23andMe’s bankruptcy turned a privacy policy into a term of sale

The week

On March 21, 2025, California’s attorney general issued a consumer alert urging 23andMe customers to consider deleting their genetic data and withdrawing from research, citing the company’s financial distress. It is unusual for a state’s top law enforcement officer to tell consumers outright to consider pulling their information from a company. The alert was a sign of how seriously officials took the possibility that a stranger might end up holding the data.

The alert was specific. It pointed to the company’s own securities filings, which had disclosed substantial doubt about its ability to continue as a going concern. It reminded Californians of their rights under the state’s Genetic Information Privacy Act: to delete their account and genetic data, to have their biological sample destroyed, and to revoke consents they had given. It cited the California Consumer Privacy Act’s deletion right too.

Then it walked readers through the steps. Log in, open the settings page, find the data section, download a copy if wanted, and choose permanent deletion. Change the sample storage preference to have the saliva sample destroyed. Withdraw research consent in a separate section. A law enforcement office publishing a click-by-click guide to leaving a company was a measure of the concern.

Millions of people once spat into a tube, mailed it off and received a report about their ancestry and health. In March 2025, many of them were being told, in effect, to think hard about whether they wanted that sample’s results to stay on file.

On Sunday, March 23, two days after the alert, 23andMe filed for Chapter 11 bankruptcy in the Eastern District of Missouri. Chapter 11 is the part of the U.S. Bankruptcy Code that lets a struggling company keep operating under court supervision while it reorganizes or sells itself, rather than simply shutting down. The company said it would pursue a court-supervised sale of substantially all its assets. In a company like 23andMe, the most valuable of those assets was the data itself.

The mechanics were set out in a securities filing the next day. The company asked the court to approve a structured sale through a competitive auction under section 363 of the Bankruptcy Code. It arranged up to $35 million in financing to keep operating during the case, from JMB Capital Partners Lending. It warned that shareholders might receive nothing from the sale.

Co-founder Anne Wojcicki resigned as chief executive, effective with the filing, and stayed on the board. The chief financial officer, Joseph Selsavage, became interim chief executive. The company said any buyer would have to comply with applicable law in its treatment of customer data. That sentence was meant to reassure. It also raised the obvious question of which laws, enforced by whom, and how strictly.

The filing followed years of decline. 23andMe had gone public in 2021 by merging with a special-purpose acquisition company backed by Richard Branson, in a deal that valued it at about $3.5 billion. Its 2018 partnership with GSK, which brought a $300 million investment, had shown what its consented research data could be worth to a drug developer. Neither the consumer business nor drug development had produced steady profits. In September 2024, all seven of its independent directors resigned together.

Then there was the 2023 credential-stuffing breach, which exposed profile data on about 6.9 million users through the DNA Relatives feature. Credential stuffing is an attack in which criminals take usernames and passwords leaked from other websites and try them on a new site, betting that people reuse passwords. The DNA Relatives feature let customers see and be seen by genetic relatives, so access to one account revealed information about many others. Reporting at the time said the stolen data was advertised in lists singling out users of Ashkenazi Jewish and Chinese descent. The March 2025 filing said the company had agreed to pay $37.5 million to settle related claims on behalf of U.S. customers.

The alert and the filing landed in a policy gap. No federal statute specifically governed what happens to consumer genetic data when its holder is sold out of bankruptcy. The answer would have to be assembled from bankruptcy law, the FTC’s consumer protection powers and a patchwork of state statutes. Each of those had been written with other problems in mind.

By the end of the week, a consumer genetics company had become a test case for a question most organizations never consider. When a company fails, what happens to the personal data it holds, and to the promises it made when it collected that data?

The 2023 23andMe breach was a story about a sharing feature that multiplied exposure, and about health-related data that HIPAA, the federal health privacy law, does not reach. HIPAA mainly covers health care providers, health plans and the companies that work for them. A consumer genetics company selling directly to the public falls largely outside it.

