Consumers have been trading their DNA for a personal genetic history lesson with 23andMe since 2007.
The company has since become extremely popular and has collected a trove of genetic information relating to more than 14 million people. But in March 2025, 23andMe filed for Chapter 11 bankruptcy due to ongoing financial struggles and data privacy concerns after the company experienced a major data breach involving approximately 6.9 million customers and resulting in a $30 million settlement.
Now, the company and its assets could potentially be sold to an entity that has a different agenda for millions of individuals’ genetic information. In that event, genetic information could be used for research on genetic diseases, identification of individuals in law enforcement actions, and other applications that consumers may not have contemplated when they provided their genetic information to 23andMe.
The fate of 23andMe raises questions such as what laws, if any, protect this information, and what can customers do to protect their data?
Data privacy laws
All 50 states have data breach notification laws that require data owners to notify individuals if certain personal information was subject to unauthorized access or acquisition. However, the acquisition of data through the sale of a bankruptcy estate does not mean that the acquisition of data is unauthorized. It is likely that the bankruptcy estate would be considered the “owner” of the data with authorization to sell it without the consent of the individuals who provided the data. And, in turn, the buyer’s subsequent use of the data would be “authorized.”
It should also be noted that states define personal information differently, and only a small number of states protect biometric information such as genetic information. State laws generally do not govern the processing of the data. Thus, in the event that the acquirer of the data experiences a data breach, 23andMe, or a future acquirer, may be required to inform individuals of a breach but will not necessarily be required to disclose how their information is being used.
Federal laws also do not offer much help here. The Health Insurance Portability and Accountability Act applies only to certain types of health care entities and their vendors. 23andMe, or a subsequent purchaser, is not likely to fall under this classification. Further, to qualify as protected health information under HIPAA, the information generally needs to be transmitted electronically and related to a person’s health condition, or to the provision of, or payment for the provision of, health care. Therefore, data collected by 23andMe would not qualify as protected health information. Although the federal Genetic Information Nondiscrimination Act prohibits employers and health insurance companies from discriminating based on an individual’s genetic information, among other things, it presumably would not protect against other uses of the information.
What can 23andMe customers do?
Currently, customers are still able to delete their data and profiles from 23andMe. Customers should also consider requesting destruction of their saliva samples and cancellation of any further use of their genetic information. Additionally, it is a best practice to review the privacy policies of companies to which consumers divulge personal information. Privacy policies typically explain what third parties, if any, will receive the information and how the information is processed.
The Constangy Cyber Team assists businesses of all sizes and industries with compliance needs. If you would like additional information about state or federal data privacy laws, please contact us at cyber@constangy.com.
Associate AttorneyAs part of the rapid response team, Matthew guides clients through ransomware attacks, business email compromises, and other forms of cybercrime. He coordinates digital forensics, network restoration, and other resources to ...
PartnerHe brings over ten years of combined incident response and risk management experience to his role on our Rapid Response Team. During the seven years prior to joining the Constangy Cyber Team, Matt worked at a boutique incident ...
The Constangy Cyber Advisor posts regular updates on legislative developments, data privacy, and information security trends. Our blog posts are informed through the Constangy Cyber Team's experience managing thousands of data breaches, providing robust compliance advisory services, and consultation on complex data privacy and security litigation.
