28 states sued to stop your DNA from being sold in bankruptcy court

23andMe declared bankruptcy after years of declining demand for its ancestry and health testing kits, compounded by a major 2023 data breach that exposed the personal data of roughly 5.5 million customers and damaged public trust in the company. The company stated it filed Chapter 11 to facilitate a sale process to maximize the value of its business. Its most valuable remaining asset was never a product. It was the genetic profiles of everyone who had ever mailed in a saliva sample.

Under bankruptcy law, customer data is generally treated as a sellable business asset, governed by Section 363(b) of the Bankruptcy Code, which looks to a company's own privacy policy to determine what can be sold. 23andMe's privacy policy stated that if the company were acquired or went through bankruptcy, the same data-handling terms would carry over to the new owner. Legal experts note that policy language can be changed at any time, meaning the specific protections a new owner would actually honor are not fixed.

California Attorney General Rob Bonta issued a formal consumer alert directly instructing residents to delete their 23andMe data and, separately, to request their physical genetic sample be destroyed. Twenty-eight state attorneys general jointly sued in the bankruptcy court itself, arguing the company lacked legal authority to treat biological samples and raw genetic data as ordinary transferable property. A bankruptcy judge nonetheless authorized 23andMe to proceed with a sale process for its assets, including the genetic database.

This establishes that a real company holding the genetic data of over 15 million people sought and received court authorization to sell that data as a business asset during bankruptcy, that 28 state attorneys general formally challenged this in federal court, and that a real government consumer alert instructed residents on specific deletion and sample-destruction steps. This is confirmed by the bankruptcy filing, the state lawsuit, and the court's own ruling.

What this does not establish is exactly who purchased the data or what specific new privacy commitments, if any, the buyer is bound by beyond 23andMe's original, changeable privacy policy. HIPAA, the federal law most people assume covers medical privacy, does not apply here; 23andMe is not a HIPAA-covered entity. Protection depends on state-level genetic privacy laws, which vary significantly.