The bankruptcy raised a different question. What happens to data, and to the promises made when it was collected, when the company holding it fails? Health systems, research institutions and life sciences firms all hold or share data with companies that could one day face the same process. A promising analytics startup, a research partner, a software vendor that hosts patient-derived information: any of them could run out of money.

The answer has three parts: what the promises said, who enforced them once the company was in court, and what the company’s partners could do about it. Each part has a different owner inside a typical health organization. Privacy and legal teams write the promises. Nobody owns the court process until it arrives. Vendor risk, research administration and data teams own the partnerships.

Promises, layered consent and data as an asset

Three ideas carry most of this story, and they are not especially technical.

A privacy policy is a promise. When a company collects your information, it publishes a privacy policy explaining what it will do with it. Regulators treat those statements as commitments. A company that says one thing and does another can face enforcement for misleading consumers. Most policies are written for the normal course of business, but nearly all of them include a clause about what happens if the company is sold or goes bankrupt.

Consent is layered. Agreeing to a company’s terms when you sign up is one kind of consent. Agreeing to let your data be used in scientific research is often a separate, narrower one, with its own rules about who may use the data and for what. Some laws add a third layer. Genetic data, for example, carries extra protection under state laws such as California’s Genetic Information Privacy Act, which requires consent for certain disclosures.

In bankruptcy, data is an asset. A company in Chapter 11 is trying to pay its creditors as much as possible. Everything it owns, including buildings, patents, brand names and customer data, can be sold under the supervision of a judge. The judge’s job is to balance getting the best price with respecting the rights of everyone affected, including customers.

Put those together and the problem becomes clear. A database of genetic information is worth a great deal to a buyer. But each record arrives wrapped in promises, consents and legal protections that the buyer has to honor. The value of the data and the strings attached to it are inseparable.

Which rules apply to whom

The rules that attach to health-related data depend on who holds it and how it was collected. The differences matter because a sale can move data from one regime to another.

• HIPAA applies to covered entities (most providers, health plans and clearinghouses) and to their business associates. It follows the relationship, not the data type.
• The Federal Trade Commission Act lets the FTC act against unfair or deceptive practices, including broken privacy promises. The FTC’s Health Breach Notification Rule, updated in 2024, covers many health apps and personal health record vendors that HIPAA does not.
• State genetic privacy laws, such as California’s Genetic Information Privacy Act and Illinois’s older Genetic Information Privacy Act, add consent and deletion rights. The Illinois law lets individuals sue directly.
• State consumer health data laws, led by Washington’s My Health My Data Act, require consent to collect and share consumer health data and a signed authorization to sell it.
• The Genetic Information Nondiscrimination Act limits how health insurers and employers use genetic information. It does not govern a consumer genetics company’s sale of its database.

23andMe itself showed how these regimes can coexist inside one estate. Alongside its consumer genetics service, it owned Lemonaid Health, a telehealth business that delivers care as a provider. The sale covered both. A buyer of a mixed estate inherits HIPAA obligations for one part and consumer-protection and state-law obligations for the rest.

The promises: what the policy said about a sale

Like most consumer privacy policies, 23andMe’s anticipated a merger, acquisition or bankruptcy and described customer data as something that could transfer to a successor. Customers who opted into research had signed a separate, narrower consent. And the state genetic privacy laws applied on top.

Those layers looked like boilerplate until a sale made them operative. A buyer would acquire a data set whose permitted uses differed by customer, by consent type and by state. That is hard to value and harder to integrate. A bidder cannot simply load the records into a new platform. It must carry forward every restriction attached to them, record by record.

A sensitive data set resembles a building in which every apartment has a different lease. Some tenants have rent control, some have the right to break the lease at any time, some can sublet and some cannot. The building is still valuable, but a buyer cannot treat it as an empty shell. Every lease has to be read, and the price reflects the restrictions in them. Here the leases are consent forms and the tenants are people whose DNA is in the file.

Writing the change-of-control clause

For any organization that collects health or genetic data, the practical step is to write the change-of-control language as if a judge and a state attorney general will one day read it. That means separating categories of data in the policy, saying plainly which categories can transfer and on what conditions, and keeping consent records that can be queried by customer and by data type. A promise that is vague at collection turns into a dispute at sale.

