23andMe Bankruptcy: Understanding the Risk to Your DNA Data Privacy

When you spit into a 23andMe tube, you hand over the most personal data that exists: the genetic code that defines you, and partly your relatives too. So when 23andMe filed for bankruptcy in 2025, millions of people were left asking a frightening question — what happens to my DNA now?

The company held one of the largest human genetic databases ever assembled, built from more than 15 million customers. As it collapsed into Chapter 11, the fate of that data became a national controversy.

This article explains exactly what happened, who now owns the data, why genetic information is uniquely dangerous to lose control of, and the concrete steps you can take to protect yourself.

One number frames everything that follows. The data was always justified by what it could do for medicine, so we looked for what medicine got out of it: ClinicalTrials.gov, searched on 1 September 2026, listed 16 registered studies mentioning 23andMe, nine of them completed.

Sixteen. The largest consumer genetic database ever assembled appears in a number of registered trials you could count on your fingers, while the database itself passed through bankruptcy court and sold for $305 million.

That gap is the argument of this article in one line. The scientific value of consumer genetic data was the justification for collecting it. The commercial value is what determined where it went.

23andMe’s Rise and Fall

Founded in 2006, 23andMe was a pioneer of direct-to-consumer genetic testing. For a modest fee, customers mailed in a saliva sample and received reports on their ancestry, traits, and certain health risks.

The idea was a sensation. Millions of people bought kits, and the company amassed a genetic database of extraordinary scientific and commercial value.

In 2021, 23andMe went public through a merger with a special-purpose acquisition company, reaching a peak market value of around six billion US dollars.

Then the decline began. The core problem was a broken business model: customers generally test once, so repeat revenue was thin, and the company struggled to turn its data into a profitable drug-discovery business.

By 2024, its valuation had collapsed to roughly two percent of its peak. Mounting losses, a plunging share price, and a devastating data breach set the stage for bankruptcy.

The company had bet heavily on using its database to develop new drugs, a long and expensive process that had not yet paid off. Meanwhile, the flow of new kit sales slowed as the novelty faded.

It was a paradox that defined the company: it sat on a genetic archive of immense value, yet could not translate that asset into a stable, profitable business.

The 2023 Data Breach

The turning point in public trust came in 2023. Attackers gained access to 23andMe accounts and, through a feature that let relatives share information, reached far more data than the accounts they broke into.

The attackers used a technique called credential stuffing, reusing usernames and passwords leaked from other websites to log in. Because many people reuse passwords, a fraction of accounts were compromised this way.

The damage then multiplied through a feature called DNA Relatives, which let users see information about genetic matches. A single breached account could expose data on many relatives who were never hacked at all.

The breach ultimately exposed personal information belonging to roughly 6.9 million customers — nearly half the user base at the time.

Exposed data included names, birth years, ancestry details, and in some cases relationship information and health-related reports. Some data sets appeared to target specific ethnic groups, deepening the alarm.

The incident triggered lawsuits, regulatory scrutiny, and a lasting loss of confidence. For a company whose entire value rested on trust with sensitive data, it was a severe blow.

The company later strengthened its security, including requiring two-step verification, but the reputational harm was already done. Trust, once broken over something as personal as DNA, is hard to rebuild.

The Bankruptcy Filing

On 23 March 2025, 23andMe filed for Chapter 11 bankruptcy protection in the United States Bankruptcy Court for the Eastern District of Missouri, aiming to sell its assets.

Co-founder Anne Wojcicki resigned as chief executive, replaced on an interim basis by the company’s chief financial officer, Joe Selsavage. The company’s shares were suspended and delisted from Nasdaq.

Chapter 11 allows a company to reorganise or sell itself while shielded from creditors. Crucially, in a bankruptcy, a company’s assets can be sold — and 23andMe’s most valuable asset was its genetic database.

That is precisely what set off alarm bells. The DNA of 15 million people was now, in effect, an item on a bankruptcy balance sheet.

