What Happens When the Company Holding Your Genome Goes Bust
When 23andMe collapsed into Chapter 11, the auction of assets built around its 15-million-customer genetic database exposed the governance gap between the permanence of genetic information and the mortality of the companies that hold it.
On March 23, 2025, 23andMe and its operating subsidiaries filed for Chapter 11 bankruptcy protection in the U.S. Bankruptcy Court for the Eastern District of Missouri (Case No. 25-40976-357). The filing initiated a court-supervised asset sale under Section 363 of the Bankruptcy Code, placing substantially all of the company’s operating assets up for bid.
Among the company’s most consequential assets was its genetic and phenotypic database, containing records compiled from approximately 15.1 million customers.
The proceedings brought commercial insolvency and biological privacy into unusually direct conflict. Direct-to-consumer genetic testing companies marketed testing through a framework of consumer control over personal genetic information. The bankruptcy auction demonstrated the limits of that framing: when the corporate entity failed, the contractual, database, intellectual-property, and business interests surrounding that information carried substantial strategic value in a corporate restructuring, bringing those interests into an asset pool administered through the bankruptcy process.
I. The Company Died. Your DNA Didn’t.
The commercial genomics industry was built on a temporal mismatch: the permanence of human biological data held by commercial institutions subject to ordinary corporate mortality.
In its annual Form 10-K filing for the fiscal year ended March 31, 2024, 23andMe reported that its customer repository had reached 15.1 million individuals. More than 80 percent of those customers had checked an electronic consent box permitting their genetic data to be used in third-party scientific research.
When the operating company entered Chapter 11, the consumer question shifted immediately. Customers who had submitted saliva samples for genealogical or health reports were suddenly forced to ask who possessed the legal authority to hold, license, or transfer their genetic records once the business that collected them ceased to operate as a going concern.
II. What You Actually Gave Them
The strategically important asset at issue in the bankruptcy was not a warehouse of saliva vials; it was an interconnected informational asset composed of multiple distinct technical layers:
What the Database Connected
┌────────────────────────────────────────────────────────┐
│ 1. Physical Biobank: Saliva samples held in storage │
├────────────────────────────────────────────────────────┤
│ 2. Raw SNP Microarrays: Hundreds of thousands of loci │
├────────────────────────────────────────────────────────┤
│ 3. Imputed Variants: Statistically inferred markers │
├────────────────────────────────────────────────────────┤
│ 4. Phenotypic Survey Data: Self-reported health traits │
├────────────────────────────────────────────────────────┤
│ 5. Relational Graph: Interconnected family trees │
├────────────────────────────────────────────────────────┤
│ 6. Account Metadata: Names, billing records, addresses │
└────────────────────────────────────────────────────────┘
A raw DNA sequence has limited clinical utility on its own. The economic value of 23andMe’s platform resided in the correlation between raw single-nucleotide polymorphisms (SNPs) and longitudinal phenotypic survey data regarding user traits, habits, lifestyles, and health-related characteristics. By connecting genetic variants with phenotypic and health-related information across millions of people, the company constructed a computational substrate for identifying disease associations and potential drug targets.
III. Who Owns What?
The legal structure of consumer genomics separates biological property from digital information rights.
In Moore v. Regents of the University of California (1990), the California Supreme Court addressed property rights in excised biological materials, holding that individuals do not retain a property interest sufficient to support a conversion claim in their cells once transferred to third parties. While Moore addressed excised tissue rather than consumer genetic databases, it illustrates the difficulty of treating biological material as an ordinary property interest once it leaves the body.
In consumer genomics, companies hold digitized data assets governed by contract. When customers agreed to 23andMe’s Terms of Service and Privacy Statement, they granted the company broad operating licenses to extract, analyze, and aggregate their genetic profiles. Crucially, those agreements incorporated standard change-of-control provisions: in the event of a merger, acquisition, reorganization, or bankruptcy, personal information could be assigned, sold, or transferred to an acquiring entity, with the stated condition that the privacy policy would continue to govern the transferred data.
IV. The Strange Economics of Genetic Distress
23andMe’s trajectory was defined by an operational dilemma: high customer acquisition costs, low repeat purchasing, and long capital cycles as it expanded its research and therapeutics operations.
The core genetic test was largely a one-time purchase. Because an individual’s genome does not change, customers had little operational reason to purchase a second kit. In its FY2024 filings, 23andMe described its subscription service, 23andMe+, as an essential initiative to establish recurring revenue and increase customer lifetime value. Yet despite accumulating 15.1 million customers, only approximately 562,000 users were active paying subscribers.
