In March 2025, 23andMe — the company holding the genetic data of more than 15 million people — filed for Chapter 11 bankruptcy. For most customers, the news arrived the same way it always does with these things: a vague news alert, a flurry of alarming headlines, and a sinking feeling about something they'd done years ago and mostly forgotten about. If you spit into a tube and mailed it back, your DNA is somewhere in that dataset. And for a few months, it was unclear exactly where it was headed.

The situation has since resolved — a new entity now owns the company — but the questions it raised haven't gone away. What actually happened? Who has your data now? What can they do with it? And what, practically speaking, should you do? This article answers all of those questions.

What Happened: The Collapse of 23andMe

23andMe's bankruptcy didn't come out of nowhere. The company had been financially struggling for years, burning through cash from its peak valuation of roughly $6 billion without finding a sustainable business model beyond its original kit sales. The real accelerant was a massive data breach in late 2023 that exposed the genetic and personal information of nearly 7 million customers — roughly half the user base at the time. [1] The breach triggered class-action litigation, a $30 million settlement, and a collapse in public trust that the company never recovered from.

By early 2025, the board had been trying unsuccessfully to sell the company as a going concern. CEO and co-founder Anne Wojcicki made a last-minute bid to take the company private, which the special committee rejected. Wojcicki then resigned. On March 23, 2025, 23andMe and 11 affiliated entities filed voluntary Chapter 11 petitions in the U.S. Bankruptcy Court for the Eastern District of Missouri, with $35 million in debtor-in-possession financing to keep the lights on during the sale process. [1]

Who Acquired the Data — and When

The bankruptcy sale unfolded in two acts. In May 2025, Regeneron Pharmaceuticals was declared the winning bidder in the court-supervised auction, with a $256 million offer for substantially all of 23andMe's assets — including its 15-million-sample biobank, the Personal Genome Service platform, and the Total Health service. [2] Regeneron has its own genetics research operation, the Regeneron Genetics Center, and the acquisition would have added 23andMe's database to an existing bank of nearly 3 million deidentified genetic profiles.

Then the bidding was reopened. Regeneron declined to raise its offer. In late June 2025, 23andMe reached an agreement with TTAM Research Institute — a nonprofit public benefit corporation founded by Anne Wojcicki — to acquire the company's assets for $305 million. [3] TTAM completed the acquisition on July 14, 2025, under Section 363 of the U.S. Bankruptcy Code. As of that date, 23andMe's consumer genetics business, research services, and Lemonaid Health telehealth platform all transferred to TTAM.

TTAM has stated a commitment to providing customers with "choice and transparency" over their data, including the ability to change research participation decisions. The nonprofit structure is meant to signal a research mission rather than a commercial one — though it's worth noting that nonprofits are not automatically exempt from the privacy concerns that drove alarm during the bankruptcy proceedings.

What US Law Actually Says — and Where It Falls Short

The legal framework governing consumer genetic data in the United States has significant gaps, and the 23andMe situation exposed most of them. [7]

Bankruptcy law treats data as an asset. Under Section 363 of the U.S. Bankruptcy Code, a company's customer data — including genetic data — can be sold as part of a bankruptcy estate. There are some procedural requirements around personally identifiable information (PII), but these create process obligations, not substantive prohibitions. The FTC has jurisdiction over deceptive trade practices related to data, but its enforcement capacity in bankruptcy proceedings is limited and contested. [9]

HIPAA doesn't apply here. The Health Insurance Portability and Accountability Act protects health data held by healthcare providers and their business associates. Direct-to-consumer genetic testing companies like 23andMe are not covered entities under HIPAA, which means the data you gave 23andMe has never had the same protections as data you share with your doctor. [8]

GINA protects some things but not others. The Genetic Information Nondiscrimination Act of 2008 prohibits health insurers and employers from using genetic information to discriminate against individuals. That's meaningful protection, but GINA explicitly does not apply to life insurance, disability insurance, or long-term care insurance. A life insurer could legally use genetic data to make underwriting decisions. GINA also says nothing about how genetic data can be stored, sold, or transferred — it only restricts certain downstream uses. [8] [11]

