Your Genetic Code Is Up for Grabs
March 23, 2025: 23andMe filed for bankruptcy. The company holds genetic data for over 15 million people. A new buyer can acquire that data along with the company. [1]
Federal law doesn't protect genetic data given to private companies. 23andMe's privacy policy explicitly states your data "may be accessed, sold or transferred" in a bankruptcy. [2]
Unlike a password, you can't change your DNA after a breach. Neither can your relatives.
The 23andMe Collapse
From $6 Billion to Bankruptcy
23andMe went public in 2021 with a $6 billion valuation. By March 2025, it was worth about $48 million, a 99% collapse. [3]
What happened:
- Never profitable: Despite millions of customers, the company never turned a profit
- 2023 data breach: 6.9 million users compromised, nearly half the customer base [4]
- $30 million settlement: Class action lawsuits from the breach
- Board exodus: Directors resigned, CEO Anne Wojcicki stepped down [1]
The Breach That Changed Everything
In late 2023, hackers used credential stuffing, testing recycled passwords from other breaches, to access 23andMe accounts. Once inside, they exploited the "DNA Relative" feature to access genetic data of 5.5 million additional people who never had their accounts compromised. [4]
What was stolen:
- Names and family relationships
- Ethnic heritage percentages
- Health predisposition reports
- Disease risk markers (Type 2 diabetes, Celiac disease, etc.)
- Family tree connections
Your cousin's weak password exposed your genetic disease risks.
What Happens to Your Data Now?
23andMe is looking for a buyer. Your genetic data is part of the sale. [1]
The privacy policy allows a new owner to:
- Access all stored genetic data
- Transfer data as part of the acquisition
- Adopt the existing privacy policy, then change it [2]
A bankruptcy court has recommended appointing a consumer privacy ombudsman to oversee the data sale. But that's advisory, not binding. [5]
Who Might Buy 23andMe's Data?
- Pharmaceutical companies: Genetic data is valuable for drug research
- Insurance companies: Could use genetic risks for pricing (where legal)
- Data brokers: Resell to unknown third parties
- Foreign entities: No law prevents international sales
Police Are Already Searching Your DNA
How Genetic Genealogy Works for Law Enforcement
You don't have to commit a crime. You don't have to upload your DNA. Your relative's DNA is enough.
Here's the process:
- Police get DNA from a crime scene
- Upload to GEDmatch or similar database
- Find partial matches (distant relatives)
- Build family trees to identify suspect
- Get warrant for suspect's actual DNA
The Golden State Killer was caught this way in April 2018. Since then, hundreds of cases have used genetic genealogy. [6]
The Databases and Their Policies
GEDmatch
Users: ~1.3 million profiles
Police access: Opt-in only (supposedly)
Reality: Florida police got warrant for ALL users, including opt-outs [7]
Owner: Verogen Inc (forensic testing company)
FamilyTreeDNA
Users: ~2 million profiles
Police access: Allowed with user opt-in
History: Secretly allowed FBI access before disclosure [8]
Ancestry
Users: ~25 million profiles
Police access: Prohibited by policy
Exception: Valid court orders can compel access
23andMe
Users: ~15 million profiles
Police access: Prohibited by policy
Problem: Bankruptcy could change everything
The GEDmatch Loophole
In 2019, Florida police obtained a warrant for GEDmatch's entire database, including the vast majority of users who had explicitly opted out of law enforcement searches. GEDmatch complied. [7]
Forensic genealogists have also reportedly searched users who opted out, skirting the privacy rules entirely. [7]
The lesson: Opt-out settings are policy, not law. A warrant or determined investigator can override them.
The Insurance Discrimination Problem
What GINA Does (and Doesn't) Protect
The Genetic Information Nondiscrimination Act (2008) protects against genetic discrimination in:
- Health insurance coverage decisions
- Employment decisions
GINA does NOT protect against discrimination in:
- Life insurance
- Long-term care insurance
- Disability insurance
Life insurers can legally deny you coverage or raise rates based on genetic risk factors. [9]
Real-World Scenarios
Imagine this data in insurer hands:
- BRCA1 mutation (breast cancer risk) → Life insurance denied or 10x premium
- Huntington's gene → Long-term care insurance impossible
- Alzheimer's risk markers → Higher rates across the board
Even without direct access, insurers could buy data from brokers who acquired it through bankruptcy sales or breaches.
The Unique Problem: DNA Can't Be Changed
Genetic Data Is Forever
When your password is stolen, you change it. When your credit card is compromised, you get a new one. When your DNA is breached?
There's nothing to change. Your genetic code is permanent.
Worse: your DNA reveals information about your relatives. Your breach is their breach. Your children inherit both your genes and your privacy exposure.
