Evidence: well sourced. Imported from the supplied 65-Case Master Edition, dated September 19, 2026. Source links and classifications are retained as an attributed case account; import is not an independent source review.
Case at a glance
- Case number
- 051
- Date / range
- 2025 sale process
- Sector
- Consumer genetics and commercial data
- Genetic asset
- Genetic database, stored samples, and privacy commitments
- Security principle
- Corporate-Continuity Risk
Event summary
23andMe's 2025 Chapter 11 sale process turned genetic privacy into a bankruptcy-governance question: data and stored samples can outlive the company relationship in which users originally provided them.
Source: oag.dc.gov — 23andMe Bankruptcy And Data Stewardship source 1.
Source: attorneygeneral.gov — 23andMe Bankruptcy And Data Stewardship source 2.
Source: restructuring.ra.kroll.com — 23andMe Bankruptcy And Data Stewardship source 3.
The case in context
The 2025 bankruptcy process raised a continuity question: which commitments travel with genetic data and stored samples when control changes? The supplied record distinguishes the earlier bidding stage from the later TTAM transaction, rather than treating an initial bidder as the final owner.
The relevant assets are not limited to account records. Sample custody, research permissions, deletion processes, and obligations of a successor can each require separate treatment. Bankruptcy does not automatically make private data public, while a general promise to honor policies does not explain every future-use decision.
Acquisition and processing
consumer sample/data → long-lived database → financial distress → bankruptcy sale → successor control → continuity or reinterpretation of privacy commitments
The sequence of events
- consumer sample/data
- long-lived database
- financial distress
- bankruptcy sale
- successor control
- continuity or reinterpretation of privacy commitments
What became inferable or exposed
Genetic database, stored samples, and privacy commitments
23andMe's 2025 Chapter 11 sale process turned genetic privacy into a bankruptcy-governance question: data and stored samples can outlive the company relationship in which users originally provided them.
Affected parties and consent
- Direct parties
- Customers and research participants whose assets were subject to successor stewardship
- Indirect parties
- Relatives and connected participants may be relevant where the asset contains relationship information.
- Direct count
- Unknown / not assigned
- Indirect count
- Unknown / not assigned
- Consent status
- The relevant boundary is the consumer permission or representation attached to storage, sharing, and later use. Unauthorized access is not authorized by ordinary participation in a service.
Security dimensions
Confidentiality
The confidentiality question concerns genetic database, stored samples, and privacy commitments. Exposure and further inference must be distinguished from the fact of collection or availability.
Integrity
The integrity question is whether the described material, permissions, processing, or interpretation can be relied upon. Corporate-Continuity Risk identifies the particular boundary examined here.
Availability
Access and continuity are assessed for the described event; potential effects are not presented as confirmed outages or losses.
Provenance
The relevant chain follows genetic database, stored samples, and privacy commitments through the stages shown below. Missing public detail is not proof that internal records did not exist.
Consent, persistence, and relational exposure
Consent
The relevant boundary is the consumer permission or representation attached to storage, sharing, and later use. Unauthorized access is not authorized by ordinary participation in a service.
Persistence
Later reuse depends on the actual asset and links to other records; no future misuse is asserted.
Relational exposure
Relatives and connected participants may be relevant where the asset contains relationship information.
Case-specific assessment
confidentiality and consent critical; availability uncertain; integrity/provenance high; persistence maximal; relational exposure high.
GeneticSecurity.org analysis
Genetic Exposure Radius
No single level is assigned where the supplied dossier gives a range, conditional outcome, or broad institutional consequence. The affected parties and proposed assessment are shown separately.
Confidence: not assigned. Classification: GeneticSecurity.org analysis.
Genetic Persistence Risk
Persistence depends on the specific biological material or information retained. A potential effect is not treated as an observed genomic disclosure.
Confidence: not assigned. Classification: GeneticSecurity.org analysis.
Genetic Provenance Integrity
A numeric provenance level is not inferred from the existence of a source or court record. It requires evidence of the relevant custody and processing controls.
Confidence: not assigned. Classification: GeneticSecurity.org analysis.
Proposed classification and its limits
Suggested GER: GER-3/4. Suggested GPR: GPR-5. Suggested GPI: GPI-3/4 if custody and transfer are documented.
These are proposed classifications from the supplied case dossier. Conditional scores describe an assumed exposure; they are not evidence that it occurred. A single numeric value is left unassigned when the asset or outcome is not sufficiently bounded.
What this case does not prove
A bankruptcy filing does not automatically make data public or erase privacy law. Likewise, a promise to honor existing policies does not answer every future-use question.
Mitigations and lessons
- Privacy-by-design sale covenants
- Independent ombudsman
- Affirmative consent for material purpose change
- Deletion and sample-destruction pathways
- Successor audits
- Escrowed records
- Insolvency planning before crisis
Primary sources
Secondary sources
No additional source listed. See the evidence notes for limitations.
Policy and standards
Genetic Security Policy and StandardsReview and correction history
Source edition: September 19, 2026. Imported case account; no substantive corrections recorded.
Correction policy and logCite this case
GS-CASE-051. 23andMe Bankruptcy: Can Genetic Consent Survive a Corporate Sale?. GeneticSecurity.org. https://geneticsecurity.org/cases/051-23andme-bankruptcy-genetic-data-sale/