Bankruptcy law generally allows valuable assets to be sold to repay creditors, and it does not automatically carve out an exception for something as intimate as genetic data. That legal reality was, for many, the most unsettling part.

Regulators moved quickly. California’s Attorney General issued a consumer alert reminding residents of their right to have genetic data deleted, and the Federal Trade Commission warned that any sale must honour existing privacy promises.

The Fight for the Data: Regeneron vs TTAM

The sale process became a dramatic, closely watched contest, precisely because of what was being sold.

In May 2025, the biotechnology giant Regeneron Pharmaceuticals won the initial bankruptcy auction with a bid of 256 million US dollars, pledging to honour 23andMe’s privacy policies.

But the story did not end there. Anne Wojcicki, through a newly formed nonprofit called the TTAM Research Institute, argued she had been unfairly excluded and pressed the court to reopen bidding.

In June 2025, the court reopened the auction. In a final round, TTAM offered 305 million US dollars, and Regeneron declined to raise its bid further.

The bankruptcy court approved the sale to TTAM in late June, and the acquisition formally closed on 14 July 2025. Wojcicki’s nonprofit took ownership of 23andMe’s assets, including its genetics service and the Lemonaid telehealth business.

More than two dozen US states filed objections during the process, arguing that genetic data should not be transferred without each customer’s explicit consent. Those objections were ultimately overruled by the court.

Anne Wojcicki’s Fight for Control

The bidding drama was also a deeply personal story. Anne Wojcicki had co-founded 23andMe in 2006 and built it into a household name before its fall.

She had tried more than once to take the company private before the bankruptcy, and her earlier proposals were rejected by the board. Resigning as chief executive did not end her determination to control its future.

Her decision to bid through a nonprofit was significant. A public-benefit structure is not driven by shareholder profit, which she argued made it a more trustworthy custodian of sensitive genetic data.

Critics remained cautious, noting that pledges are only as durable as the organisation making them. But the nonprofit outcome was widely seen as less risky than a sale to a profit-driven buyer.

Why Genetic Data Is Uniquely Sensitive

Losing control of genetic data is unlike losing a password or even a credit card number. The differences are profound and permanent.

It cannot be changed. You can cancel a stolen card or reset a leaked password. You cannot reset your genome. Once your DNA is exposed, it is exposed for life.

It is not only yours. Because you share DNA with relatives, testing yourself exposes information about parents, siblings, children, and cousins who never consented to anything.

It is deeply revealing. Your genome can indicate predispositions to disease, family relationships you may not know about, and traits you might never wish to disclose.

It is permanent and future-facing. Data safe today may become dangerous as science advances, revealing more than anyone could have predicted at the time it was collected. The molecule itself is explained in our complete guide to DNA.

What Are the Real Risks?

The concerns raised by the bankruptcy are not hypothetical. Several concrete risks have driven the alarm among experts and regulators.

The core worry is that data collected for a friendly purpose — curiosity about ancestry or health — could later be used in ways the customer never imagined or agreed to.

Insurance discrimination. While US law restricts the use of genetic data by health insurers, those protections do not extend to life, disability, or long-term care insurance in the same way.

Employment concerns. Although discrimination based on genetics is illegal in many contexts, enforcement is imperfect, and the mere existence of exposed data creates risk.

Law enforcement access. Genetic databases have been used by police to identify suspects through relatives. A change of ownership can alter how such requests are handled.

Re-identification. Even “anonymised” genetic data can often be traced back to individuals, because a genome is itself a unique identifier that no amount of stripping labels can fully hide.

Together, these risks explain why a corporate ownership change — normally a dry financial event — became a matter of urgent personal concern for millions.

The Legal Landscape: GINA, HIPAA, and State Laws

Many people assume strong laws protect their genetic data. The reality is a patchwork with significant gaps.

The Genetic Information Nondiscrimination Act, known as GINA, is the main federal shield. It bars health insurers and employers from using genetic information against you.

But GINA has real limits. It does not cover life insurance, disability insurance, or long-term care insurance — precisely the areas where genetic risk could matter most.

HIPAA, the health privacy law, offers little help here either. It generally applies to hospitals, doctors, and insurers — not to direct-to-consumer testing companies like 23andMe.

This leaves state law to fill the gap. States such as California have stronger genetic privacy rules, and Europe’s GDPR treats genetic data as a special protected category, but coverage varies enormously by location.

Under the European Union’s GDPR, genetic data is classed as a special category requiring explicit consent and strict handling. In principle, that gives European customers stronger rights than many Americans enjoy.

The United Kingdom applies similar protections through its own data-protection framework. In practice, though, enforcing these rights against a company in a foreign bankruptcy is complicated and slow.

The uneven global patchwork means your genetic privacy can depend as much on where you live as on any promise a company makes — a striking inequality for data as universal as DNA.

What the Law Actually Protects, and What It Leaves Open

It is worth being exact about the protection most people believe they have, because the gap between the belief and the statute is where the real risk sits.

The Genetic Information Nondiscrimination Act, passed in 2008, is the law usually cited when someone worries about a DNA test being used against them. It does two things. It stops health insurers using genetic information to set premiums or deny cover, and it stops employers using it in hiring, firing or promotion. Both are real protections and both matter.

What GINA does not cover is the part people tend to be most afraid of. It does not apply to life insurance. It does not apply to disability insurance. It does not apply to long-term care insurance. In those three markets an insurer may lawfully ask about, and act on, genetic and family health information when deciding whether to offer a policy and at what price. A number of US states have passed their own laws extending protection into some of these areas, so the answer to “am I protected?” depends on where you live as much as on what you were tested for.

The exclusion was deliberate rather than accidental, and the argument behind it is not frivolous. Insurers point to adverse selection: if millions of customers know more about their own risk than the actuaries pricing the policy, people who learn they carry a serious risk buy heavily while those who learn they do not stop buying, and the pool stops working. That is a genuine structural problem, not merely an industry talking point.

Against it, a 2017 paper in Personalized Medicine by Jessica Tenenbaum of Duke University and Kenneth Goodman of the University of Miami argues that the three excluded markets have been wrongly lumped together. Life insurance mainly transfers wealth after a death. Disability and long-term care insurance, by contrast, pay for the care a living person needs in order to function. The authors conclude there is no good reason to place those two in the same class as life insurance and therefore beyond GINA’s reach. Nearly a decade later, they remain there.

Set that beside the bankruptcy and the shape of the problem becomes clear. The protections negotiated in court covered security, oversight and the right to delete. None of them addressed the uses that GINA already fails to reach, because a bankruptcy court cannot write insurance law. A reader deciding whether to keep or delete an account is not really choosing between two custodians. They are choosing whether to leave a permanent record in a category the law has never fully closed.

Europe Starts From the Opposite Assumption

The American framework described above works by exception. Genetic data is handled like any other commercial record unless some particular statute reaches it, and GINA — the statute most people have heard of — reaches employment and health cover while leaving three insurance markets open.

European law inverts the default. Article 9 of the General Data Protection Regulation places genetic data in a category it calls special, alongside biometric data and data concerning health, and begins by prohibiting its processing outright. Processing becomes lawful only if one of a closed list of conditions applies: explicit consent given for a specified purpose, or a narrow set of public-interest, medical, legal and research grounds. The same regulation gives individuals a right to erasure.

The practical difference is not the length of the rulebook but where the burden falls. Under the American model a use is allowed until a law forbids it, and the customer is left to discover which laws apply in their state. Under the European model a use is forbidden until someone can point to the ground that permits it, and the organisation holding the data has to produce that justification. When a company changes hands, that distinction decides who has to explain themselves.

