23andMe's bankruptcy isn't just a finance story, it's a potential privacy crisis

Photo collage of an auctioneer gesturing towards the camera with a gavel, showing off a huge strand of DNA on a plinth.

What happens when a business based on the thing that makes you you goes belly up?

(Image credit: Illustration by Julia Wytrazek / Getty Images)

published 25 March 2025

By definition, there is nothing more personal than someone's unique genetic code. So when California Attorney General Rob Bonta warned residents this past week that the looming bankruptcy of genetic testing and analysis company 23andMe could put the biological data of some 14 million users at risk, his consumer rights alert struck a sensitive nerve. Here, it seems, is the nightmare scenario about which many privacy experts had long warned.

Given California's "robust privacy laws," residents should "consider invoking their rights" to demand 23andMe "delete their data and destroy any samples of genetic material held by the company," Bonta said in a press release. The company, meanwhile, claimed in an open letter that its Chapter 11 bankruptcy filing does not "change how we store, manage or protect customer data." Crucially, 23andMe said, any future buyers will be "required to comply with applicable law with respect to the treatment of customer data." Even so, data security specialists remain worried about what could potentially happen — and who might have future access — to 23andMe's genetic treasure trove.

Beyond the company's assertion that any potential buyers would be legally bound to "observe applicable privacy laws," 23andMe has also attempted to assuage user fears by claiming "any customer data it shares with other parties is anonymous and can't be traced to individual users," said CBS News. Still, concerns about its ability to protect its customers' genetic data have "swirled in recent years," said CNBC, particularly after "hackers accessed the information of nearly 7 million customers" in late 2023. That hack, which "appeared to target Jewish and Chinese customers," was followed by a drop in earnings "attributed to fewer test kits being ordered," The New York Times said.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

https://cdn.mos.cms.futurecdn.net/flexiimages/jacafc5zvs1692883516.jpg

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Privacy experts are "watching the company's challenges with concern on several fronts," said Geoffrey Fowler at The Washington Post. Not only is safeguarding against hacks like the one in 2023 "hard for any company to do under bankruptcy proceedings," but new ownership of 23andMe could choose to use your data for "new purposes" not included in the original user agreement. If that happens, "it would be on you to keep on top of the changes."

Many customers may have assumed their private genetic data is legally protected by laws such as the Health Insurance Portability and Accountability Act, commonly known as HIPAA, which "creates rules about what can be shared under what context," said I. Glenn Cohen, Harvard Law School professor and health law expert, to the Harvard Gazette. But since 23andMe is a direct-to-consumer business and not a medical provider, the law treats those clients "essentially as a consumer, not as the patient." Bankruptcy laws, on the other hand, offer "some protections, but they're not perfect." Broadly, there is a "lack of federal regulation and a cluttered mess of state privacy laws" under which 23andMe's user data is protected (or not), said TechCrunch.

Rafi Schwartz has worked as a politics writer at The Week since 2022, where he covers elections, Congress and the White House. He was previously a contributing writer with Mic focusing largely on politics, a senior writer with Splinter News, a staff writer for Fusion's news lab, and the managing editor of Heeb Magazine, a Jewish life and culture publication. Rafi's work has appeared in Rolling Stone, GOOD and The Forward, among others.