A well-drafted clause usually does four things. It names the categories that may transfer, such as account data, and those that may not without fresh consent, such as genetic data and samples. It requires any successor to adopt the existing policy for data collected under it. It promises notice to individuals before a transfer, with a window to delete. And it says what happens to data if no qualified successor emerges, such as destruction.

Each element has a cost. Excluding genetic data from automatic transfer lowers the price a buyer will pay. A notice window invites deletions that shrink the data set. Destruction as a fallback removes the option of selling to the highest bidder. Those costs are the price of a promise that will survive scrutiny. A policy that avoids them is cheaper only until a court reads it.

Consent records that can answer questions

“Queryable” deserves a moment. It means a staff member can ask the system a precise question, such as “which customers in California consented to research but not to transfer?”, and get an accurate answer in minutes. Many organizations store consent as a scanned form or a checkbox in an old system, which makes that question very hard to answer under deadline pressure.

Versioning matters as much as the answer. Privacy policies and consent forms change over the years. A customer who joined in 2012 agreed to a different text than one who joined in 2024. A consent record should store which version each person accepted and when, so the organization can honor the promise that person was actually given.

The engineering is not exotic. A consent table keyed to each person, with the consent type, version, date, jurisdiction and any withdrawal, does most of the work. The hard part is retrofitting it onto records collected before anyone thought to keep that detail.

Samples are a separate asset

Genetic testing companies, biobanks and laboratories also hold physical samples. A sample can be tested again with methods that did not exist when it was collected. It carries more future information than any single data file.

California’s alert treated sample destruction as its own step, separate from data deletion. Organizations that store samples need the same discipline for them as for data: an inventory by consent, a chain of custody, and a documented process for destruction on request. In a sale, the freezer is part of the estate too.

Deletion has limits that should be stated

Deletion promises also need to be precise about what cannot be deleted. Customers who asked 23andMe to delete their data were told that some information would be kept for a period to meet the testing laboratory’s legal obligations. Clinical laboratories and health providers face similar retention duties under federal and state rules.

A notice that promises deletion without describing those exceptions invites complaints at exactly the moment an organization can least afford them. The better practice is to say in advance what is retained, for how long, under which rule, and who can see it in the meantime.

Research consent and its paperwork

Research consent needs the same discipline. Academic medical centers and biobanks typically tie each participant’s consent to a protocol, an institutional review board approval and a data use agreement. An institutional review board is the committee that approves and oversees research involving people; a data use agreement is the contract that sets out what a recipient may do with shared data. When the data holder changes hands, each of those documents has to travel with the records. If they live in a shared drive instead of the data platform’s metadata (the descriptive information stored alongside each record), the new owner inherits obligations it cannot see.

Federally funded research adds another layer. The Common Rule, which governs most federally funded research with people, has allowed “broad consent” for future research since its 2018 revision. Broad consent is still bounded by its stated scope. A buyer who wants to use research data for a new commercial purpose must check that purpose against the consent each participant signed.

The process: who enforced the promises in court

Bankruptcy moved the promises from a private contract between the company and its customers into a public proceeding with many parties at the table. The Bankruptcy Code provides for a consumer privacy ombudsman to advise the court on sales of personal information, and the court appointed one. The ombudsman is an independent expert whose job is to look at a proposed sale from the customers’ point of view and tell the judge whether it respects their privacy.

State attorneys general and the chairman of the Federal Trade Commission, the federal agency that polices unfair and deceptive business practices, signaled early that any buyer should be held to the company’s existing commitments. Congress called company leaders to testify.

How a section 363 sale works

A sale under section 363 follows a set sequence. The company proposes bidding procedures, which the court approves. Bidders submit offers by a deadline, and the company may hold an auction among qualified bidders. The court then holds a sale hearing, where objectors can be heard, before approving the winning bid.

Personal information has its own rule. Section 363(b)(1) says that if a company’s privacy policy prohibits transferring personal information to outsiders, the company may not sell it unless the sale is consistent with the policy. The alternative route requires appointing an ombudsman and a court finding that the sale would not violate applicable law outside bankruptcy.