Neither framework should be oversold. A strong regulation did not prevent the 2023 breach, and rights that exist on paper still require a person to know they have them and to act. But the contrast is useful for a reader trying to judge their own exposure, because it shows that the American position is a policy choice rather than a technical necessity. Genetic data is not inherently ungovernable. It is governed differently in different places, and the United States has chosen the more permissive arrangement.

This is also why the standard reassurance — that the data is de-identified — carries less weight for genomes than for other records. An address can be changed and a card number reissued. A genome cannot be revoked, it does not expire, and because it is shared with relatives, a decision made by one person discloses information about people who were never asked. Those relatives have no account to delete.

That is not a theoretical concern, and the clearest demonstration did not come from a hacker. In 2018 investigators identified a suspect in the Golden State Killer case by uploading crime-scene DNA to a public genealogy database and working outwards through the family trees of distant relatives who had tested voluntarily. The suspect had never taken a DNA test. He was found through the choices of cousins he had probably never met. Whatever one concludes about that particular outcome, the mechanism is the point: a genetic database does not only describe the people in it, and consent given by one person quietly extends across a family.

What Happens to Your Data Now?

Under its new nonprofit owner, TTAM has pledged to uphold 23andMe’s existing privacy commitments and to give customers continued choice over their data.

The commitments announced include a consumer privacy board, prompt notification of any breaches, and a period of complimentary identity-theft monitoring for users.

Throughout the process, a court-appointed Customer Privacy Ombudsman reviewed how the sale would affect users — an unusual safeguard reflecting how sensitive the assets were.

Still, many customers did not wait to find out. Amid the uncertainty, around two million users chose to delete their genetic profiles from the service.

The lesson is clear: promises can change with ownership, and the surest protection remains taking direct control of your own data.

A Court-Appointed Privacy Watchdog

One notable feature of the 23andMe case was the appointment of an independent Customer Privacy Ombudsman to review the sale’s impact on users.

This role, provided for under US bankruptcy law when sensitive personal information is involved, is rarely invoked at this scale. Its use signalled how seriously the court treated the genetic data.

The ombudsman examined how the data would be handled, whether privacy policies would be honoured, and what protections buyers were offering — informing the court before it approved any sale.

For privacy advocates, the ombudsman was a welcome safeguard. For others, it underlined a deeper worry: that such protection was improvised case by case, rather than guaranteed by clear law.

What the Courts Finally Decided

The bankruptcy did not end when the database changed hands. It ended in a courtroom settlement more than a year later, and the terms repay a close reading, because they are the first real precedent for what happens when a genetic database goes through insolvency.

On 16 July 2026 the attorneys general of 42 states announced a settlement of their bankruptcy claims against the company. On paper the states secured $150 million in allowed claims. In practice they recovered $18 million, paid immediately from what remained of the bankruptcy estate. The distance between those two figures is the ordinary arithmetic of a company that has run out of money. Alabama’s share, for a sense of scale, was $260,817.

A separate class-action settlement of $46.75 million covered US consumers caught in the 2023 breach, with claims closing on 17 February 2026.

The conditions attached to the data matter more than the money. TTAM Research Institute — since reregistered as the 23andMe Research Institute — agreed to enhanced security requirements, formal risk analysis, an advisory board, compliance with comprehensive privacy laws without exception, and the continuation of consumer deletion rights.

Read one way, that is a system working. A court and 42 state law offices extracted binding privacy commitments that had not existed before. Read another way, it is this article’s argument restated: every one of those protections was negotiated after the fact, by lawyers, in a bankruptcy court. None of it was guaranteed in advance by a statute covering consumer genetic data. The next company to fail will begin the same argument from the beginning.

How to Delete Your 23andMe Data

If you have ever used 23andMe and want to remove your data, the company provides a deletion process. The steps below reflect the standard account settings.

1. Log in and open Settings. Sign in to your 23andMe account, then select “Settings” from the menu under your profile.

2. Find the data section. Scroll to the “23andMe Data” section and click “View” to see the information held on your account.

