23andMe’s bankruptcy turned a privacy policy into a term of sale
Once 23andMe entered Chapter 11, its privacy promises stopped being a disclosure and turned into a condition that courts, states and bidders had to price. Anyone holding or sharing health-adjacent data should write contracts with that ending in mind.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On March 21, 2025, California’s attorney general issued a consumer alert urging 23andMe customers to consider deleting their genetic data and withdrawing from research, citing the company’s financial distress. Two days later, on Sunday, March 23, 23andMe filed for Chapter 11 bankruptcy in the Eastern District of Missouri and said it would pursue a court-supervised sale of substantially all its assets. Co-founder Anne Wojcicki resigned as chief executive and said she intended to bid as an independent buyer. The company said any buyer would have to comply with applicable law in its treatment of customer data. The filing followed years of decline and the 2023 credential-stuffing breach that exposed profile data on millions of users through the DNA Relatives feature.
Earlier in this series, we looked at the 2023 23andMe breach as a story about a sharing feature that multiplied exposure, and about health-adjacent data that HIPAA does not reach. The bankruptcy raised a different question. What happens to data, and to the promises made when it was collected, when the company holding it fails? Health systems, research institutions and life sciences firms all hold or share data with companies that could one day face the same process. The answer has three parts: what the promises said, who enforced them once the company was in court, and what the company’s partners could do about it.
The promises: what the policy said about a sale
Like most consumer privacy policies, 23andMe’s anticipated a merger, acquisition or bankruptcy and described customer data as something that could transfer to a successor. Customers who opted into research had signed a separate, narrower consent. Genetic data also carried extra protection under state laws such as California’s Genetic Information Privacy Act, which requires consent for certain disclosures.
Those layers looked like boilerplate until a sale made them operative. A buyer would acquire a data set whose permitted uses differed by customer, by consent type and by state. That is hard to value and harder to integrate. A bidder cannot simply load the records into a new platform. It must carry forward every restriction attached to them, record by record.
For any organization that collects health or genetic data, the practical step is to write the change-of-control language as if a judge and a state attorney general will one day read it. That means separating categories of data in the policy, saying plainly which categories can transfer and on what conditions, and keeping consent records that can be queried by customer and by data type. A promise that is vague at collection turns into a dispute at sale.
Research consent needs the same discipline. Academic medical centers and biobanks typically tie each participant’s consent to a protocol, an institutional review board approval and a data use agreement. When the data holder changes hands, each of those documents has to travel with the records. If they sit in a shared drive instead of the data platform’s metadata, the new owner inherits obligations it cannot see.
The process: who enforced the promises in court
Bankruptcy moved the promises from a contract between the company and its customers into a public proceeding with many parties at the table. The Bankruptcy Code provides for a consumer privacy ombudsman to advise the court on sales of personal information, and the court appointed one. State attorneys general and the chairman of the Federal Trade Commission signaled early that any buyer should be held to the company’s existing commitments. Congress called company leaders to testify.
Each of these actors could influence price and timing. The ombudsman’s report could shape what the court approved. Objecting states could delay a sale. Bidders had to decide how much of the data’s value would survive the conditions the court was likely to impose. In effect, the privacy policy was being repriced in public, by people who had never been party to it.
For leaders, the second-order effect matters most. In a distressed sale, the value of a sensitive data set is its commercial potential minus the restrictions attached to it. Those restrictions are set by regulators during the sale, not by the company in advance. An organization that relies on data held elsewhere cannot assume the data will stay where it is, or that its future owner will use it as the original holder did.
The partners: what counterparties of a failing data holder can do
The hardest position belongs to partners. Consider a health system that sends patient-derived data to a startup for analytics. A biobank that shares samples with a research company, or a drug maker that licenses a data set, faces the same risk. If the counterparty enters bankruptcy, the data it holds may become part of the estate.
Many contracts try to solve this with a clause that ends the agreement and requires data return if the partner becomes insolvent. Counsel should review whether such clauses will work. Bankruptcy law generally limits clauses that terminate a contract solely because a party has filed. Protections that act earlier, or that keep the data out of the partner’s hands, are more dependable.
Three design choices do that. First, give partners access, not copies, using a controlled analytics environment or data clean room that the data owner operates. Second, write data use agreements as licenses with deletion rights exercisable on notice at any time, and exercise them when warning signs appear. Third, assign someone, often in vendor risk or finance, to watch the financial health of data partners. Going-concern warnings, exchange delisting notices and sudden layoffs are public signals. Each should trigger a review of what data the partner holds and whether to recall it.
These choices carry costs. Clean rooms limit what partners can build. Frequent deletion requests strain relationships with small vendors. Research collaborations slow down when data never leaves the owner’s environment. Those costs are lower than finding that a partner’s most valuable asset in bankruptcy is your patients’ data.
With hindsight
The sale ran through the spring. Regeneron initially agreed to buy the assets for $256 million, but after the court-appointed privacy ombudsman reported concerns, the auction reopened. TTAM Research Institute, a nonprofit led by Anne Wojcicki, won with a $305 million bid, and the court approved the sale at the end of June 2025. TTAM committed to honor existing privacy policies and deletion rights and to restrict any further transfer of the data. In June, 27 states and the District of Columbia had sued to block a sale of genetic data without consent. At a House Oversight hearing that month, the interim chief executive said 1.9 million of 15 million customers had asked to delete their data since the filing.
The episode confirmed that, in insolvency, privacy commitments are enforced by courts and states rather than by the company that wrote them.