The battle for 23andMe's DNA customer data

Yahoo

27-03-2025

A bankruptcy filing by personalized genomics firm 23andMe (ME) calls into question what happens to its most valuable asset: genetic data from 15 million customers.
"I think the law on that is pretty unclear at this point," said Jonathan Lipson, a bankruptcy law professor at Temple University's Beasley School of Law.
The murky legal ground sets up an uncertain future for 23andMe and its customers, especially those who want their DNA and other information obliterated from the records of a biotech company that once dazzled Silicon Valley.
The company built a following by asking customers to mail in their biological information through "cheek swabs." In exchange for a fee, customers received gene-based health indicators, ancestral histories, and subscription services that provided them with control over their data.
But under bankruptcy protection, a "stay" halts enforcement of all contractual obligations against the company. And its assets — potentially including customer biometric data — become the property of a bankruptcy estate that is legally protected from creditors.
Lipson expects 23andMe's managers to argue that certain customer data is not theirs to delete because the data belongs to the estate.
The managers, he said, are legally obligated to maximize the value of the remaining assets, which would involve retaining the data.
"While I don't know exactly what the legal characterization of this data is," Lipson said, "I'm sure they're thinking about it."
23andMe sent an email to customers assuring them that their data would remain protected during the bankruptcy.
"The Chapter 11 filing does not change how we store, manage, or protect customer data," the email said. Any buyer of the company, it added, would be required to comply with applicable law with respect to the treatment of customer data.
23andMe's instructions for account deletion can be found here.
Roughly 20 states, including California, Colorado, New Jersey, Texas, Virginia, Washington, Utah, and Connecticut, have adopted protections applying to biometric data, and most give consumers a right to delete their information.
California Attorney General Rob Bonta has warned 23andMe's California customers that they are legally entitled to scrub their genetic data from the company's systems, including their DNA, identity, and biological samples — the saliva test samples submitted to the company.
"Due to the trove of sensitive consumer data 23andMe has amassed ... Californians who want to invoke these rights can do so by going to 23andMe's website," the attorney general's office said in a statement that outlines the steps consumers can take.
"Given 23andMe's reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company," Bonta said.
Daniel Gielchinsky, a partner and co-founder of DGIM Law, said the unfortunate reality is that the "more customers who go and scrub their data ... the less value this entity has as a going concern," noting that the company's value resides in its data.
The stock of 23andMe fell more than 11% Tuesday after dropping 59% on Monday.
The company's bankruptcy petition seeks court authorization to pursue a structured sale of its assets through an auction. The filing reported $277 million in assets as of the end of 2024 and debts of $215 million.
The 23andMe board has rejected a nonbinding acquisition offer from co-founder and CEO Anne Wojcicki, who stepped down on Friday. Wojcicki has been trying to take the company private since April.
Even if 23andMe's managers were to push the bankruptcy court to free it from its consumer agreements, the company would still need to abide by state laws. And customers in states that have adopted biometric data privacy laws are in the best position to control their data, said Ryan Sulkin, a data protection attorney at Benesch.
However, Lipson cautioned that there's some uncertainty about how the bankruptcy court would apply its federal authority to administer the sale of the estate.
A major factor likely to influence the fate of customers' data is whether the US Justice Department or the US Federal Trade Commission takes an interest in the bankruptcy proceedings.
"I would expect the Federal Trade Commission to have a voice at the table here," Sulkin said.
And Sulkin suspects that only certain buyers would satisfy US national security interests in a transition of 23andMe's troves of personal genetic data.
"Does this entity need to be solely owned by US interests?" he asked. If so, he said, "then you start getting into a TikTok scenario," referring to a law passed last year by Congress banning the social media app unless it finds a buyer for its US operations.
One hope for customers worried about the safety of their data is that bankruptcy courts are accustomed to protecting individual healthcare records in proceedings involving hospitals or doctors' practices. Typically, courts appoint a healthcare ombudsman to ensure patients continue to receive ongoing care.
But 23andMe falls into a gray area because its customers are not technically patients, and protecting healthcare information is tangential to the ombudsman role.
"So it's not quite a perfect fit for this situation," Gielchinsky said. "It's going to be an ongoing conversation between the creditors, the debtor, and the court about how best to protect customer data while still allowing there to be a competitive auction process."
23andMe's consumer notice says that in the event of a sale, customer data would "remain protected under the current 23andMe Privacy Policy, unless and until they are presented with materially new terms." Notice of such a change, it says, would be made "as required by law."
Alexis Keenan is a legal reporter for Yahoo Finance. Follow Alexis on X @alexiskweed.
Click here for in-depth analysis of the latest stock market news and events moving stock prices