The 23andMe bankruptcy ended with the company’s genetic database sold intact to a nonprofit, not destroyed or scattered. No federal law blocked that sale, and no federal law says your DNA must be deleted when a company fails. What protected people in practice was a patchwork: state attorneys general, a few state genetic privacy statutes, the company’s own privacy policy, and each customer’s right to request deletion. This article covers US law and was checked on October 10, 2026.

The short version, as of October 2026

If a consumer genetics company goes bankrupt, its customer database is treated as an asset of the estate. A court can approve its sale. Whether that sale needs your consent depends mostly on the company’s own privacy promises and on state law, because the federal Bankruptcy Code has no genetic-specific rule.

Congress has seen bills to change that. The Don’t Sell My DNA Act, S. 1916, was introduced in the Senate on May 22, 2025. A government summary describes it as requiring written consent from every affected person before genetic information in a bankruptcy estate is used, sold or leased, and requiring deletion of what is not disposed of under its rules in a Chapter 11 case. I found no sign that it has become law. Treat it as a proposal.

How the 23andMe case unfolded

The sequence matters because each step showed a different layer of protection working, or not working.

Date Event
March 2025 23andMe files for Chapter 11 in the US Bankruptcy Court for the Eastern District of Missouri. California’s attorney general reminds residents they can ask for deletion.
April 4, 2025 The FTC writes to the bankruptcy trustees that a buyer must honor the company’s earlier privacy promises. Several state attorneys general issue consumer alerts.
May 22, 2025 Regeneron agrees to buy the company for $256 million, subject to approval.
June 2025 The auction reopens. TTAM Research Institute, led by former CEO Anne Wojcicki, bids $305 million. A coalition of state attorneys general sues in the bankruptcy court to demand explicit customer consent for any transfer.
June 27, 2025 The court approves the sale to TTAM, according to Pennsylvania’s attorney general.
July 14, 2026 A coalition of 42 attorneys general announces a settlement of their breach-related claims with the bankruptcy trustee.

Reports of the exact approval date vary slightly. ABC News, in a story dated July 1, 2025, described approval “on Monday,” which would be June 30, while the Pennsylvania announcement gives June 27. I use the state’s date.

What the court allowed, and what it declined to require

The court did not make the sale conditional on each customer opting in. A law-firm summary from Foley Hoag reports that the judge found the court-appointed privacy ombudsman’s suggestions “commercially unfeasible” for the bankruptcy estate, while noting that remaining privacy concerns could be taken to Congress and state legislatures. The court approved what the firm calls an “equity toggle” structure, in which the data assets sit in a subsidiary that is sold, instead of being moved to a separate entity.

The reasoning leaned on the buyer’s commitments. TTAM said it would keep the existing privacy policies, and the court pointed to planned protections such as the ability to delete data and to opt out of research uses. Pennsylvania’s attorney general described the sale as leaving customer DNA “under the same privacy policies, cybersecurity protections, and management,” with research partnerships limited to people who had consented to research use.

So the answer to “can my DNA be sold without my say-so?” in this case was: the database was sold, but the buyer inherited the old promises, and you kept the option to leave.

This is why the privacy policy you clicked through years ago turned out to matter. The FTC’s April 2025 letter rested on the idea that a company’s promises to customers do not evaporate in court, and the states built their demands on the same footing. A policy that said “we will not sell your data” was a stronger starting point than silence would have been. The lesson for anyone using a testing service now is to save a copy of the policy as it reads on the day you sign up, since later versions can change the terms.

Deletion is the tool consumers actually had

The most concrete protection was the right to delete. By the company’s own account to a House committee in June 2025, about 15% of its roughly 15 million customers, close to 1.9 million people, had asked for deletion since the filing, as reported by HIPAA Journal. That is a large number of people acting inside a few months.

California’s attorney general walked customers through the steps: open account settings, find the section on your 23andMe data, download a copy if you want one, then request deletion. If you had opted to store your saliva sample, he urged changing that preference so the physical sample is destroyed. A deletion request is not necessarily the end of every record. Companies may keep limited information to meet legal obligations, and the sources I read do not say exactly what remains after a request, so check each company’s policy.

If you are a customer of any genetics company

  1. Read the privacy policy’s section on mergers, sales and bankruptcy. Note whether it promises notice before a transfer.
  2. Download your raw data if you want a copy.
  3. Request deletion of the account and the stored sample if you no longer want it held.
  4. Keep the confirmation email or a screenshot. A deletion promise is only as good as your ability to show you made the request.
  5. If you live in a state with a genetic privacy law, check whether it gives you a statutory deletion right.

The state-law patchwork

States moved faster than Congress. A 2025 Orrick analysis lists a handful of examples. Illinois, California and Utah have specific genetic privacy statutes. Texas passed HB 130, which bars selling or transferring Texans’ genome sequencing data to foreign adversaries, including in bankruptcy proceedings. Indiana’s HB 1521, dated May 6, 2025, targets consumer genetic testing providers with disclosure and consent rules and attorney general enforcement, with penalties up to $7,500 per violation. Montana’s SB 163 updated its genetic privacy act and added neurotechnology data. According to that analysis, about twenty states have broad consumer privacy laws, though some count genetic data as sensitive only when it is used to identify a person.

Of those, only Texas is described as addressing bankruptcy directly, and only for transfers to foreign adversaries. That is the gap the federal bill is aimed at.

Why HIPAA and GINA do not fill the gap

People often assume health privacy law covers a DNA kit. It generally does not. HIPAA applies to health care providers, health plans and their business associates, and a consumer company that sells you a test is usually none of those; the Orrick piece makes the same point. The Genetic Information Nondiscrimination Act is narrower still: it limits how health insurers and employers may use genetic information, not who may buy a database.

One federal rule is relevant but different in kind. The Department of Justice’s bulk data rule, effective April 8, 2025, restricts bulk transfers of human ‘omic data to countries of concern, even when the data is anonymized or encrypted. It guards against a specific foreign-transfer risk. It does not give you a consent right over a domestic sale.

The breach settlement is a separate story

It is easy to blend two events. The bankruptcy sale concerned who would own the database. The July 14, 2026 settlement concerned the 2023 breach, which exposed genetic data of about 6.9 million customers worldwide, including 92,385 Minnesotans, per Minnesota’s attorney general. The states found weaknesses such as no password blocklists or multifactor authentication and inadequate monitoring.

The recovery is modest. Because the estate has limited money and many creditors, the states’ recovery was capped at $18 million paid from available bankruptcy funds. Minnesota’s announcement also lists a $47 million class-action settlement for consumers, without further detail in that release. The same release says the sale terms bind the buyer, now called 23andMe Research Institute, to enhanced security requirements, an advisory board, compliance with comprehensive privacy laws, and continued deletion rights.

Related questions

Can I still delete my data now that the sale closed?

The settlement announcements say deletion rights continue under the buyer. Use the account settings page and keep a record of the request.

Does bankruptcy automatically erase my data?

No. Data is usually an estate asset to be sold or, in some cases, retained. Deletion happens when you ask for it or when a statute or court order requires it.

Could this happen with another company?

Yes. Without a federal rule, outcomes depend on the company’s policy, the judge, the attorneys general who intervene, and state statutes. This is general information, not legal advice.

Sources