To generate sustained returns, 23andMe pivoted toward therapeutics, monetizing the research potential of its biobank, adding to the company’s financial strain. In July 2018, GlaxoSmithKline (GSK) entered a landmark five-year research collaboration with 23andMe, accompanied by a $300 million equity investment, granting the pharmaceutical manufacturer exclusive rights to use consented customer data to discover and validate therapeutic targets. Substantially all of 23andMe’s research-services revenue during this period was derived from the GSK collaboration.
However, in July 2023, the exclusive five-year target-discovery term lapsed. The companies subsequently executed a non-exclusive, 12-month data license in October 2023 for a $20 million fee, running through approximately October 2024. In its public filings, 23andMe reported that research-services revenue fell following the conclusion of the exclusivity period and warned that future research revenues could decline substantially without new multi-year agreements. At the same time, proprietary drug development required heavy R&D expenditures while carrying substantial clinical failure risks, accelerating the company’s cash burn.
These structural strains were compounded by an October 2023 security breach. Attackers deployed credential stuffing against roughly 14,000 user accounts, then leveraged the opt-in “DNA Relatives” feature to access personal, geographic, and family-tree profiles belonging to approximately 6.9 million customers, as documented in PIPEDA Findings #2025-001. The breach added substantial litigation, regulatory, and remediation burdens to an already cash-strained enterprise. In September 2024, all seven independent directors resigned following a dispute over Wojcicki’s proposed take-private transaction, leaving the company without an independent board less than six months before filing for Chapter 11.
These structural strains were compounded by an October 2023 security breach. Attackers deployed credential stuffing against roughly 14,000 user accounts, then leveraged the opt-in “DNA Relatives” feature to access personal, geographic, and family-tree profiles belonging to approximately 6.9 million customers, as documented in PIPEDA Findings #2025-001. The breach added substantial litigation, regulatory, and remediation burdens to an already cash-strained enterprise. In September 2024, all seven independent directors resigned following a dispute over Wojcicki’s proposed take-private transaction, leaving the company without an independent board roughly six months before filing for Chapter 11.
V. The Auction on the Courthouse Steps
The bankruptcy process demonstrated that a genomic database can retain substantial strategic value even as the company operating it fails.
Under Section 541 of the Bankruptcy Code, filing a petition creates an estate encompassing all legal or equitable interests of the debtor in property. Section 363 provides the statutory mechanism for the debtor-in-possession to sell those assets outside the ordinary course of business, subject to court approval.
In May 2025, Regeneron Pharmaceuticals became the stalking-horse bidder under court-approved sale procedures, establishing an initial bidding baseline with a $256 million cash offer to acquire 23andMe’s consumer business, laboratory operations, and research biobank. At that stage, TTAM Research Institute—a non-profit public benefit corporation established by Wojcicki – served as the backup bidder at $146 million. For a major drugmaker, acquiring the operating assets offered direct access to an annotated, population-scale genetic repository capable of supporting drug-target validation without the multi-year expense of assembling a clinical cohort from scratch.
After the initial auction concluded with Regeneron as the prevailing bidder, TTAM submitted revised acquisition proposals. The parties subsequently agreed to final-proposal procedures approved by the bankruptcy court on June 6, 2025. In the final bidding round on June 13, TTAM prevailed with a purchase price of $305 million. Regeneron became the official backup bidder with an adjusted offer of $151 million. Following a contested hearing, the bankruptcy court approved the transaction on June 27, 2025, and the sale formally closed on July 14, 2025, as detailed in 23andMe’s regulatory filings.
Had TTAM not outbid the field, Regeneron would have acquired the operating assets and associated data-management rights, subject to the applicable privacy terms and court-approved conditions.
The Bankruptcy Asset Auction
23andMe Files Chapter 11 (March 23, 2025)
Substantially all assets placed under § 363
│
▼
Initial May 2025 Stalking-Horse Round:
Lead Bidder: Regeneron Pharmaceuticals ($256 Million)
Backup Bidder: TTAM Research Institute ($146 Million)
│
▼
Final Bidding Round (June 13, 2025):
Winning Bid: TTAM Research Institute ($305 Million)
Backup Bidder: Regeneron Pharmaceuticals ($151 Million)
│
▼
Sale Approved (June 27, 2025) / Closed (July 14, 2025)
Operating assets transferred under negotiated privacy covenants
VI. When the Bankruptcy Court Meets Genetic Privacy
To address potential abuses of consumer records in corporate insolvencies, Congress created 11 U.S.C. § 332 in 2005. The statute requires the bankruptcy court to order the appointment of an independent Consumer Privacy Ombudsman (CPO) when a hearing is required under Section 363(b)(1)(B) for a proposed sale or lease of personally identifiable information subject to privacy policy restrictions.
