23andMe Bankruptcy: Understanding the Risk to Your DNA Data Privacy

When you spit into a 23andMe tube, you hand over the most personal data that exists: the genetic code that defines you, and partly your relatives too. So when 23andMe filed for bankruptcy in 2025, millions of people were left asking a frightening question — what happens to my DNA now?

The company held one of the largest human genetic databases ever assembled, built from more than 15 million customers. As it collapsed into Chapter 11, the fate of that data became a national controversy.

This article explains exactly what happened, who now owns the data, why genetic information is uniquely dangerous to lose control of, and the concrete steps you can take to protect yourself.

23andMe’s Rise and Fall

Founded in 2006, 23andMe was a pioneer of direct-to-consumer genetic testing. For a modest fee, customers mailed in a saliva sample and received reports on their ancestry, traits, and certain health risks.

The idea was a sensation. Millions of people bought kits, and the company amassed a genetic database of extraordinary scientific and commercial value.

In 2021, 23andMe went public through a merger with a special-purpose acquisition company, reaching a peak market value of around six billion US dollars.

Then the decline began. The core problem was a broken business model: customers generally test once, so repeat revenue was thin, and the company struggled to turn its data into a profitable drug-discovery business.

By 2024, its valuation had collapsed to roughly two percent of its peak. Mounting losses, a plunging share price, and a devastating data breach set the stage for bankruptcy.

The company had bet heavily on using its database to develop new drugs, a long and expensive process that had not yet paid off. Meanwhile, the flow of new kit sales slowed as the novelty faded.

It was a paradox that defined the company: it sat on a genetic archive of immense value, yet could not translate that asset into a stable, profitable business.

The 2023 Data Breach

The turning point in public trust came in 2023. Attackers gained access to 23andMe accounts and, through a feature that let relatives share information, reached far more data than the accounts they broke into.

The attackers used a technique called credential stuffing, reusing usernames and passwords leaked from other websites to log in. Because many people reuse passwords, a fraction of accounts were compromised this way.

The damage then multiplied through a feature called DNA Relatives, which let users see information about genetic matches. A single breached account could expose data on many relatives who were never hacked at all.

The breach ultimately exposed personal information belonging to roughly 6.9 million customers — nearly half the user base at the time.

Exposed data included names, birth years, ancestry details, and in some cases relationship information and health-related reports. Some data sets appeared to target specific ethnic groups, deepening the alarm.

The incident triggered lawsuits, regulatory scrutiny, and a lasting loss of confidence. For a company whose entire value rested on trust with sensitive data, it was a severe blow.

The company later strengthened its security, including requiring two-step verification, but the reputational harm was already done. Trust, once broken over something as personal as DNA, is hard to rebuild.

The Bankruptcy Filing

On 23 March 2025, 23andMe filed for Chapter 11 bankruptcy protection in the United States Bankruptcy Court for the Eastern District of Missouri, aiming to sell its assets.

Co-founder Anne Wojcicki resigned as chief executive, replaced on an interim basis by the company’s chief financial officer, Joe Selsavage. The company’s shares were suspended and delisted from Nasdaq.

Chapter 11 allows a company to reorganise or sell itself while shielded from creditors. Crucially, in a bankruptcy, a company’s assets can be sold — and 23andMe’s most valuable asset was its genetic database.

That is precisely what set off alarm bells. The DNA of 15 million people was now, in effect, an item on a bankruptcy balance sheet.

Bankruptcy law generally allows valuable assets to be sold to repay creditors, and it does not automatically carve out an exception for something as intimate as genetic data. That legal reality was, for many, the most unsettling part.

Regulators moved quickly. California’s Attorney General issued a consumer alert reminding residents of their right to have genetic data deleted, and the Federal Trade Commission warned that any sale must honour existing privacy promises.

The Fight for the Data: Regeneron vs TTAM

The sale process became a dramatic, closely watched contest, precisely because of what was being sold.

In May 2025, the biotechnology giant Regeneron Pharmaceuticals won the initial bankruptcy auction with a bid of 256 million US dollars, pledging to honour 23andMe’s privacy policies.

But the story did not end there. Anne Wojcicki, through a newly formed nonprofit called the TTAM Research Institute, argued she had been unfairly excluded and pressed the court to reopen bidding.

In June 2025, the court reopened the auction. In a final round, TTAM offered 305 million US dollars, and Regeneron declined to raise its bid further.

