The 23andMe Bankruptcy Threatens 14 Million Genetic Profiles: Who Gets Your DNA Data?
23andMe's financial collapse has placed the genetic data of approximately 14 million customers at unprecedented risk. As the company explores bankruptcy options, its genetic database representing the most intimate biological information possible becomes a potential asset for sale. Our investigation reveals that while 23andMe has pledged to protect customer data, its privacy policy explicitly allows data transfer to acquiring entities, and federal law provides no specific protection for consumer genetic data outside of employment and health insurance contexts. The investigation examines who might acquire this data, what they could do with it, and why every 23andMe customer should consider requesting data deletion before it is too late.
The Value of Genetic Data
DNA data is the most permanent and personal information that exists. Unlike a password or credit card number, genetic information cannot be changed if compromised. 23andMe's database of 14 million genetic profiles is estimated to be worth $1-5 billion based on comparable pharmaceutical and research data deals. The company has already monetized its database through partnerships with GlaxoSmithKline, which paid $300 million for access to 23andMe's data for drug discovery research. In bankruptcy proceedings, this database becomes an asset that creditors may seek to monetize. Potential acquirers include pharmaceutical companies seeking genetic research populations, insurance companies interested in genetic risk profiling, data brokers seeking to add genetic information to consumer profiles, and foreign entities including sovereign wealth funds. Each of these scenarios presents distinct risks to customer privacy and wellbeing that existing legal frameworks are inadequate to address.
The Legal Protection Gap
Federal genetic privacy protections are surprisingly limited. The Genetic Information Nondiscrimination Act prohibits the use of genetic information in employment decisions and health insurance underwriting, but does not cover life insurance, disability insurance, or long-term care insurance. This means that genetic data revealing predispositions to cancer, Alzheimer's, or other conditions could be used by life insurers to deny coverage or increase premiums. No federal law specifically prevents the sale of genetic data as a corporate asset in bankruptcy. 23andMe's privacy policy states that in the event of a merger, acquisition, or bankruptcy, customer information may be shared with the acquiring entity. California's CCPA provides some protections for California residents, and a handful of states have enacted genetic privacy laws. But for most Americans, their most intimate biological data has fewer legal protections than their cable TV viewing history.
The Broader Genetic Privacy Crisis
The 23andMe situation is the most visible manifestation of a broader genetic privacy crisis. Over 40 million Americans have submitted DNA to consumer genetic testing companies including 23andMe, Ancestry, and others. This data, combined with family network analysis, allows researchers to identify genetic relationships for virtually the entire U.S. population through distant relative matching. Law enforcement has used genealogy databases to solve cold cases through genetic genealogy, raising questions about the use of genetic information for purposes far beyond what customers consented to. The permanent nature of genetic data means that privacy violations today will have consequences for decades. Children of 23andMe customers will be identifiable through their parents genetic profiles indefinitely. The decision to submit DNA to a commercial company is irreversible, and the privacy implications extend far beyond the individual who submitted the sample.
Key Findings
- 23andMe's database of 14 million genetic profiles could be sold as a corporate asset in bankruptcy, with estimated value of $1-5 billion.
- Federal law does not prevent genetic data from being used by life insurance, disability insurance, or long-term care insurance companies.
- Over 40 million Americans have submitted DNA to consumer testing companies, enabling identification of virtually the entire U.S. population through family matching.
- 23andMe's privacy policy explicitly allows customer data transfer to acquiring entities in bankruptcy or merger scenarios.
Timeline
GlaxoSmithKline pays $300 million for access to 23andMe genetic database for drug research.
23andMe discloses data breach affecting 6.9 million user profiles.
23andMe CEO Anne Wojcicki proposes taking company private amid financial difficulties.
23andMe files for bankruptcy protection, genetic database becomes potential asset for sale.