23andMe’s policy, like most, contemplated transfer in a sale. That narrowed the bankruptcy-law argument and moved the fight to state law and consent. The states’ position was that genetic data required each customer’s express consent before sale, whatever the policy said. The bankruptcy court became the place where that state-law argument was heard.

Precedents that pointed the same way

The issue was not new. In 2000, the FTC challenged the sale of customer data by Toysmart, a bankrupt online toy retailer whose policy had promised not to share it. In the end, the data was destroyed rather than sold. In 2015, RadioShack’s bankruptcy drew objections from the FTC and state attorneys general over its customer files, and the data sold was narrowed.

Those cases involved purchase histories and email addresses. 23andMe involved genetic data, which cannot be changed once exposed and which reveals information about relatives who never signed up. The stakes were higher, and the cast of objectors larger.

National security joins the conditions

A newer condition entered the picture in 2025. The Justice Department’s rule restricting bulk transfers of sensitive personal data to countries of concern took effect on April 8, 2025. It covers human genomic data, among other categories, and it prohibits or restricts transactions that would give entities linked to those countries access to it. The House Oversight hearing in June framed the sale partly as a national security question.

For any organization holding genetic or other “omic” data, a buyer’s ownership and investors now affect whether a transfer is lawful at all. Diligence on a buyer, or on a research partner, has to include who stands behind it.

How restrictions turned into price

Each of these actors could influence price and timing. The ombudsman’s report could shape what the court approved. Objecting states could delay a sale. Bidders had to decide how much of the data’s value would survive the conditions the court was likely to impose. In effect, the privacy policy was being repriced in public, by people who had never been party to it.

The second-order effect matters most. In a distressed sale, the value of a sensitive data set is its commercial potential minus the restrictions attached to it. Those restrictions are set by regulators during the sale, not by the company in advance. An organization that relies on data held elsewhere cannot assume the data will stay where it is, or that its future owner will use it as the original holder did.

Deletion requests shrink the asset during the sale itself. Every customer who follows an alert like California’s removes a record from what bidders are buying. A seller that cannot predict how many customers will leave cannot predict what it is selling.

There is also a reputational dimension that no contract fully captures. Once the story reached the news, customers, legislators and regulators formed views quickly. Any organization whose name was attached to that data, as a partner, a research collaborator or a referral source, could find itself answering questions it had never prepared for.

Security while the case runs

A company in Chapter 11 keeps operating, and it keeps holding the data. That period carries its own risk. Staff leave, budgets tighten and attention moves to the sale. Security monitoring, patching and access reviews can slip just as the data draws the most attention from criminals and the press.

Partners and regulators have an interest in the data’s security during the case, as well as in who buys it. A partner with audit rights should consider using them early. A state regulator can ask the court for assurances. A buyer will also want evidence that nothing leaked between the filing and the closing, because a breach in that window becomes the buyer’s problem.

The case that the system worked

A fair counter-argument says the process did its job. A court, an ombudsman, states and Congress scrutinized the sale, and the buyer committed to honor the existing policies. On that view, partners had little to fear.

The answer is that 23andMe was famous. Its sale drew national coverage, a congressional hearing and dozens of attorneys general. A small analytics vendor holding a few hospitals’ patient-derived data would draw none of that. Its data could change hands with little public attention. The protections that worked for 23andMe’s customers were partly a product of its fame, and partners of obscure companies cannot count on them.

The partners: what counterparties of a failing data holder can do

The hardest position belongs to partners. Suppose a regional health system sends patient-derived data to a startup for analytics. The startup builds dashboards that help the health system predict hospital readmissions. The work is valuable, and the startup holds a copy of several years of de-identified and partly identified patient data on its own servers. Two years in, the startup’s funding dries up. A biobank that shares samples with a research company, or a drug maker that licenses a data set, faces the same risk. If the counterparty enters bankruptcy, the data it holds may become part of the estate, the pool of assets a court oversees.