The bankruptcy court approved the sale to TTAM in late June, and the acquisition formally closed on 14 July 2025. Wojcicki’s nonprofit took ownership of 23andMe’s assets, including its genetics service and the Lemonaid telehealth business.

More than two dozen US states filed objections during the process, arguing that genetic data should not be transferred without each customer’s explicit consent. Those objections were ultimately overruled by the court.

Anne Wojcicki’s Fight for Control

The bidding drama was also a deeply personal story. Anne Wojcicki had co-founded 23andMe in 2006 and built it into a household name before its fall.

She had tried more than once to take the company private before the bankruptcy, and her earlier proposals were rejected by the board. Resigning as chief executive did not end her determination to control its future.

Her decision to bid through a nonprofit was significant. A public-benefit structure is not driven by shareholder profit, which she argued made it a more trustworthy custodian of sensitive genetic data.

Critics remained cautious, noting that pledges are only as durable as the organisation making them. But the nonprofit outcome was widely seen as less risky than a sale to a profit-driven buyer.

Why Genetic Data Is Uniquely Sensitive

Losing control of genetic data is unlike losing a password or even a credit card number. The differences are profound and permanent.

It cannot be changed. You can cancel a stolen card or reset a leaked password. You cannot reset your genome. Once your DNA is exposed, it is exposed for life.

It is not only yours. Because you share DNA with relatives, testing yourself exposes information about parents, siblings, children, and cousins who never consented to anything.

It is deeply revealing. Your genome can indicate predispositions to disease, family relationships you may not know about, and traits you might never wish to disclose.

It is permanent and future-facing. Data safe today may become dangerous as science advances, revealing more than anyone could have predicted at the time it was collected. The molecule itself is explained in our complete guide to DNA.

What Are the Real Risks?

The concerns raised by the bankruptcy are not hypothetical. Several concrete risks have driven the alarm among experts and regulators.

The core worry is that data collected for a friendly purpose — curiosity about ancestry or health — could later be used in ways the customer never imagined or agreed to.

Insurance discrimination. While US law restricts the use of genetic data by health insurers, those protections do not extend to life, disability, or long-term care insurance in the same way.

Employment concerns. Although discrimination based on genetics is illegal in many contexts, enforcement is imperfect, and the mere existence of exposed data creates risk.

Law enforcement access. Genetic databases have been used by police to identify suspects through relatives. A change of ownership can alter how such requests are handled.

Re-identification. Even “anonymised” genetic data can often be traced back to individuals, because a genome is itself a unique identifier that no amount of stripping labels can fully hide.

Together, these risks explain why a corporate ownership change — normally a dry financial event — became a matter of urgent personal concern for millions.

The Legal Landscape: GINA, HIPAA, and State Laws

Many people assume strong laws protect their genetic data. The reality is a patchwork with significant gaps.

The Genetic Information Nondiscrimination Act, known as GINA, is the main federal shield. It bars health insurers and employers from using genetic information against you.

But GINA has real limits. It does not cover life insurance, disability insurance, or long-term care insurance — precisely the areas where genetic risk could matter most.

HIPAA, the health privacy law, offers little help here either. It generally applies to hospitals, doctors, and insurers — not to direct-to-consumer testing companies like 23andMe.

This leaves state law to fill the gap. States such as California have stronger genetic privacy rules, and Europe’s GDPR treats genetic data as a special protected category, but coverage varies enormously by location.

Under the European Union’s GDPR, genetic data is classed as a special category requiring explicit consent and strict handling. In principle, that gives European customers stronger rights than many Americans enjoy.

The United Kingdom applies similar protections through its own data-protection framework. In practice, though, enforcing these rights against a company in a foreign bankruptcy is complicated and slow.

The uneven global patchwork means your genetic privacy can depend as much on where you live as on any promise a company makes — a striking inequality for data as universal as DNA.

What Happens to Your Data Now?

Under its new nonprofit owner, TTAM has pledged to uphold 23andMe’s existing privacy commitments and to give customers continued choice over their data.

The commitments announced include a consumer privacy board, prompt notification of any breaches, and a period of complimentary identity-theft monitoring for users.

Throughout the process, a court-appointed Customer Privacy Ombudsman reviewed how the sale would affect users — an unusual safeguard reflecting how sensitive the assets were.

Still, many customers did not wait to find out. Amid the uncertainty, around two million users chose to delete their genetic profiles from the service.

The lesson is clear: promises can change with ownership, and the surest protection remains taking direct control of your own data.