State laws vary widely. Some states — California, Texas, Illinois among them — have enacted their own genetic privacy statutes that go beyond GINA. But patchwork state protections don't add up to a coherent national standard. Proposed federal legislation, including the "Don't Sell My DNA Act," would require written consumer consent before genetic data could be sold or transferred during bankruptcy — but as of this writing, no such bill has been enacted. [12]

What This Actually Means for You: Putting the Risk in Context

The concern about 23andMe's data is legitimate, but it helps to be specific about what the realistic risks are — and aren't.

The 15 million genetic profiles in 23andMe's database are valuable primarily at the population level, for pharmaceutical research. Drug discovery depends on identifying genetic patterns across large cohorts — finding which variants correlate with disease risk, drug response, or treatment outcomes. That's what Regeneron was willing to pay $256 million for, and it's what TTAM's research mission centers on. Your individual profile, in that context, is one data point among millions. [10]

The risks that are more concrete are the ones that GINA doesn't cover: life insurance underwriting, disability insurance, long-term care insurance. These are niche but real. If you're in the market for any of these products and carry variants associated with elevated health risks, there is currently no federal law preventing an insurer from using that information if they obtain it. [11]

There's also the less quantifiable concern about future uses. Data has a long shelf life. The company that owns it today may not be the one that holds it in ten years, the regulatory landscape may change, and uses that aren't currently contemplated may eventually become possible. This is the harder-to-dismiss argument for data deletion: not that there's an acute threat today, but that removing your data from the pool limits future exposure. [12]

Step 1: Download Your Raw Data First

Before you do anything else — especially before you delete your account — download your raw data file. This file contains your complete genotype data: hundreds of thousands of genetic markers that you can use independently of 23andMe, forever. Once your account is deleted, this data is gone. [4]

Here's how to do it:

  • Log into your account at you.23andme.com
  • Click your profile icon in the top-right corner and go to Settings
  • Scroll to the 23andMe Data section
  • Click Download Raw Data and confirm your password
  • Accept the terms — 23andMe will email you when your file is ready (usually within minutes, sometimes up to a few hours)
  • Download the .zip file from the link in that email — the link expires after 7 days

Store the file somewhere secure: an encrypted external drive, a password-protected folder, or a reputable encrypted cloud service. The file is typically 20–25 MB and contains your complete genetic data in a plain-text format readable by any third-party analysis service. [5]

Step 2: Opt Out of Research Participation

If you haven't already opted out of research, you can do so from your account settings before deletion — and it's worth doing even if you plan to delete your account, because the opt-out takes effect within 30 days. [6]

  • In Settings, navigate to Research and Product Consents
  • Withdraw consent for 23andMe research and for third-party researcher access to your data
  • If you previously consented to have your saliva sample stored, you can withdraw that consent under Preferences and request destruction of the physical sample

Important limitation: opting out stops your data from being included in studies that begin more than 30 days after your withdrawal. It does not remove your data from studies that have already been completed or are already underway. This is standard practice in research contexts — retroactive removal from aggregated datasets isn't technically feasible — but it's worth understanding what "opting out" does and doesn't accomplish.

Step 3: Delete Your Account and Request Data Removal

Multiple state attorneys general — including in New York, North Carolina, Missouri, and Pennsylvania — issued public guidance urging 23andMe customers to delete their data following the bankruptcy filing. [6] Here's how:

  • In Settings, scroll to the 23andMe Data section
  • Click Delete Data, then Permanently Delete Data
  • Follow the prompts — 23andMe will send a confirmation email titled "23andMe Delete Account Request"
  • Open that email and click Permanently Delete All Records to confirm
  • The deletion covers your account, genetic data, and associated personal information

The company has confirmed that the deletion process remains available despite the bankruptcy and ownership transition. If you encounter issues completing the process, follow up directly with 23andMe customer support — the account closure page is at customercare.23andme.com. [4]

What to Do With Your Raw Data After Downloading

Here's the part of this story that tends to get lost in the privacy coverage: your raw data file is genuinely useful, and downloading it before deletion means you lose nothing of practical value while removing your profile from the database.

