When 23andMe Went Bankrupt: Who Really Owns Your DNA?
From ancestry kits to hospital labs, the evolving debate on privacy, consent, and control of genetic data
Written by our intern, Natalie Swan, a senior at Ohio State University studying genetics. She blends deep scientific knowledge with clear, engaging imagery, and plans to pursue a career as a genetic counselor. She shares Modern Reproduction’s mission of making scientific and complex health information understandable and accessible to everyone.
A couple of months ago, the news broke that 23andMe was filing for bankruptcy, and the company’s future was largely unknown. As this occurs in business all the time, this private entity hit the public harder, as around 15 million individuals put their genetic information into the hands of this one company (3). Almost everyone knows someone close who participated in 23andMe, I know at least 3 close family members. While news sources have flooded users with information and recommendations on handling this situation, I began to wonder, how do these concerns extend to clinical genetic testing with healthcare providers?
In late March 2025, 23andMe announced its plan to sell, stating, “23andMe... has filed for Chapter 11 bankruptcy and is looking for a buyer” (3). During this time, the California Attorney General also publicly stated that people should delete their data (2). Most people’s thoughts consisted of the fear that this information could be potentially used against them in the future, or the fear of a complete lack of privacy. Those and more are completely valid concerns that, if you experienced these, I can guarantee you were not the only one.
My only challenge to this fear is the hope that people understand what 23andMe was doing with their information, even before selling the company was an option. In 2018, 23andMe entered a partnership with GSK, a publicly traded pharmaceutical and biotechnology company based in London. Anyone who had consented to research had their information sold, raking in $20 million for 23andMe (3). While these consumers did consent to participate in research, many had understood that this meant the information would remain within 23andMe’s walls. Although this example is not the same as selling, other companies have been involved in collecting the data for years now.
Privacy has always been a concern in this space. You may remember the 2018 case in which law enforcement used a program called GEDMatch to use data from relatives of the Golden State Killer to arrest him. GEDmatch enables individuals to trace their family history by combining data from multiple ancestry websites, thanks to user submissions (5). Asking questions about your privacy on these sites has always been important, not just in the last couple of months since the bankruptcy announcement.
When discussing the privacy of your genetic information online, it is crucial to be aware of the current laws in place for your protection. The two that tie into this conversation the most are the Genetic Information Nondiscrimination Act (GINA) and the Health Insurance Portability and Accountability Act (HIPAA). HIPAA is the most widely known and sets the standards for protecting health information. It was designed to allow the sharing of health information with those who need it, such as doctors, while ensuring it remains adequately protected. It protects “individually identifiable health information,” meaning any information that is linked to one’s identity (1).
The second law is the Genetic Information Nondiscrimination Act (GINA). GINA prohibits discrimination based on genetic information in employment and health insurance. Meaning an employer cannot use your genetic information against you, and health insurance companies cannot raise your rates due to it either. This law was passed in 2008 and has proven essential to the growth of the field of genetics. Of course, though, there are several exceptions. First, GINA does not cover life, disability, or long-term care insurance. There is also an exception for employers with fewer than 15 employees. Lastly, this does not apply to individuals receiving insurance through the federal government or the military (7). While both laws are essential for healthcare in our country, there is one main reason that 23andMe is not directly impacted by either: they are not a healthcare company. They are very upfront on the website that the information is not designed to provide medical information.
Now that we have covered the problems 23andMe currently faces, it is essential to discuss what is similar and different about genetic testing through 23andMe and genetic testing with a healthcare provider. When you submit your information to a hospital for healthcare services, that hospital is tied to HIPAA. 23andMe, in its terms of service, acknowledges that there is a small risk of unauthorized access to your personal information, which could expose information about family members or facilitate identification. They also state that if users elect to store their saliva sample, 23andMe may conduct “further analysis” (4).
While genetic testing in a hospital setting does offer safer conditions through legal protections, there are still important considerations to be aware of. When you undergo genetic testing through a hospital, there are often two options for how the process can proceed. Large institutions may have their in-house lab, but most hospitals send the DNA samples to be tested at a genetic testing laboratory. What happens after the genetic sample is sent out is ultimately up to each lab.
