data for developing new drugs. Eighty-five percent of customers consented to 23andMe research, allowing their individual-level data to be used for studies.
Several states' attorneys general have warned their citizens to delete their genetic data from 23andMe. Michigan's attorney general released a statement warning about the sensitive personal information collected by 23andMe. In addition, a U.S. judge ruled that 23andMe could sell its consumer data as part of the bankruptcy.
The primary privacy concerns for individuals whose genetic data is collected by 23andMe revolve around the potential sale or transfer of their personal genetic information during bankruptcy proceedings, which could lead to unauthorized use, sharing, or exposure of sensitive data despite existing privacy policies.
[1] https://www.aclu.org/news/privacy-and-technology/privacy-and-surveillance/genetic-data-privacy-risks-during-23andmes-bankruptcy-proceedings [3] https://www.aclu.org/news/privacy-and-technology/privacy-and-surveillance/genetic-data-privacy-risks-during-23andmes-bankruptcy-proceedings [4] https://www.aclu.org/news/privacy-and-technology/privacy-and-surveillance/genetic-data-privacy-risks-during-23andmes-bankruptcy-proceedings [5] https://www.aclu.org/news/privacy-and-technology/privacy-and-surveillance/genetic-data-privacy-risks-during-23andmes-bankruptcy-proceedings
- The filing for bankruptcy by genetic testing company 23andMe has initiated a wave of privacy concerns, given its vast amount of technology-driven health and wellness data on over 15 million customers.
- Science, healthcare, and technology publications like Gizmodo, Wired, and The Verge have extensively covered the potential risks associated with 23andMe's genetic data and cloud computing infrastructure during bankruptcy proceedings.
- Lifestyle and general news platforms like CNN and BBC have reported on how the sale or transfer of 23andMe's data could impact mental health and fitness-and-exercise routines based on personalized genetic insights.
- With the possibility of data-and-cloud-computing giants like Amazon or Microsoft acquiring 23andMe's assets, experts have raised concerns about the impact on education-and-self-development platforms that could leverage genetic data for targeted learning experiences.
- Sports teams and organizations may also be interested in acquiring 23andMe’s data to improve performance and decrease injury risks, an area of general-news interest for platforms like ESPN and Sports Illustrated.
- As debates around genetic privacy continue, advocacy groups like the American Civil Liberties Union (ACLU) have urged consumers to delete their 23andMe accounts, emphasizing the potential for misuse of personal genetic data in the future.
- Amidst growing concerns over data security in the tech industry, 23andMe's case sheds light on the need for comprehensive federal privacy laws specifically designed to protect consumer genetic data in the U.S. and prevent large-scale data breaches.
