The Federal Trade Commission (FTC) has written to the 23andMe bankruptcy trustees to advise them that the sale of the company and its assets must be consistent with the company’s past pledges to consumers about the privacy and security of their personal and genetic data and biological samples.Last month, 23andMe announced that it had entered Chapter 11 bankruptcy proceedings and had asked the court to arrange the sale of the company, including any assets owned by the company. 23andMe is a direct-to-consumer genetic testing company that conducts genetic testing of DNA obtained from saliva samples. Concerns have been raised about the sale of the company, which will include consumers’ personal and genetic data and biological samples. State Attorneys General in California, New York, Massachusetts, and Iowa have issued consumer alerts, advising past users of 23andMe’s services to take steps to protect their data, including requesting that 23andMe delete their data and destroy their test samples.’As 23andMe goes bankrupt, Iowans should know how to keep their DNA off the market,’ said Iowa Attorney General Brenna Bird. ‘The power is in Iowans’ hands to protect their unique and valuable genetic information. By taking a few simple steps, residents can control how their data is used, stored, or shared.’Following the announcement, 23andMe confirmed that ‘any buyer of 23andMe will be required to comply with our privacy policy and with all applicable law with respect to the treatment of customer data.’ While the statement was issued to reassure 23andMe customers, there is widespread concern about data privacy. Due to the number of individuals attempting to submit requests to delete their data, the 23andMe website has been experiencing technical difficulties, making submitting a request difficult.FTC chairman, Andrew N. Ferguson, has responded to the announcement to express his concerns about consumer privacy. In his letter, Ferguson explained that user data may be considered an asset that could be sold, and reminded 23andMe of its past commitments to ensure the privacy of consumer data and their biological samples.’As you may know, 23andMe collects and holds sensitive, immutable, identifiable personal information about millions of American consumers who have used the Company’s genetic testing and telehealth services. This includes genetic information, biological DNA samples, health information, ancestry and genealogy information, personal contact information, payment and billing information, and other information, such as messages that genetic relatives can send each other through the platform,’ explained Ferguson.Ferguson explained that the company has previously promised, and continues to promise, that user privacy and choice are at the forefront of its business model, and consumers have been told that they are in control of their data and can decide how it can be used and for what purposes. They also have the right to request that their data and samples be deleted.Ferguson said 23andMe has stated that personal information will not be shared with insurance companies, employers, public databases, or law enforcement without a court order or subpoena, and that consumers have been promised that their genetic information will not be shared with any third parties, although in the event of a bankruptcy, merger, or acquisition, personal data may be sold, accessed, or transferred to a third party as part of that transaction.Ferguson said the FTC believes that these promises to consumers must be kept, and that any data or biological samples that are transferred in relation to the sale will still be subject to the representations the company has previously made regarding data privacy and security. ‘Any purchaser should expressly agree to be bound by and adhere to the terms of 23andMe’s privacy policies and applicable law, including as to any changes it subsequently makes to those policies,’ Ferguson said.March 24, 2025: Genetic Testing Company 23andMe Files for Bankruptcy——————————————————————–The direct-to-consumer genetic testing company 23andMe has announced it has entered Chapter 11 bankruptcy and has asked the US Bankruptcy Court for the Eastern District of Missouri to facilitate a sale to maximize the value of its business.23andMe provides saliva-based DNA test kits to help customers identify and track their ancestry. The company was successful initially and went public in 2021 via a merger with a Special Purpose Acquisition Company (SPAC) and had a market capitalization of $6 billion. In February 2021, the company had its highest end-of-day stock price of $353.0; however, the share value has been tumbling since, reaching a low of $1.27 in early March 2025. In 2023, the company was hit with a damaging data breach. While there was no breach of 23andMe systems, a hacker was able to access accounts and steal the sensitive data of around half of its customers — [7 million individuals](https://www.hipaajournal.com/6-9-million-23andme-users-affected-by-data-breach/). 23andMe faced intense scrutiny over the data breach, with data protection regulators in the [United Kingdom and Canada](https://www.hipaajournal.com/uk-canada-data-regulators-investigate-23andme/) launching investigations. 23andMe also faced multiple lawsuits over the breach and negotiated a [$30 million settlement](https://www.hipaajournal.com/23andme-class-action-data-breach-settlement/) to resolve the consolidated class action litigation.23andMe CEO and co-founder Anne Wojcicki has been attempting a buyout since April last year, but the board rejected the proposal. She has now resigned and will attempt to purchase the company and take it private, and is convinced 23andMe is still a viable business. There is no guarantee that Wojcicki will be able to raise the necessary funds, and there may be other potential buyers. Should another buyer obtain the company, they will have access to the genetic data of 15 million people, which will include their genetic, ancestry, and family connections as well s any personal information provided to create their account.CEO chair, Mark Jensen, said ‘We are committed to continuing to safeguard customer data and being transparent about the management of user data going forward, and data privacy will be an important consideration in any potential transaction.’ U.S. users of the 23andMe service have a degree of protection under the Genetic Information Nondiscrimination Act (GITA), as their genetic data cannot be used to make employment or health insurance decisions but there may be other ways that their data could be used.California Attorney General, Rob Bonta, has reminded California residents that they have the right under the California Genetic Information Privacy Act to request 23andMe delete their data and destroy any samples of genetic material the company holds. ‘California has robust privacy laws that allow consumers to take control and request that a company delete their genetic data,’ said Attorney General Bonta. ‘Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company.’Customers are able to exercise their rights by logging into their 23andMe account and requesting the deletion of data and destruction of samples in the data section, which is accessible via the settings menu. An email confirmation will be sent by 23andMe, and a response is required to verify the request before any data/samples will be deleted/destroyed. Deletion of data and samples will be permanent, although it should be noted that per 23andMe’s privacy policy, some data will be retained by 23andMe for an undisclosed amount of time to comply with the company’s legal obligations.’With 23andMe facing bankruptcy, there are serious concerns about what happens to millions of users’ genetic and personal health information. This isn’t just a typical data set; it includes deeply sensitive, immutable biological data that can be tied to individuals and their families for generations. Unlike a password or credit card number, you can’t change your DNA,’ said Ensar Seker, CISO at SOCRadar. ‘The bottom line is that 23andMe’s bankruptcy shouldn’t just be seen as a business failure. It’s a data stewardship crisis. Regulators, privacy watchdogs, and even national security agencies should step in to ensure that this dataset doesn’t fall into the wrong hands. Transparency, oversight, and ethical responsibility are now more important than ever.’The post [FTC: 23andMe Buyer Must Abide by Company’s Past Privacy Promises](https://www.hipaajournal.com/genetic-testing-company-23andme-files-for-bankruptcy/) appeared first on [The HIPAA Journal](https://www.hipaajournal.com).
Related Tags:
NAICS: 62 – Health Care And Social Assistance
NAICS: 518 – Computing Infrastructure Providers
Data Processing
Web Hosting
Related Services
NAICS: 92 – Public Administration
NAICS: 51 – Information
Blog: Hipaa Journal
Create Account
Indicator Removal: File Deletion
Indicator Removal
Associated Indicators: