What Happened to Your DNA When 23andMe Entered Bankruptcy?
Updated July 15, 2026: This article now reflects the bankruptcy outcome and distinguishes confirmed events from the risks discussed beforehand.
In March 2025, 23andMe entered Chapter 11 protection. That turned an abstract privacy question into a real test: what happens when a consumer-genetics company changes hands?
The answer is more nuanced than “your DNA gets sold to the highest bidder.”
What the sale process established
The U.S. Federal Trade Commission warned that 23andMe's privacy promises continued to apply during a bankruptcy transfer. In June 2025, 23andMe announced a sale agreement with TTAM Research Institute, a nonprofit led by company co-founder Anne Wojcicki. The announced terms included commitments to existing privacy policies, continued account-deletion rights, limits on later transfers, and additional privacy oversight.
Those commitments matter. They do not make the underlying sensitivity disappear.
Genetic information is difficult to anonymize completely, can reveal information about biological relatives, and cannot be changed like a password. A transfer can be lawful and contractually restricted while still deserving close scrutiny from customers and regulators.
What the breach showed
The 2023 breach remains the clearest warning in this story. A joint investigation by the United Kingdom's Information Commissioner's Office and the Office of the Privacy Commissioner of Canada found serious security failings connected to the incident, including inadequate authentication and delayed protective controls. The regulators also recorded later remediation.
That is stronger evidence than speculating that a financially troubled company must be neglecting security. The lesson is to look at documented controls, incidents, and enforcement findings—not infer a security posture from a share price.
What privacy law does—and does not—do
Consumer genetic services are not necessarily covered by the same U.S. HIPAA rules that apply to health plans and many healthcare providers. That does not mean the data sits in a lawless void. Privacy policies, consumer-protection law, state or provincial law, bankruptcy orders, and regulator oversight can all matter. The exact protections depend on jurisdiction and circumstance.
Practical choices for customers
If you use a consumer-genetics service:
- review the current privacy policy and research-consent settings;
- download any information you want to retain before closing an account;
- use the provider's documented process to delete the account and request sample destruction, if that is your choice;
- use a unique password and multifactor authentication where available; and
- treat breach notifications as account-security events, while recognizing that ordinary credit monitoring cannot make exposed genetic information revocable.
The durable lesson
The 23andMe case does not prove that every bankruptcy results in unrestricted genetic-data sales. It proves something more useful: privacy promises, identity controls, deletion rights, transfer restrictions, and regulatory jurisdiction need to be understood before a corporate crisis.
Sources: FTC letter concerning the bankruptcy, 23andMe's sale agreement announcement, and the joint UK–Canada enforcement findings.