23andMe Bankruptcy Sale: Privacy and National Security Concerns

23andMe's Bankruptcy and Data Sale

• 📌 23andMe, a direct-to-consumer genetic testing company with over 15 million customers, filed for Chapter 11 bankruptcy on March 23, 2025.
• ⚠️ The bankruptcy sale raises significant concerns about who will acquire the company and gain access to sensitive customer genetic data.
• 🏛️ Two primary bidders, TTAM Research (founded by 23andMe co-founder Anne Wojciki) and Regeneron Pharmaceuticals, are in the final stages of the auction process, overseen by a US bankruptcy court.

National Security and Foreign Adversary Risks

• 🚨 Concerns exist that genetic data could fall into the hands of foreign adversaries, particularly China, which has a history of using genetic data for surveillance and potentially bioweapons development.
• 🇨🇳 23andMe has had past ties to Chinese investors, including a 2015 funding round involving a venture arm of a company with ties to the CCP and PLA, raising questions about future data access.
• 🛡️ The Pentagon previously advised military personnel against using consumer DNA kits due to national security risks, including potential mass surveillance and unauthorized tracking.

Data Privacy and Consumer Protection Gaps

• 🔒 Unlike healthcare providers regulated by HIPAA, direct-to-consumer genetic testing companies operate with minimal oversight, and terms of service often allow data sale during bankruptcy.
• 📉 A 2023 data breach exposed personal information from nearly 7 million 23andMe profiles, primarily targeting customers of Jewish and Chinese heritage, highlighting vulnerabilities.
• ⚖️ The lack of comprehensive federal data privacy and cybersecurity laws leaves consumers' sensitive genetic data at risk, with states attempting to fill the regulatory gap.

Company Response and Future Safeguards

• ✅ 23andMe emphasizes its commitment to customer privacy, transparency, and explicit consent for data usage, with over 80% of customers opting into research.
• 🔒 In response to the 2023 breach, 23andMe implemented mandatory password resets and two-factor authentication, and is requiring bidders to adhere to existing privacy policies.
• 🤝 Both TTAM Research and Regeneron Pharmaceuticals have agreed in their purchase agreements to maintain 23andMe's current privacy policies and consents.

Legislative and Oversight Needs

• 📜 Congress is urged to enact comprehensive federal data privacy, cybersecurity, and AI laws to address the evolving landscape and protect Americans' sensitive information.
• 🔍 There's a call for stronger oversight and potential legislative action to prevent the misuse of genetic data by both foreign adversaries and domestic entities, including potential exploitation for insurance premiums or targeted advertising.
• 🗣️ Witnesses expressed a willingness to consult with Congress on drafting legislation to safeguard genetic data and ensure robust privacy protections.