The appointment process in the 23andMe proceeding followed a contested procedural path. 23andMe initially proposed sale procedures without an ombudsman, asserting that its privacy policies permitted corporate transfers. Certain state governmental entities that had objected to 23andMe’s proposed customer-data representative joined an April 29, 2025 stipulation with the debtor, the U.S. Trustee, and the Creditors’ Committee providing for the appointment of a CPO, while preserving 23andMe’s legal positions. On May 6, the U.S. Trustee formally appointed Professor Neil Richards, a privacy scholar at Washington University School of Law. Concurrently, the Federal Trade Commission sent a warning letter on March 31, 2025, as noted in the FTC press release, advising the U.S. Trustee that 23andMe’s past privacy representations remained relevant to any transfer and that deceptive practices could violate Section 5 of the FTC Act.
Under Section 332, the ombudsman provides the court with information regarding the debtor’s privacy policy, potential consumer losses and gains, and the costs and benefits of alternatives, including possible mitigating terms. In his evaluation, Richards found that an unrestricted transfer could conflict with 23andMe’s pre-2022 privacy representations, which had offered stronger assurances against data transfers—and recommended that the court require separate, affirmative opt-in consent before an acquirer could materially modify privacy protections. His report was advisory and did not bind the court. The final transaction order nevertheless imposed privacy conditions addressing several of the same concerns examined in his evaluation.
VII. Your DNA Isn’t Only Yours
The 23andMe proceedings underscored an inherent limitation of modern data protection law: individual consent cannot fully govern relational biological data.
Much of modern privacy law assigns rights and decision-making authority primarily to identifiable individuals. Frameworks such as the California Consumer Privacy Act (CCPA), the European Union’s General Data Protection Regulation (GDPR), and India’s Digital Personal Data Protection Act (DPDPA) operate on the premise that privacy can be managed through individual choices: one person evaluates disclosures, checks a box, and grants consent.
Genetics exposes the limits of that assumption. Human DNA is an interconnected biological network. On average, close relatives share substantial portions of their genomes: roughly 50 percent with parents, siblings, and children; 25 percent with grandparents, aunts, and uncles; and 12.5 percent with first cousins, with actual sharing varying due to random chromosomal crossover during meiosis.
In a landmark 2018 study published in Science, computational biologist Yaniv Erlich analyzed an empirical database of 1.28 million profiles and observed a 60 percent success rate in finding a third-cousin or closer relative for individuals of European descent. The authors projected that if database coverage expanded to roughly 2 percent of that target population, long-range familial searches could identify nearly any individual in that demographic under the study’s modeling assumptions when combined with public family trees and demographic records.
This network dynamic was demonstrated during 23andMe’s 2023 breach. Attackers directly penetrated approximately 14,000 accounts, but through the opt-in “DNA Relatives” feature, they accessed profile details belonging to approximately 6.9 million people.
When a genomic database is transferred through a corporate sale, the buyer acquires a biological map that reaches beyond the customers who signed the contract. A customer who consented to testing also revealed genetic information that could say something about biological relatives who never consented to the company’s services. Even someone who never used a consumer genetic-testing service may have some hereditary information indirectly inferable from relatives who did.
VIII. The Deletion Illusion and Legal Carveouts
Following court approval of the sale to TTAM Research Institute, 23andMe reiterated that customers retained the right to delete their accounts. Under TTAM’s operational commitments, account deletion automatically closes the user profile, cancels ongoing research participation, and directs the disposal of the customer’s physical biological sample.
However, account deletion does not equate to the complete historical erasure of genomic data across all systems. For customers who consented to research, account deletion or research withdrawal operates prospectively; information already incorporated into ongoing or completed research cannot be withdrawn or removed from published scientific findings under 23andMe’s research agreements.
Beyond deletion mechanics, statutory protections outside bankruptcy remain fragmented. The Health Insurance Portability and Accountability Act (HIPAA) does not automatically cover direct-to-consumer genetic-testing companies merely because they handle health information; applicability depends on whether the company or a particular service falls within HIPAA’s covered-entity or business-associate categories under federal regulations (45 C.F.R. § 160.103).