A Court-Appointed Privacy Watchdog

One notable feature of the 23andMe case was the appointment of an independent Customer Privacy Ombudsman to review the sale’s impact on users.

This role, provided for under US bankruptcy law when sensitive personal information is involved, is rarely invoked at this scale. Its use signalled how seriously the court treated the genetic data.

The ombudsman examined how the data would be handled, whether privacy policies would be honoured, and what protections buyers were offering — informing the court before it approved any sale.

For privacy advocates, the ombudsman was a welcome safeguard. For others, it underlined a deeper worry: that such protection was improvised case by case, rather than guaranteed by clear law.

How to Delete Your 23andMe Data

If you have ever used 23andMe and want to remove your data, the company provides a deletion process. The steps below reflect the standard account settings.

1. Log in and open Settings. Sign in to your 23andMe account, then select “Settings” from the menu under your profile.

2. Find the data section. Scroll to the “23andMe Data” section and click “View” to see the information held on your account.

3. Download first, if you want a copy. Before deleting, you can download your raw genetic data to keep for your own records.

4. Permanently delete. Select “Permanently Delete Data” and confirm via the email the company sends. This step cannot be undone.

5. Address your sample. If you previously agreed to have your saliva sample stored, you can withdraw that consent and request its destruction in your account preferences.

One caveat worth knowing: data already shared with research partners before deletion may not be fully retractable, which is why acting sooner rather than later matters.

Protecting Your Genetic Privacy More Broadly

The 23andMe saga offers lessons that reach far beyond one company. Genetic testing is now a large industry, and the same principles apply everywhere.

Read the privacy policy before testing. Understand whether your data can be sold, shared with research partners, or transferred if the company is acquired.

Be cautious with research consent. Opting in to research can advance science, but it also widens where your data travels. Choose deliberately, not by default.

Remember your relatives. Consider that testing yourself reveals information about your family. It is a shared decision, even if only one person clicks “agree.”

Know your rights. Depending on where you live, you may have legal rights to access, delete, or restrict the use of your genetic data. Use them.

The Bigger Picture for Consumer Genetics

The collapse of 23andMe sent a shockwave through the direct-to-consumer genetics industry. It exposed a structural weakness in the whole business model.

These companies gather priceless, permanent data, yet they are ordinary businesses that can fail, be sold, or change hands — taking that data with them.

The episode has intensified calls for stronger, clearer national rules on how genetic data is stored, secured, and transferred, especially during bankruptcies.

It has also made consumers more wary. The convenience of learning about your ancestry now sits alongside a clearer understanding of the long-term risks. That tension runs through debates over technologies like designer babies and modern gene editing in medicine.

Other testing firms watched the saga closely. Some moved to reassure customers about their own data practices, aware that trust across the entire sector had been shaken by one company’s collapse.

The episode may ultimately push the industry toward stronger, more transparent standards. If so, the painful 23andMe story could leave consumer genetics safer than it found it.

Why This Matters

The 23andMe bankruptcy is a landmark case in the history of data privacy. It is the first time the genetic data of millions became a bankruptcy asset on such a scale.

Its resolution — a nonprofit takeover with privacy pledges and court oversight — was arguably a relatively good outcome. But it depended on lawsuits, regulators, and a court, not on guarantees built into the system.

The deeper lesson is that in a genetic age, your DNA can end up somewhere you never intended, through events entirely outside your control.

It also raises a question society has barely begun to answer: who should be trusted to hold the genetic records of millions, and under what enforceable rules? The 23andMe case made that question impossible to ignore.

The most reliable protection is knowledge and action: understand what you are agreeing to before you test, and take direct control of your data when you can. Your genome is the one piece of information you can never replace.

The science of what that genome encodes is explored across our coverage, from the genetics of cancer to what DNA reveals about human origins.

Frequently Asked Questions

Sources

• 23andMe Media Center — Agreement for Sale of Business to TTAM Research Institute (June 2025).
• Regeneron Pharmaceuticals — Asset Purchase Agreement to Acquire 23andMe (with July 2025 update).
• U.S. Securities and Exchange Commission — 23andMe Form 8-K, court approval of sale to TTAM (June 2025).
• U.S. Federal Trade Commission — 23andMe bankruptcy and your genetic data.
• California Office of the Attorney General — consumer alert on deleting genetic data.
• Harvard Law School, Petrie-Flom Center — The 23andMe Bankruptcy: Privacy Considerations.
• Reuters — Court-appointed overseer for 23andMe genetic data.