3. Download first, if you want a copy. Before deleting, you can download your raw genetic data to keep for your own records.

4. Permanently delete. Select “Permanently Delete Data” and confirm via the email the company sends. This step cannot be undone.

5. Address your sample. If you previously agreed to have your saliva sample stored, you can withdraw that consent and request its destruction in your account preferences.

One caveat worth knowing: data already shared with research partners before deletion may not be fully retractable, which is why acting sooner rather than later matters.

Protecting Your Genetic Privacy More Broadly

The 23andMe saga offers lessons that reach far beyond one company. Genetic testing is now a large industry, and the same principles apply everywhere.

Read the privacy policy before testing. Understand whether your data can be sold, shared with research partners, or transferred if the company is acquired.

Be cautious with research consent. Opting in to research can advance science, but it also widens where your data travels. Choose deliberately, not by default.

Remember your relatives. Consider that testing yourself reveals information about your family. It is a shared decision, even if only one person clicks “agree.”

Know your rights. Depending on where you live, you may have legal rights to access, delete, or restrict the use of your genetic data. Use them.

The Bigger Picture for Consumer Genetics

The collapse of 23andMe sent a shockwave through the direct-to-consumer genetics industry. It exposed a structural weakness in the whole business model.

These companies gather priceless, permanent data, yet they are ordinary businesses that can fail, be sold, or change hands — taking that data with them.

The episode has intensified calls for stronger, clearer national rules on how genetic data is stored, secured, and transferred, especially during bankruptcies.

It has also made consumers more wary. The convenience of learning about your ancestry now sits alongside a clearer understanding of the long-term risks. That tension runs through debates over technologies like designer babies and modern gene editing in medicine.

Other testing firms watched the saga closely. Some moved to reassure customers about their own data practices, aware that trust across the entire sector had been shaken by one company’s collapse.

The episode may ultimately push the industry toward stronger, more transparent standards. If so, the painful 23andMe story could leave consumer genetics safer than it found it.

Why This Matters

The 23andMe bankruptcy is a landmark case in the history of data privacy. It is the first time the genetic data of millions became a bankruptcy asset on such a scale.

Its resolution — a nonprofit takeover with privacy pledges and court oversight — was arguably a relatively good outcome. But it depended on lawsuits, regulators, and a court, not on guarantees built into the system.

The deeper lesson is that in a genetic age, your DNA can end up somewhere you never intended, through events entirely outside your control.

It also raises a question society has barely begun to answer: who should be trusted to hold the genetic records of millions, and under what enforceable rules? The 23andMe case made that question impossible to ignore.

The most reliable protection is knowledge and action: understand what you are agreeing to before you test, and take direct control of your data when you can. Your genome is the one piece of information you can never replace.

The science of what that genome encodes is explored across our coverage, from the genetics of cancer to what DNA reveals about human origins.

Frequently Asked Questions

Sources

• 23andMe Media Center — Agreement for Sale of Business to TTAM Research Institute (June 2025).
• Regeneron Pharmaceuticals — Asset Purchase Agreement to Acquire 23andMe (with July 2025 update).
• U.S. Securities and Exchange Commission — 23andMe Form 8-K, court approval of sale to TTAM (June 2025).
• Office of the Alabama Attorney General — 42-state settlement of bankruptcy claims against 23andMe (16 July 2026).
• Federal Trade Commission — privacy and data security guidance.
• California Attorney General — CCPA rights, including deletion of personal data.
• Harvard Law School, Petrie-Flom Center — The 23andMe Bankruptcy: Privacy Considerations.
• Reuters — Court-appointed overseer for 23andMe genetic data.
• NAAG Client States v. 23andMe Holding Co., No. 25-04035 (Bankr. E.D. Mo.) — multistate action over the genetic database, CourtListener
• Gutierrez v. 23andMe, Inc., No. 25-04043 (Bankr. E.D. Mo.) — adversary proceeding docket, CourtListener