Why the insolvency clause disappoints

Many contracts try to solve this with a clause that ends the agreement and requires data return if the partner becomes insolvent. Counsel should review whether such clauses will work. Bankruptcy law generally limits clauses that terminate a contract solely because a party has filed. So the clause many organizations rely on may be the one least likely to hold when it is needed. Protections that act earlier, or that keep the data out of the partner’s hands to begin with, are more dependable.

The automatic stay adds a second obstacle. When a company files, most actions to collect from it or take property from it stop. A partner that wants its data back generally has to ask the bankruptcy court for permission. That takes time and lawyers, during the period when the debtor’s staff may be leaving.

The HIPAA business associate agreement offers some help for identifiable data. HIPAA requires these agreements to oblige the vendor to return or destroy protected health information at termination, where feasible. That obligation is a regulatory requirement, which strengthens a covered entity’s hand. It does not follow de-identified data, which falls outside HIPAA once properly de-identified. Many analytics partnerships run largely on de-identified data, so the contract terms are what protect it.

Three design choices that act earlier

Three design choices do that.

First, give partners access, not copies. A controlled analytics environment or data clean room, operated by the data owner, lets a partner run its analysis on the data without ever taking the data away. If the partner fails, there is nothing of yours on its servers to sell.

Second, write data use agreements as licenses with deletion rights exercisable on notice at any time, and exercise them when warning signs appear. A right that can be used only after a bankruptcy filing may arrive too late. A right that can be used whenever the owner chooses can be used early.

Third, assign someone, often in vendor risk or finance, to watch the financial health of data partners. Going-concern warnings (an auditor’s statement that a company may not survive the coming year), exchange delisting notices and sudden layoffs are public signals. Each should trigger a review of what data the partner holds and whether to recall it.

Each choice needs a verification step. Access-only arrangements should be checked for exports, since analysts often download extracts for convenience. Deletion rights should come with a certificate of destruction and, for important partners, the right to audit it. Financial monitoring should cover private companies too, through news of layoffs, missed payments or a sudden change in leadership.

A recall playbook, written in advance

When a warning sign appears, the order of steps matters. A short playbook, agreed with counsel before it is needed, keeps the response from stalling.

1. Confirm from the inventory exactly what data the partner holds, under which agreement, and where it is stored.
2. Shut off ongoing feeds and revoke the partner’s credentials to your systems, so no new data leaves.
3. Invoke the deletion or return right in writing, and ask for a certificate of destruction by a set date.
4. Preserve your own records of what was shared and when, in case notification or litigation follows.
5. Brief the privacy officer, communications team and any research oversight body that approved the sharing.

Each step is easier before a filing than after. Once the automatic stay applies, the second and fourth steps remain in your control, but the third may need the court’s permission.

Derived data and trained models

Analytics and artificial intelligence partnerships raise a further question. A partner may have built features, risk scores or a trained model from the data. Deleting the source records does not delete what was derived from them.

Data agreements should say who owns derived data and models, whether they must be destroyed with the source data, and whether they may be sold. A partner whose most valuable asset is a model trained on your patients’ records has something a bankruptcy buyer will want. If the agreement is silent, that question will be decided by the court rather than by the parties.

How it differs by type of organization

A health system’s main exposure is patient data shared with vendors and analytics firms. Most of that runs under business associate agreements, which helps for identifiable data. The gap is in de-identified extracts and pilot projects that never went through the full contracting process.

An academic medical center or biobank shares data and samples with research collaborators under data use and material transfer agreements. Its constraints come from consent forms, institutional review boards and funders. Its weakness is usually the paperwork trail, which may not tell it where every copy went.

A life sciences company more often licenses data in, from a consumer genetics firm, a registry or a data broker. Its risk runs the other way. If the licensor fails, the license itself may be rejected or sold. The Bankruptcy Code gives licensees of certain intellectual property some protection when a licensor rejects a license. Whether a particular data license qualifies is a question for counsel.

