ABSTRACT
After declaring bankruptcy in March 2025, direct-to-consumer (DTC) genetic testing company 23andMe sold the data of over 15 million people around the world to TTAM Research Institute, a non-profit created by 23andMe’s founder and long-time CEO. The organization outbid Regeneron Pharmaceuticals, which was originally named the successful bidder in the bankruptcy 5 auction. 23andMe’s consumers might breathe a sigh of relief that their data didn’t end up in the hands of different leadership. But the saga highlights the risks associated with the sale of sensitive health databanks. Commercial sales of genetic data have happened before, and they will happen again. 23andMe’s bankruptcy just made salient the ways in which existing law fails to fully protect consumer genetic data against exploitation, commercialization, or misuse. Moreover, the next data sale will likely involve a company with fewer privacy protections than 23andMe, as it was among the most protective under its pre-bankruptcy policies. Congress has finally expressed interest in taking action, introducing two bipartisan bills – the Don’t Sell My DNA Act and the Genomic Data Protection Act – that aim to enhance consumer control over their genetic data in the event of a sale or bankruptcy. These are important steps forward. But 15 neither proposal provides adequate or genuine consumer protection. American action reaches beyond US borders too, given the popularity of consumer genetic testing across the globe.
Ram, Natalie and Prince, Anya and Roberts, Jessica L and Fox, Dov and Spector-Bagdady, Kayte, The Precarious Future of Consumer Genetic Privacy (September 8, 2025), Science, volume 389, no 6765 (11 September 2025); San Diego Legal Studies Paper No 25-034.
Leave a Reply