The raw data file contains your genotype at hundreds of thousands of positions — far more than 23andMe ever showed you in its health reports. The reports you saw in the 23andMe app were a curated, FDA-reviewed subset. The raw file contains everything the chip tested, including hundreds of variants with well-documented effects on how your body processes vitamins, handles toxins, regulates neurotransmitters, and manages inflammation. [5]

Several third-party tools can analyze this file:

  • Whole Gene Health — analyzes 100+ variants across methylation, detoxification, vitamin metabolism, neurotransmitters, and cardiovascular pathways, producing a personalized supplement protocol with specific forms, dosages, and medication interaction screening
  • Promethease — a database-style tool that cross-references your variants against published research; useful for browsing but produces a data dump rather than an actionable protocol
  • Sequencing.com — accepts raw data uploads and runs additional interpretation tools; offers whole-genome sequencing upgrades
  • Genetic Genie — free, focused specifically on methylation and detox pathways

The file you download is yours permanently. It doesn't expire, it doesn't change, and it doesn't require any ongoing relationship with 23andMe. More detail on using your raw data file is here.

Should You Retest With Another Service?

If you've deleted your 23andMe data without downloading first, or if you're starting from scratch and want to do a DNA test, the landscape has changed.

AncestryDNA remains the largest consumer genetics database by user count, with strong ancestry features and decent health-relevant raw data. Their privacy policies allow raw data download, and their data can be used with most third-party analysis tools. The company hasn't been through a bankruptcy, though no consumer genetics company should be considered permanently immune to the structural pressures that brought down 23andMe.

Nebula Genomics — which had been the leading privacy-focused option, offering whole-genome sequencing and blockchain-based data control — shut down its consumer service in February 2025 and transitioned to a company called DNA Complete. Whole-genome sequencing remains available through Sequencing.com and specialized clinical providers, though at higher price points than consumer chip-based tests.

Whole-genome sequencing (WGS) covers roughly 100% of your genome, compared to the 0.02% tested by standard consumer genotyping chips. As sequencing costs continue to fall, WGS is becoming more accessible. The tradeoff is that interpreting the additional data requires more sophisticated tools — and raises its own privacy questions about who holds the data.

Regardless of which service you use, the privacy considerations are worth reviewing before you hand over a saliva sample. Key questions to ask: Does the company sell data to third parties? What happens to your data if the company is sold or acquired? Can you download your raw data in full? Can you delete your data and have your physical sample destroyed? How is the data used for research, and can you opt out?

The Broader Lesson: Genetic Privacy Going Forward

The 23andMe bankruptcy was not primarily a story about a company doing something wrong with data. It was a story about what happens when a company holding extremely sensitive information runs out of runway — and about how poorly the existing legal framework handles that scenario. [9] [11]

Genetic data is categorically different from most other personal information. It doesn't change. It reveals information not just about you but about your biological relatives, who never consented to anything. It can identify you even when stripped of your name. And its future uses — in insurance, employment, law enforcement, medicine — are still being worked out. The decision to hand it to a company, in exchange for ancestry percentages and a few health reports, deserves more scrutiny than most people gave it at the time.

That's not a reason to panic about a past decision — most 23andMe customers will never experience any concrete harm from having taken the test. But it's a good reason to be more deliberate going forward: to read privacy policies before submitting samples, to understand what consent forms actually say, and to download your raw data so that you remain in control of your genetic information regardless of what happens to the company that tested it.

The data you've already generated from your DNA has real value — for your health, for your supplement decisions, for understanding how your body works. The point of the steps above isn't to make that data disappear; it's to make sure you control where it goes.