A health plan sits somewhere between these cases. It shares member data with care management, pharmacy benefit and analytics vendors, nearly all under business associate agreements. Its exposure is concentrated in a few large vendors, which makes monitoring easier. It also means one vendor failure could touch most of its members at once.

These choices carry costs. Clean rooms limit what partners can build. Frequent deletion requests strain relationships with small vendors. Research collaborations slow down when data never leaves the owner’s environment. Those costs are lower than finding that a partner’s most valuable asset in bankruptcy is your patients’ data.

Trust, price, regulators and partnership strategy

In bankruptcy, 23andMe’s genetic database became an asset for sale. For any organization holding health data, that puts four things at stake: trust, price, regulators and strategy.

Customers and patients. People who share health or genetic information do so on trust. They rarely read the privacy policy, but they assume the organization they gave their data to will keep looking after it. When that assumption breaks, the damage is not confined to the company that failed. Hospitals, clinics and research programs that referred people, or collaborated with the failed company, can find their own reputations bruised.

Money. Sensitive data is often one of the most valuable things an organization holds, and one of the hardest to value. Executives who negotiate data partnerships, licensing deals or acquisitions should understand that the price of a data set depends on the promises attached to it. Regulators may tighten those promises at the worst possible moment.

The same logic applies when a health organization is the buyer. Acquiring a digital health company, a physician group or a research firm means acquiring its data and its promises. Diligence should include the target’s privacy policies by version, its consent records, its data sharing agreements and its security history. A data set that cannot be used as planned is worth less than the deal model assumed.

Regulators. The 23andMe sale drew in state attorneys general, the Federal Trade Commission’s chairman, a court-appointed ombudsman and Congress. Any organization that holds health-related data should assume a similar cast would appear in its own crisis, and that each would read its documents closely.

Strategy. Many health systems and research institutions are actively looking for partners to help them get more value from their data, through analytics, artificial intelligence or research collaborations. That is a reasonable ambition. The 23andMe episode is a reminder to design those partnerships with the partner’s possible failure in mind from the very first contract, not as an afterthought.

Return to the hypothetical health system. Suppose its agreement had given the startup access to a clean room rather than a copy, with a deletion right the health system could use on notice. The startup’s collapse would then have been an inconvenience: a dashboard to rebuild with another vendor. Without those choices, it becomes a legal, regulatory and reputational problem that the health system does not control.

Who owns the program

The work crosses departments that rarely plan together. The privacy officer owns notices and consents. The general counsel owns contract terms. Vendor risk owns partner monitoring. Research administration owns data use agreements. The data platform team owns where the copies live.

A practical arrangement gives one executive, often the chief privacy officer or chief data officer, responsibility for an inventory of outbound data sharing. Each entry lists the partner, the data, the agreement, the deletion right and the date it was last confirmed. The inventory is the document a general counsel will want on the first day a partner’s trouble becomes public.

Three numbers make the program visible to a board or audit committee. The first is how many outside parties hold copies of sensitive data. The second is the share of those arrangements with a deletion right usable on notice. The third is the share confirmed in the past twelve months, by certificate or audit. If the first number falls and the other two rise, the exposure is shrinking.

What a prepared data holder has in place

An organization that has absorbed the 23andMe story tends to have a few things in place.

• A current inventory of every outside party that holds a copy of its sensitive data, what that data is and under which agreement.
• Privacy notices and research consents that distinguish categories of data and say plainly what happens to each in a sale or bankruptcy.
• Consent records stored in a way that can be searched by person, data type and policy version, rather than simply filed.
• An inventory of stored biological samples tied to consent, with a tested destruction process.
• A default of access over copies for analytics and research partners.
• Contract language, reviewed by counsel, that gives the organization deletion rights it can use at any time and covers derived data and models.
• A named owner who monitors partners’ financial health and has a playbook for recalling data.

The failures mirror those strengths.