What Breached Genetic Data Reveals
- Health conditions: Current and future disease risks
- Family secrets: Unknown siblings, non-paternity events, adoptions
- Ethnic heritage: Potential discrimination in some contexts
- Identity: DNA is the ultimate identifier
- Relatives: Information about people who never consented
The Regulatory Void
Why HIPAA Doesn't Apply
HIPAA protects health information shared with healthcare providers and insurers. 23andMe and Ancestry aren't healthcare providers, they're consumer companies. [10]
When you send DNA to 23andMe, you're legally a customer, not a patient. No HIPAA protection applies.
State Laws: A Patchwork
At least 11 states have genetic privacy laws, but they vary widely:
- California: Strongest protections, explicit deletion rights
- Most states: No specific genetic privacy law
- Federal: No comprehensive genetic data protection
California AG Rob Bonta urged residents to delete their 23andMe data before the bankruptcy. [11] Most Americans don't have comparable protections.
How to Protect Yourself
If You've Already Used a DNA Service
Delete Your Data Now
- 23andMe: Settings → 23andMe Data → Delete Data → Confirm deletion
- Ancestry: Settings → Delete Account → Confirm
- GEDmatch: Profile → Delete Kit
- FamilyTreeDNA: Contact support for deletion
Warning: Deletion may not remove data already shared with third parties or used in research.
Download Your Data First
- Request a copy of all stored data
- Check for third-party sharing history
- Document what you had before deleting
Opt Out of Everything
- Disable DNA matching features
- Opt out of research participation
- Disable law enforcement searches (where available)
- Set profiles to maximum privacy
If You're Considering DNA Testing
Questions to Ask
- Who owns the data after upload?
- What happens in bankruptcy or acquisition?
- Is law enforcement access allowed?
- Can you fully delete data later?
- Is third-party sharing permitted?
Alternatives to Consider
- Medical genetic testing: Through healthcare providers, protected by HIPAA
- Don't test: The only guaranteed protection
- Minimal sharing: If you test, never enable matching features
For Everyone: Understand the Family Risk
You can't control whether relatives use these services. Their DNA reveals yours.
Have conversations with family about:
- The permanence of genetic data exposure
- Insurance discrimination risks
- Law enforcement access possibilities
- What happens when companies fail
The Bigger Picture
The Business Model Problem
Consumer DNA testing was never sustainable as a standalone business. 23andMe proved it, $6 billion in perceived value, never profitable, now bankrupt. [1]
The real value isn't in the $99 test kit. It's in the database. Millions of genetic profiles are worth billions to pharmaceutical companies, researchers, and anyone else who wants access to human genomic data at scale.
You're not the customer. Your DNA is the product.
What Needs to Change
Policy Recommendations
- Extend HIPAA: Cover direct-to-consumer genetic companies
- Expand GINA: Include life, disability, and long-term care insurance
- Require consent: Explicit opt-in for any sharing, research, or law enforcement access
- Bankruptcy protections: Mandate data deletion options before sale
- Right to deletion: Federal law requiring complete data removal on request
- Warrant requirements: No law enforcement access without judicial oversight
The Bottom Line
23andMe is bankrupt. 15 million people's genetic data is part of the liquidation sale. Police already search genealogy databases, sometimes ignoring opt-out settings. GINA doesn't protect you from life insurance discrimination based on genetic risk.
Unlike every other type of personal data, DNA can't be changed after a breach. Your genetic code is permanent. And it reveals information about relatives who never consented to testing.
If you've used a DNA testing service: Consider deleting your data now, before ownership changes or new breaches occur. Download a copy first, then delete.
If you're considering DNA testing: Understand that you're trading permanent, unchangeable personal data for ancestry curiosity. The companies holding that data can fail, get hacked, or sell to entities with very different intentions.
Your DNA is the most personal data you have. Once it's out there, it's out there forever.
References
- NPR - 23andMe is filing for bankruptcy. Here's what it means for your genetic data (March 2025)
- TechCrunch - 23andMe faces an uncertain future, so does your genetic data (March 2025)
- EPIC - 23andMe's Downturn Highlights Insufficient Privacy Safeguards (2025)
- TIME - 23andMe Hack Breaches 6.9 Million Users' Info (December 2023)
- Foley Hoag - 23andMe's Bankruptcy and Genetic Data (March 2025)
- Science - A judge said police can search the DNA of millions of Americans without consent
- The Intercept - GEDmatch Loophole Gave Police Access to Private DNA Data (August 2023)
- Criminal Legal News - Forensic Genetic Genealogy: Law Enforcement's Rapid Adoption (June 2024)
- Cole Van Note - The Long-Term Impact of Genetic Data Breaches (February 2025)
- Harvard Gazette - What happens to your data if 23andMe collapses? (March 2025)
- Washington State AG - Consumer Alert: Data privacy rights following 23andMe bankruptcy (March 2025)