SouthernWorldwide.com – As 23andMe, a prominent genetic testing company, filed for bankruptcy on March 23, 2025, immediate and widespread concerns arose regarding the fate of the vast personal information stored in its genetic and health data database. Shortly after, a U.S. judge permitted the company to sell its consumer data as part of the bankruptcy proceedings.
Attorneys general from several states issued warnings to their residents, urging them to delete their genetic data. California specifically advised its citizens to request 23andMe delete their data and destroy their spit samples. Michigan’s attorney general released a statement emphasizing that “23andMe collects and stores some of the most sensitive personal information, our genetic code.”
When customers initially signed up for 23andMe, they agreed to terms and conditions and a privacy notice. This agreement allowed the company to utilize their information for research and development, and to share aggregated data with third parties. Customers who consented to additional research also allowed their individual information to be shared with third parties. 23andMe had also clearly stated that in the event of bankruptcy or asset sale, consumer information might be sold or transferred.
Despite 23andMe having previously informed customers about these possibilities, many remain surprised and concerned by the current situation.
The author, a lawyer and bioethicist, has been studying direct-to-consumer genetic testing for nearly a decade. Understanding the types of information 23andMe has been collecting and how it might be used if sold or shared can help clarify consumer concerns.
What is 23andMe?
Founded in 2007, 23andMe, named after the 23 pairs of chromosomes in human cells, was among the first direct-to-consumer genetic testing companies in the United States. Its significant backing from Google attracted substantial interest from other investors, enabling 23andMe to thrive while many other similar companies ceased operations.
The direct-to-consumer business model involves customers ordering a genetic test kit online, submitting a saliva sample, and then accessing their results via an online portal. Over 15 million consumers purchased 23andMe kits, with the vast majority consenting to its research initiatives. At its peak, the company was valued at $6 billion.
While the market initially recognized the value of 23andMe’s business model, its stock has experienced a prolonged decline, and the company owes hundreds of millions of dollars to creditors.
Factors contributing to this sharp downturn include a decrease in test kit sales following a 2023 hack that compromised the data of nearly 7 million individuals. Additionally, the company failed to generate sufficient profits from providing data access to other private sector entities. The limited private interest in 23andMe’s data may stem from the fact that much of the information collected is self-reported, which is often considered less reliable than data documented in a medical record by a physician.
What kind of data does 23andMe collect?
While the adage “If you’re not paying, you’re the product” often applies, 23andMe managed to engage consumers as both paying customers and the product itself. This was achieved by selling genetic testing kits while simultaneously collecting a massive amount of their valuable data.
23andMe collected more than just genetic data derived from customer saliva samples. Eighty-five percent of customers consented to 23andMe’s research, allowing their individual-level data to be used in studies. The company then gathered information from survey questions covering personal health and other aspects of life, such as drinking habits and risk tolerance.
This means that 23andMe not only possesses the genetic data of 15 million individuals but also holds nearly a billion additional data points linked to this genetic information. This makes the 23andMe dataset potentially highly private and extremely valuable.
Read more : Asteroid Apophis, as large as the Eiffel Tower, to approach Earth in 2029, NASA reports
Initially, drug companies appeared to agree on this value. For instance, in 2018, 23andMe granted GlaxoSmithKline an exclusive license to use consented customer data for developing new drugs. GlaxoSmithKline also made a $300 million equity investment in 23andMe. When 23andMe went public in 2021, its $6 billion valuation reflected the promise of this business model.
However, for over a decade, scholars, including the author, have cautioned that allowing 23andMe to collect and utilize personal data was not something customers fully comprehended or were entirely comfortable with.
What should 23andMe customers worry about?
In response to current public concern regarding data privacy, 23andMe has stated that there will be no changes to its data storage and protection practices during its bankruptcy proceedings. However, once these proceedings conclude, what specific concerns should customers have?
Firstly, law enforcement agencies could potentially use genetic information in civil or criminal cases. This scenario occurred in 2018 when police utilized the genetic testing company GEDmatch to help identify the Golden State Killer. Law enforcement posed as customers seeking genealogy data and submitted an old crime scene blood sample. This allowed them to link the sample to known suspects through relatives who had provided their genetic information to the company as consumers. Although this action violated GEDmatch’s policies, the evidence was successfully used in court.
Secondly, genetic information could be used to discriminate against customers if it indicates they have or are at high risk of developing a genetic disease or disorder. The federal Genetic Information Nondiscrimination Act (GINA) prohibits health insurers and employers from requesting genetic information or using it for discrimination in employment or health insurance decisions. However, it does not offer protection against discrimination in long-term care or life insurance.
Many warnings from the media and attorneys general focus on genetic information due to its unique nature. However, direct-to-consumer genetic testing companies also retain a substantial amount of personal information from the surveys customers complete. Much of this information could be embarrassing if inadvertently or intentionally disclosed, such as details about a person’s intelligence.
In the 2025 book “Careless People,” former Meta executive Sarah Wynn-Williams reported that Facebook used indicators of self-consciousness about personal appearance, like deleting a selfie, to promote beauty products. If companies possess such intimate personal details, this information could be used not only for product sales but also to potentially manipulate individuals through social media or the internet in ways they may not realize. It could be employed for targeted advertising or to develop algorithms that exploit a person’s vulnerabilities.
The author believes that consumers are justified in their concerns about the potential misuse of their genetic data. However, the survey data, containing a wide array of other personal information, presents an equally, if not more significant, privacy problem. This is particularly concerning if the data is combined with other publicly available information, such as a dating profile, to construct a more detailed and personal profile of an individual.
The author is proceeding with deleting their own 23andMe data. In the future, they would advise consumers against freely providing the private sector with information about their fears, hopes, limitations, and successes.
That information holds value for more individuals than just the consumer.