• Treating privacy notices as marketing copy. They are promises, and in a crisis they will be read by judges and attorneys general as well as customers.
• Relying on an insolvency clause alone. As noted above, clauses triggered solely by a bankruptcy filing may not hold.
• Losing track of copies. Data shared for a pilot project years ago, with a vendor that has since been acquired twice, is often the copy nobody remembers.
• Keeping research paperwork separate from the data. If consent forms and approvals live in a different system from the records they govern, honoring them during a transfer becomes guesswork.
• Assuming de-identified means safe. De-identified data leaves HIPAA behind, and only the contract governs what happens to it next.
• Waiting for a filing to act. By the time a partner is in court, the data is already part of a process the organization does not control.

Where our data sits if a partner fails

1. Which outside companies hold copies of our patient, member or research data today, and how many of them are small or venture-funded firms that could fail?
2. What do our own privacy notices and consents say would happen to people’s data if we were sold or went bankrupt, and would we be comfortable reading that aloud in court?
3. Have our lawyers reviewed whether the termination and data-return clauses in our data agreements would actually work if a partner filed for bankruptcy?
4. Do our agreements let us require deletion at any time, on notice, and have we ever tested that right?
5. Who watches the financial health of our data partners, and what would make them sound the alarm?

With hindsight

The sale ran through the spring, and it unfolded in public, with many hands on the outcome.

After a May auction, Regeneron agreed to buy the assets for $256 million. TTAM Research Institute, a nonprofit led by Anne Wojcicki, then bid $305 million, the company reopened bidding, and TTAM won the final round on June 13. The court approved the sale on June 27, 2025. TTAM committed to honor existing privacy policies, to let customers delete their data and opt out of research, and to adopt further safeguards.

The company’s announcement of court approval described TTAM’s commitment to the existing privacy policies as one that would last in perpetuity. It said every customer would receive an email notice of the sale before closing. The assets sold included the consumer genetics service, the research business and Lemonaid Health, the telehealth unit. TTAM completed the acquisition in July 2025.

The pressure came from several directions at once. In June, 27 states and the District of Columbia had sued to block a sale of genetic data without consent. New York’s attorney general, who announced the suit on June 10, said the company could not auction the genetic information of about 15 million customers without their express, informed consent. The House Oversight Committee questioned Wojcicki and the interim chief executive at a hearing on June 10. Its title framed the sale as a matter of national security as well as privacy. Not one of these parties had signed the original privacy policy, yet each had a hand in deciding what it would mean in practice.

The 2023 breach also caught up with the company abroad. In June 2025, the United Kingdom’s Information Commissioner’s Office fined 23andMe £2.31 million over the breach. It cited failures including the lack of adequate multifactor authentication. The breach and the bankruptcy had been separate stories in 2023. By 2025 they were one: a company weakened by a security failure had to sell data whose security customers no longer trusted.

The rules also shifted while the case ran. The Justice Department’s rule on bulk transfers of sensitive personal data took effect on April 8, 2025, two weeks after the filing. It added a national security test that any transfer of genomic data has to pass, whatever a privacy policy says. Future sales of genetic data sets will be judged by who controls the buyer as well as by what it promises.

Deletion turned out to be part of the price. California’s alert, and similar guidance from other states, told customers how to leave before any bidder took control. Every customer who did so removed a record from the asset being sold. A data set marketed under public scrutiny shrinks while it is on the market.

The episode confirmed that, in insolvency, privacy commitments are enforced by courts and states rather than by the company that wrote them. The company that made the promises was no longer in a position to decide how they would be kept. That job passed to a judge, an ombudsman, attorneys general and the winning bidder.

One part of the original worry did not come true. The data did not pass to a stranger. It went to a nonprofit led by the company’s co-founder, which adopted the existing policies. That outcome was reassuring for customers, but it was contingent. It depended on a founder willing and able to outbid a large drug company. Other failing data holders will not have one.

Two points stand out. First, data with strong legal and public sensitivity does not behave like an ordinary asset in a sale. Its value is shaped by the conditions others attach to it, and those conditions are set late, under scrutiny. Second, the organizations best placed in a partner’s collapse are those that never handed over copies in the first place, or that wrote, and used, the right to take them back. Both are decisions made long before any company runs into trouble, and both are far cheaper to make in calm conditions than in the middle of someone else’s court case.