On March 23, 2025, 23andMe, along with its affiliates, filed for voluntary Chapter 11 bankruptcy. The company’s decision to file for bankruptcy follows in the wake of a 2023 data breach affecting close to 7 million customer profiles, which led to plummeting stock prices and a class-action lawsuit settlement for $30 million.
23andMe intends to use their Chapter 11 proceedings as an avenue to facilitate a sale process to maximize the value of its business, and while doing so, continue operating its business in the ordinary course throughout the sale process. On March 28, 2025, Judge Brian C. Walsh ruled that 23andMe had the right to sell customers’ medical and ancestry data to potential bidders.
Background Information
23andMe became popular through its direct-to-consumer genetic testing kits, in which customers submit saliva samples in return for access to unique, personalized information about their ancestry, genetic traits, and health risks. Because of its broad base of customers, 23andMe has developed one of the world’s largest crowdsourced platforms for genetic research comprised of data from over 15 million customers. That scale of 23andMe’s growing database of genetic information has enabled the company to make over 100 health and carrier status reports available to its customers.
It further boasts to be the only company to have FDA authorization, clearance, or an exemption from premarket notification for all of the carrier status, genetic health risk, cancer predisposition, and pharmacogenetics reports that it offers to its customers. As such, the company and its data pose to be very valuable and attractive assets to potential buyers.
The Bankruptcy Court has approved the company’s proposal to select a stalking horse bid (i.e., a floor-setting bid that would remain subject to solicitation of further bids and an auction) by April 25, 2025, hold an auction on May 14, 2025, and hold a final hearing to approve the sale on June 17, 2025.
Bankruptcy Proceedings and Consumer Data
If you are one of 23andMe’s 15 million customers, you may be curious about what might happen to all the genetic and customer-reported data the company holds. A company’s sale of its assets is a standard and common relief often sought by debtors in bankruptcy proceedings. Section 363 of the U.S. Bankruptcy Code authorizes the sale of a debtor’s assets free and clear of claims and encumbrances. If an interested party submits a qualified bid acceptable to 23andMe, and the Bankruptcy Court subsequently approves the sale to that bidder in June, then that sale becomes final and the winning bidder becomes the owner of the company assets, including the genetic data of 23andMe’s customers, free and clear of all liens and interests.
23andMe has stated in its privacy policy that in a bankruptcy, merger, or acquisition, it will continue the same security measures it has always had in place surrounding sensitive customer data. However, the policy mentions that these procedures can be changed at will. It is also possible that potential buyers will require that the sale modify 23andMe’s existing privacy statement and/or related policies.
Consumer Privacy Ombudsman
Under Sections 332 and 363 of the Bankruptcy Code, if a bankruptcy debtor (and purchaser) do not intend to comply with the debtor’s privacy policy, the debtor is generally required to seek the appointment of a consumer privacy ombudsman (“CPO”). In the case of 23andMe, the U.S. Trustee’s office has argued that a CPO was necessary to protect the privacy rights of consumers.
23andMe has opposed such an appointment, arguing that 23andMe and the eventual buyer would abide by its privacy policy. However, even if the appointment of a CPO is approved by the Bankruptcy Court, the CPO’s role is advisory and taken into account by the Bankruptcy Court on a discretionary basis. In other words, any report provided by the CPO to the Court is intended to be informational only; it is not binding on the Court’s decision regarding the sale of consumer data and the Court will conduct its own cost-benefit analysis for customers to determine whether the sale be approved.
Future Uncertainty
The bottom line is, at this juncture, there remains uncertainty around whether 23andMe will adhere to its privacy policy throughout the sale process and how the Court will ultimately come down on the privacy aspects of the sale. In response, consumers have flocked to their 23andMe accounts to permanently delete their personal data. If you are a current customer of 23andMe and are considering doing the same, the following resource from 23andMe provides step-by-step guidance on how to do so: What’s In Your Account Settings? – 23andMe Customer Care.