Depending on the lab and the requested testing, different standards apply. When a lab order is placed, a doctor or genetic counselor must complete a requisition form stating the desired test. For some labs, this requisition form is all they need; they do not request your signature or permission, as they assume the provider has already obtained your informed consent. Others, if they do not have your signature, will not proceed with the test until they do. 23andMe was more like the latter by requesting signed informed consent documents.
Similar to 23andMe, clinical genetic testing laboratories may also retain and utilize samples for future research. Others, will destroy any sample they have received, regardless of the circumstances, in a finite amount of time. Most labs also state that there is a small risk that information could be exposed, allowing reidentification, just as 23andMe does. While I wish there were a simple answer, the reality is that it is complicated, and each lab will have different requirements for genetic testing.
Since I began writing this post, new information has come to light. As of June 13, a deal has been made with TTAM Research Institute to acquire 23andMe (shown below). Their founder is Anne Wojcicki, the former co-founder and CEO of 23andMe. I’m not surprised, as the world of genetics moves fast, with updates all the time.
The most significant issue from my point of view is that almost nobody has the time to go through each detail written in fine print, especially when it comes to a topic that requires a level of education to fully understand and is unprecedented. The bottom line is this: none of this is your fault. Consumers should not have to carry the weight of protecting their data alone. This situation affects a deeply personal matter, and we should expect to see changes in the future. In the meantime, ask questions, and know that the weight of this conversation means that it truly matters. By engaging with posts like this one, you are helping to push these conversations forward and creating pressure that can lead to real change.
Resources:
1 (OCR), Office for Civil Rights. “Summary of the HIPAA Privacy Rule.” HHS.Gov, 14 Mar. 2025, www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html.
2 23andMe Holding Co. “23andMe Announces Collaboration Extension with a New Data Licensing Agreement with GSK.” 23andMe Investors, 8 Nov. 2023, investors.23andme.com/news-releases/news‑release‑details/23andme‑announces‑collaboration‑extension‑new‑data‑licensing. Accessed 17 July 2025.
3 “23andMe Just Filed for Bankruptcy. You Should Delete Your Data Now.” The New York Times, The New York Times, www.nytimes.com/wirecutter/reviews/23andme-data-bankrupt/.
4 23andMe. “Legal - Terms of Service.” 23andMe, www.23andme.com/legal/terms-of-service/.
5 Chamary, JV. “How Genetic Genealogy Helped Catch the Golden State Killer.” Forbes, Forbes Magazine, 12 Oct. 2022, www.forbes.com/sites/jvchamary/2020/06/30/genetic-genealogy-golden-state-killer/.
6 “Genetic Information Discrimination.” US EEOC, www.eeoc.gov/genetic-information-discrimination.
7 “The Genetic Information Nondiscrimination Act (GINA).” ASHG, 7 Apr. 2025, www.ashg.org/advocacy/gina/.
8 Hernandez, Joe. “23andMe Is Filing for Bankruptcy. Here’s What It Means for Your Genetic Data.” NPR, NPR, 25 Mar. 2025, www.npr.org/2025/03/24/nx-s1-5338622/23andme-bankruptcy-genetic-data-privacy.
9 Labcorp, www.labcorp.com/content/dam/labcorp/drupal/DX_GC_L7832-0323-6%20Genetic%20Consent.pdf.
10 Questions Related to 23andMe’s Chapter 11 Filing – 23andme Customer Care, customercare.23andme.com/hc/en-us/articles/30805135934615-Questions-related-to-23andMe-s-Chapter-11-Filing.
11 Wickenheiser, Ray A. “Forensic Genealogy, Bioethics and the Golden State Killer Case.” Forensic Science International. Synergy, U.S. National Library of Medicine, 12 July 2019, pmc.ncbi.nlm.nih.gov/articles/PMC7219171/.
* This blog constitutes general information about genetic testing and medical screening. This blog does not offer or provide medical advice or diagnosis, and nothing in this blog should be construed as medical advice or diagnosis. Do not rely on the information in this blog/article to make medical management decisions. Please consult with a medical professional before making those decisions. Do not delay in seeking professional medical advice if you think you have a medical concern. Do not disregard professional medical advice based on any information received in this blog.
