23andMe Bankruptcy Case—proposal to sell gene data during liquidation.

The Chapter 11 bankruptcy filing by consumer genomics leader 23andMe in early 2025 created serious doubts about the future of its DNA database. 23andMe has created a vast library of genomes of more than 15 million people through its direct-to-consumer saliva spit kits, which offer insights into ancestry and health. In June 2025, an auction ordered by the court saw a nonprofit group affiliated with founder Anne Wojcicki outbid the company's other creditors for the genetic database for $305 million. Significantly, the auction had one of the most sensitive data assets ever constructed—millions of users' genetic profiles—to be transferred without obtaining new permission from each user. This has created urgent issues of international human rights and data protection standards.

To put this in perspective, the demise of 23andMe was caused by a drop in demand after a large data breach that involved the personal data of 7 million customers in 2023. Privacy monitors recommended that customers select the erasure of their data during the restructuring process. Bankruptcy law, however, considers customer records to be company property. The 23andMe policy is clear that personal data "could be sold to other firms" in a sale. In reality, bidders like Regeneron Pharmaceuticals made bids of hundreds of millions of dollars to buy the DNA archive. The winning bidder – TTAM Research Institute, a non-profit with an affiliation with Wojcicki – committed to "keep 23andMe's current privacy policies" in force and to comply with data protection law. 27 U.S. states and the District of Colombia , headed up by New York, acted quickly, however, to file suits to stop any transfer of customer genetic data from happening without clear permission. As one state attorney described, the data are "immutable, everlasting, and biologically singular," closely linked to the individual's own unique identity.

Genetic Information: Exclusive, Familial, and Permanent

The reason for this uproar is that genetic facts are radically different from standard personal data. Your genome is a permanent record of who you are—and who your relatives are. As one analysis puts it, one genome reveals relationships to parents, siblings, and children and encodes ancestry and disease risk. Unlike a password or credit card (which you can replace), your DNA is indelible: once revealed, it cannot be withdrawn. Every human's DNA is also inherently shared with kin. For example, scientists have already re-identified participants from "anonymized" DNA by matching against public genealogy databases. With 15+ million profiles, a 23andMe buyer could build multi-generational family trees and sensitive traits between groups.

International authorities emphasize the vulnerable character of genetic information. The 2003 International Declaration on Human Genetic Data of UNESCO affirms that genetic data is of "special status" and has to be treated in line with human rights law. It warns that the abuse of genetic information imperils human rights and human dignity. Importantly, Article 1(b) of the Declaration states that any collection or use of human genetic data "shall be consistent with the international law of human rights." Similarly, the UNESCO Universal Declaration on the Human Genome and Human Rights (1997) views the genome as a "heritage of humanity" and stresses the necessity to preserve human dignity in the light of genomic scientific advances. Such recommendations have influenced national law all over the world significantly. In the European Union, for example, the General Data Protection Regulation (GDPR) deems genetic data to be a special category to be handled with express consent (Article 9).

Privacy Frameworks and Human Rights

Human rights law strongly protects the notions of privacy and personal data. Both the Universal Declaration of Human Rights (Article 12) and the International Covenant on Civil and Political Rights (Article 17) state that "no one shall be subjected to arbitrary interference with his privacy." Likewise, Europe's Convention on Human Rights also protects "private and family life" under Article 8. In the landmark case of S. and Marper v. UK (2008), the European Court of Human Rights was of the opinion that the storage of DNA profiles and samples of individuals who are innocent of any offense constituted a breach of the right. The Court reaffirmed that genetic data concerns "intimate details of utmost importance" to the individual and leaves states with only a margin in which to justify any interference. The implication is as clear as daylight: genetic identity cannot be severed from a person's privacy.

Within these developed norms, the sale of users' genomes without permission is profoundly disturbing. The auction by 23andMe is best characterized as a random invasion of privacy. Consumers provided their DNA to 23andMe for particular uses, such as ancestry and health testing or research under informed consent. The sale of this data to a third party—specifically for future applications not yet determined—violates the underlying privacy bargain. In fact, numerous human rights documents and ethical standards mandate that individuals provide informed consent to every particular use of their genetic data. A bankruptcy court decision to have a "free and clear" sale of the database would effectively circumvent that system of consent, undermining the very intent of these protections.

International Data Privacy Regulations

Aside from general privacy rights, there is specific data protection legislation that is enforced. The European General Data Protection Regulation (GDPR) explicitly identifies genetic information as needing additional protective safeguards. Article 9 prohibits processing genetic information that "reveals racial or ethnic origin, health…or the person's sex life" except where one of numerous strict exemptions is applicable, explicitly naming the need for the subject's express consent. Practically, this means that any purchaser buying up DNA records from EU citizens must adhere to such consent conditions. 

Even though there is no federal privacy law in American legislation, there are certain limitations. The U.S. bankruptcy code (Section 363) requires additional judicial consent before the sale of some personal information, such as Social Security numbers, if the policy of privacy forbids such sales. However, genetic information is not specifically included under these protections, creating a large loophole. This difference has become more specific: state attorneys general have argued that the sale would be a violation of 23andMe's privacy policies and the contract with the customer. Congress and regulatory agencies in response are considering imposing a total ban on the sale of DNA information, acknowledging that current U.S. laws may not be sufficient to protect this kind of data.

Corporate Responsibility and Human Dignity

International human rights norms also apply to private enterprise. The UN Guiding Principles on Business and Human Rights, which have been endorsed by United Nations member states, urge firms not to infringe rights and institute remedies for any adverse effects that ensue. In data processing, this entails firms being mindful of personal data, especially identity data, with the utmost respect and sensitivity to human dignity. The sale of genetic data in a bankruptcy sale arguably contravenes this provision by commodifying something international bioethics holds to be an inalienable part of a human person.

Organizations also made public commitments to maintaining privacy protections in this sale. TTAM's offer, for example, promised to maintain existing policies and legal requirements. Privacy organizations remain doubtful, however, that nonbinding commitments will hold if there is a change in ownership unless made legally binding. 

Conclusion

The 23andMe bankruptcy auction has revealed a significant issue in how legal and business systems handle our most personal data. Genetic information is not just a regular corporate asset; it represents our identity, family connections, and biological reality. Selling this kind of data without clear and informed consent violates basic principles of privacy, personal freedom, and human dignity under international human rights law. As biotechnology develops and data banks expand, the 23andMe case should act as a warning. We need strong legal protections to make sure that human identity isn't treated like merchandise in a liquidation process.