Similarly, the Genetic Information Nondiscrimination Act of 2008 (GINA) provides vital federal protections against genetic discrimination in health insurance and employment decisions. However, GINA does not itself regulate life, disability, or long-term-care insurance underwriting, leaving those questions largely to state laws, which vary considerably. Florida’s statute (Fla. Stat. § 627.4301), for example, restricts health, life, and long-term-care insurers from specified uses of genetic information, including canceling, limiting, or denying coverage or establishing differentials in premium rates in specified circumstances.
State-level statutory frameworks, such as the California Genetic Information Privacy Act (GIPA), provide specific consumer rights to consent, deletion, and sample destruction. The interaction between state genetic-privacy requirements and a federally supervised bankruptcy sale can therefore become contested, particularly where state officials argue that a proposed transfer would violate protections applicable to their residents.
IX. The Cross-Border Collision
The international reach of 23andMe generated immediate cross-border friction during the Chapter 11 proceedings.
On April 28, 2025, the UK Information Commissioner’s Office (ICO) and the Office of the Privacy Commissioner of Canada sent a joint letter to the U.S. Trustee, with 23andMe copied, formally stating that customer data belonging to British and Canadian citizens remained subject to the UK GDPR and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). European and Canadian regulators emphasized that domestic statutory privacy obligations continue to apply to the personal information of their residents, irrespective of an asset sale in a foreign bankruptcy court.
In India, the legal framework presents a distinct comparative challenge. Under India’s Digital Personal Data Protection Act, 2023, personal data processing is governed by consent and specified lawful purposes. Unlike the EU GDPR, which classifies genetic data as “Special Category Data” under Article 9 and imposes strict general processing bans absent specific statutory exceptions, India’s DPDPA does not establish a distinct, heightened statutory classification for genetic information.
Furthermore, specialized national frameworks address biological data differently. The Indian Council of Medical Research (ICMR) publishes ethical guidance concerning the collection, storage, sharing, and transfer of human biological materials, but those frameworks target clinical trials and academic biomedical research.
The result is a fragmented custody regime: the same genomic dataset can remain subject to different privacy obligations depending on the jurisdiction and the people represented in the database.
X. The 2026 Reckoning
The asset purchase agreement executed with TTAM Research Institute concluded with explicit privacy covenants:
- Maintenance of existing user account deletion and research opt-out mechanisms.
- Preservation of current privacy policy protections.
- Formation of an independent Consumer Privacy Advisory Board.
- Annual compliance reporting made available to state attorneys general upon request.
- Binding contractual restrictions providing that TTAM will not sell or transfer genetic data in specified future transactions unless the recipient is a qualified domestic entity that adopts TTAM’s privacy policies and complies with all applicable laws.
Yet the asset sale did not extinguish legal claims against the corporate predecessor. On May 27, 2026, California Attorney General Rob Bonta filed an enforcement action in San Francisco Superior Court (Case No. CGC-26-636891) against Chrome Holding Co., formerly known as 23andMe, alleging violations of state genetic privacy statutes and deceptive disclosures regarding data security during the 2023 breach.
In July 2026, a coalition of 42 state attorneys general announced an $18 million settlement resolving consumer-protection claims arising from the breach. The states held approximately $150 million in allowed claims, but agreed to accept $18 million paid immediately from available bankruptcy funds due to the estate’s limited resources, running alongside a separate $46.75 million consumer class-action settlement, as confirmed by state attorney general releases. The settlement showed how legacy liabilities from the breach continued to draw on the limited value remaining in the bankruptcy estate even after the operating assets had changed hands.
XI. The Question Nobody Has Solved
The 23andMe proceedings demonstrate that while a bankruptcy court can approve the transfer of assets and associated data-management rights to a new corporate custodian, corporate restructuring cannot resolve the underlying governance mismatch.
The company died financially before the information lost its value. Bankruptcy law provides mechanisms for administering and liquidating commercial assets; it does not provide a comprehensive governance regime for information whose biological value, relational reach, and privacy implications persist indefinitely.
Resolving that contradiction will require structural policy answers. Possible structural responses could include prohibiting human genomic databases from being pledged as commercial debt collateral, or establishing independent data trusts where genetic repositories are held by non-commercial fiduciaries governed by duties of loyalty rather than the financial demands of corporate liquidation. Without such reforms, the most permanent biological record an individual possesses will remain tied to the commercial survival of transient corporate entities.
