A Bankrupt 23andMe Could Soon Sell Your Most Personal Data

As soon arsenic the familial investigating institution 23andMe filed for bankruptcy connected March 23, 2025, concerns astir what would hap to the idiosyncratic accusation contained successful its monolithic familial and wellness accusation database were swift and widespread. A fewer days after, a U.S. justice ruled that the institution could sell its user data arsenic portion of the bankruptcy.

The attorneys wide of respective states warned their citizens to delete their familial data. California urged its citizens to petition that 23andMe delete their information and destruct their spit samples. Michigan’s lawyer wide released a statement informing that “23andMe collects and stores immoderate of the astir delicate idiosyncratic information, our familial code.”

When customers primitively signed up for 23andMe, they agreed to terms and conditions and a privateness notice that allows the institution to usage their accusation for probe and improvement arsenic good arsenic stock their data, successful aggregate, with 3rd parties. If consumers consented to further research, which the immense bulk did, the institution tin additionally stock their idiosyncratic accusation with 3rd parties. 23andMe has besides been wide that if it is progressive successful a bankruptcy oregon merchantability of assets, user accusation might beryllium sold oregon transferred.

While 23andMe has warned customers each on astir everything that is presently happening, galore are inactive surprised and concerned.

I’m a lawyer and bioethicist who has been studying direct-to-consumer familial investigating for astir a decade. Understanding what accusation 23andMe has been collecting, and however it mightiness beryllium utilized if sold oregon shared, tin assistance clarify concerns for consumers.

What is 23andMe?

In 2007, 23andMe, named aft the 23 pairs of chromosomes recovered successful a quality cell, was 1 of the first direct-to-consumer familial investigating companies to unfastened successful the United States. It was backed by a ample concern by Google, which rapidly attracted the interest of different investors, allowing 23andMe to thrive erstwhile galore different direct-to-consumer familial companies went rapidly out of business.

The direct-to-consumer concern exemplary is reasonably straightforward: A user orders a familial trial kit online, spits into a conduit that comes successful the mail, returns it to the institution and accesses their results successful an online portal. Over 15 cardinal consumers bought 23andMe, and the immense bulk consented to its research. At its peak, the institution was valued astatine US$6 billion.

While the marketplace initially believed successful the worth of 23andMe’s concern model, its banal has been in diminution for years, and the institution owes hundreds of millions of dollars to creditors.

Reasons for this accelerated diminution see a alteration successful the merchantability of trial kits aft a 2023 hack of astir 7 cardinal people’s data, arsenic good arsenic a nonaccomplishment to nett capable from providing information entree to different backstage assemblage companies. Lack of backstage involvement successful 23andMe information whitethorn beryllium related to the information that overmuch of the accusation the institution collects is self-reported, which is often considered little reliable than accusation written down by a doc successful a aesculapian record.

What benignant of information does 23andMe collect?

While the saying goes “If you’re not paying, you’re the product,” 23andMe managed to person its consumers to some wage for AND beryllium the product. It did this by selling familial investigating kits to consumers arsenic good arsenic collecting a monolithic magnitude of their invaluable data.

And 23andMe collected much than conscionable familial information generated from consumers’ spit. Eighty-five percent of customers consented to 23andMe research, allowing their individual-level information to beryllium utilized for studies. The institution past collected accusation from survey questions astir their idiosyncratic wellness and beyond, specified arsenic drinking habits and risk tolerance.

This means that not lone does 23andMe person the genetic information of 15 cardinal people, but it besides possesses astir a cardinal further information points associated with this familial information. This makes the 23andMe dataset perchance precise backstage – and precise valuable.

At first, cause companies seemed to agree. For example, successful 2018, 23andMe granted pharmaceutical institution GlaxoSmithKline an exclusive license to usage consented lawsuit information to make caller drugs. GlaxoSmithKline besides made a $300 cardinal equity concern successful 23andMe. When 23andMe went nationalist successful 2021, its $6 cardinal valuation reflected the committedness of this concern model.

But for implicit a decade, scholars, including me, person been informing that allowing 23andMe to cod and usage idiosyncratic information was not 1 that customers afloat understood, oregon were really comfy with.

What should 23andMe customers interest about?

In effect to existent nationalist interest astir information privacy, 23andMe has stated that determination volition beryllium no changes to however it stores and protects data during its bankruptcy proceedings. But erstwhile that signifier is through, what precisely should customers interest about?

First, instrumentality enforcement could usage familial accusation successful civilian oregon transgression cases. This happened successful 2018, erstwhile constabulary utilized the familial investigating institution GEDmatch to assistance identify the Golden State Killer. Police pretended they were customers looking for genealogy information and sent successful an old transgression country humor spot. This allowed them to link to known suspects with humor relatives who had fixed their familial accusation to the institution arsenic consumers. While this was successful usurpation of GEDmatch’s ain policies, the grounds was successfully utilized successful court.

Second, familial accusation could beryllium utilized to discriminate against customers if it shows that they person oregon are astatine precocious hazard of processing a familial illness oregon disorder. The national Genetic Information Nondiscrimination Act prohibits wellness insurers and employers from asking astir familial accusation oregon utilizing it to discriminate successful enactment oregon wellness security decisions. It does not, however, support against favoritism successful semipermanent attraction oregon beingness insurance.

Many of the warnings from the media and attorneys wide are focused connected familial accusation due to the fact that it is unsocial to lone 1 person. But direct-to-consumer familial investigating companies besides clasp a monolithic magnitude of idiosyncratic accusation from the surveys consumers are asked to complete. Much of this accusation could beryllium embarrassing if it were inadvertently oregon intentionally revealed, specified arsenic a person’s intelligence.

In the 2025 publication “Careless People,” erstwhile Meta enforcement Sarah Wynn-Williams reported that Facebook would usage indications of self-consciousness astir idiosyncratic appearance, specified arsenic deleting a selfie, to beforehand quality products. If companies cognize specified intimate details astir a person, they could not lone beryllium utilized to merchantability products, but besides perchance manipulate them implicit societal media oregon the net successful ways they bash not adjacent realize. It could beryllium utilized for targeted advertizing oregon to physique algorithms that exploit a person’s vulnerabilities.

I judge consumers are close to beryllium disquieted astir however their familial information could beryllium misused. But the survey information containing each sorts of different idiosyncratic accusation are astatine slightest arsenic much, if not more, of a privacy problem. This is peculiarly concerning if the information is pooled unneurotic with different information disposable connected the internet, similar a dating profile, to make a much elaborate – and idiosyncratic – representation of an individual.

I americium deleting my ain 23andMe data. In the future, I would besides pass consumers against freely gifting the backstage assemblage with accusation astir their fears, hopes, limitations and successes.

That accusation is invaluable to much radical than conscionable you.

Kayte Spector-Bagdady, Associate Professor of Obstetrics and Gynecology, University of Michigan. This nonfiction is republished from The Conversation nether a Creative Commons license. Read the original article.