As soon as the genetic testing company 23andMe filed for bankruptcy on March 23, 2025, concerns about what would happen to the personal information contained in its massive genetic and health information database were swift and widespread. A few days after, a U.S. judge ruled that the company could sell its consumer data as part of the bankruptcy.
The attorneys general of several states warned their citizens to delete their genetic data. California urged its citizens to request that 23andMe delete their data and destroy their spit samples. Michigan’s attorney general released a statement warning that “23andMe collects and stores some of the most sensitive personal information, our genetic code.”
When customers originally signed up for 23andMe, they agreed to terms and conditions and a privacy notice that allows the company to use their information for research and development as well as share their data, in aggregate, with third parties. If consumers consented to additional research, which the vast majority did, the company can additionally share their individual information with third parties. 23andMe has also been clear that if it is involved in a bankruptcy or sale of assets, consumer information might be sold or transferred.
While 23andMe has warned customers all along about everything that is currently happening, many are still surprised and concerned.
I’m a lawyer and bioethicist who has been studying direct-to-consumer genetic testing for almost a decade. Understanding what information 23andMe has been collecting, and how it might be used if sold or shared, can help clarify concerns for consumers.
What is 23andMe?
In 2007, 23andMe, named after the 23 pairs of chromosomes found in a human cell, was one of the first direct-to-consumer genetic testing companies to open in the United States. It was backed by a large investment by Google, which quickly attracted the interest of other investors, allowing 23andMe to thrive when many other direct-to-consumer genetic companies went quickly out of business.
The direct-to-consumer business model is fairly straightforward: A consumer orders a genetic test kit online, spits into a tube that comes in the mail, returns it to the company and accesses their results in an online portal. Over 15 million consumers bought 23andMe, and the vast majority consented to its research. At its peak, the company was valued at US$6 billion.
The fate of the trove of personal information 23andMe has gathered over the years has wide-ranging implications for consumers.
While the market initially believed in the value of 23andMe’s business model, its stock has been in decline for years, and the company owes hundreds of millions of dollars to creditors.
Reasons for this rapid decline include a decrease in the sale of test kits after a 2023 hack of almost 7 million people’s data, as well as a failure to profit enough from…
