23andMe Holding Co. (“23andMe”), a personal genomics and biotechnology company, has provided consumer genetic testing for nearly 20 years. On March 23, 2025, the company announced that it had “initiated voluntary Chapter 11 proceedings in the U.S. Bankruptcy Court for the Eastern District of Missouri…to facilitate a sale process to maximize the value of its business.” According to its Privacy Statement, if 23andMe is “involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, [consumers] Personal Information may be accessed, sold or transferred as part of that transaction.” Days after the filing, the bankruptcy judge ruled that the company has the right to sell the medical and ancestry records of its 15 million customers, its most valuable asset.

Mark Jensen, Chair of the 23andMe Board of Directors, assured that the company remains “committed to continuing to safeguard customer data” and will remain “transparent about the management of user data going forward.” In fact, 23andMe’s 2023 security breach in which hackers gained access to the personal data of nearly 7 million customers is a major reason for the company’s declining value, precipitating the bankruptcy. The company’s ability to protect consumer information during its bankruptcy proceeding may increase the risk of further consumer data exposure.

California Attorney General Rob Bonta has urged 23andMe’s California customers to delete their sensitive genetic information from the platform. According to Bonta, California’s “robust privacy laws,” including the Genetic Information Privacy Act (“GIPA”) and California Consumer Privacy Act (“CCPA”), empower consumers “to take control and request that a company delete their genetic data.” Under GIPA, Californians may “delete their [23andMe] account and genetic data and have their biological sample destroyed.” GIPA also “permits California consumers to revoke consent that they provided a genetic testing company to collect, use, and disclose genetic data and to store biological samples after the initial testing has been completed.” Similarly, under the CCPA, Californians have the right to delete personal information, including genetic data, from businesses that collect personal information from the consumer. Several other state Attorneys General, including California, Connecticut and Virginia, have issued consumer alerts based on their state’s privacy laws, and on March 31, the Federal Trade Commission (“FTC”) issued letters to U.S. bankruptcy trustees stressing potential risks to sensitive consumer information to U.S. bankruptcy trustees.

Privacy advocates have also recommended that 23andMe consumers delete their data prior to a sale. While 23andMe’s Privacy Statement states that the company will not “voluntarily share” consumers’ Personal Information with “public databases,” “insurance companies or employers,” or “law enforcement, absent a valid court order, subpoena, or search warrant…,” the policy also states that it can be changed at will. The identity and intentions of 23andMe’s potential buyer raise significant privacy concerns. Although any buyer will be required to comply with applicable law with respect to the treatment of customer data, 23andMe’s new owner may acquire consumers’ genetic information and use it for purposes a consumer did not anticipate. When signing up for its services, customers accepted Terms and Conditions and a Privacy Policy permitting the company to use their DNA data for research and development, and to share their data in aggregate with third parties. 23andMe’s new owner could revise the company’s existing practices and privacy policy, and the onus would be on consumers to keep up to date on such changes. Ginny Fahs, director of product R&D for Consumer Reports’ Innovation Lab, advised that consumers’ DNA data may be used in part to determine one’s predisposition to certain diseases – one of 23andMe’s key offerings. This is crucial, however, because “[i]f the data makes its way to certain insurers, they may deny you coverage or charge you more for life, disability, or long-term care insurance because of your genetics.”

As 23andMe navigates its bankruptcy proceedings, Lutzker & Lutzker echoes the prevailing advice that 23andMe users consider deleting their genetic information from the platform. Guidance on the deletion process on 23andMe’s website can be found here.