23andMe Bankruptcy Update: How The Proceedings Highlight Best Practices For Handling And Transferring Genetic Data And Personal Information

After Foley Hoag's prior updates regarding the chapter 11 bankruptcy cases of 23andMe Holding Co and its affiliated debtors (collectively, "23andMe"), the United States Bankruptcy Court for the Eastern District of Missouri (the "Court") approved the sale of 23andMe's genetic data. On July 14, 2025, a notice of the closing of the sale was filed in bankruptcy court. This sale process informs best practices for companies and other entities handling sensitive personal information.

The Court approved the sale of 23andMe's genetic data and personal information assets to TTAM Research Institute ("TTAM"), an entity founded by Anne Wojcicki, the former CEO and co-founder of 23andMe. TTAM was deemed the successful bidder over the bid of a leading biotechnology company, Regeneron. Although several states filed objections seeking to prohibit or condition the transfer of genetic data on customers providing explicit, informed consent, the Court determined the transaction as structured did not violate applicable privacy policies or state genetic privacy laws and approved the sale to TTAM.

States' Concerns and Objections

A central point of contention was the transfer of genetic data without the renewed, opt-in consent of existing 23andMe customers. Several states argued that, under their specific laws, customers hold strong property or privacy rights in their genetic material and data. Those state-level statutes typically require explicit permission for any sale or transfer of genetic data. In response to these objections, 23andMe and TTAM contended that because the acquiring entity would honor the existing privacy commitments and maintain the company's privacy policy, no separate opt-in consent was legally required. The states' arguments reached beyond mere statutory requirements; many contended that allowing a broad bankruptcy sale would conflict with consumers' reasonable expectations, particularly individuals who signed up before 23andMe's language on possible bankruptcy transfers appeared in updated policies.

Outcome and Court's Reasoning

Despite the potential for these arguments to create significant roadblocks, the Court concluded that the new ownership structure—often referred to as the "equity toggle," whereby 23andMe's genetic data assets are initially placed into a wholly owned subsidiary ("Newco") before equity in that Newco is sold—did not constitute a "transfer" to a third party in a manner triggering explicit consent requirements under many of the cited state statutes and complied with 23andMe's privacy policy. The transaction's design, according to the Court, did not violate state law because it did not involve a direct asset transfer of data to an entirely separate corporate entity. Rather, the equity sale allowed the plaintiff-debtor to continue operating under the same data-use policies, with ownership simply shifting at the parent-company level.

Additionally, the Court emphasized the enhanced protections TTAM plans to adopt, including continued respect for customers' ability to delete data and opt out of research uses. The Court concluded that such measures serve to mitigate privacy and security risks otherwise associated with the change in corporate ownership. California appealed the bankruptcy court's decision overruling its objection, but after a brief administrative stay, the district court denied its motion to halt the sale. Of importance, while the Court held that the Privacy Ombudsman's suggestions were commercially unfeasible and too impractical to impose against the bankruptcy estate, the Court noted that there were several privacy concerns that could be addressed to Congress and state legislatures to evaluate.

Practical Implications for Entities Handling Genetic Data

These recent proceedings in the 23and Me bankruptcy case highlight key considerations for any organization that possesses genetic or similarly sensitive data:

1. Maintain Up-to-Date Privacy Policies: Courts may closely evaluate whether an organization's privacy policies have explicitly contemplated the scenario of a sale, merger, or bankruptcy. Clear, early disclosure can help mitigate or defend against future consent objections.
2. Obtain Consent Aligning with State Requirements: Entities operating in multiple jurisdictions should track varying levels of consent procedures mandated by genetic privacy laws. Inconsistent or incomplete consent forms may be challenged, particularly where states have strict provisions requiring a renewed, opt-in basis.
3. Consider the Corporate Transaction Structure: The 23andMe case illustrates the importance of structuring a transaction so that it does not trigger more onerous or prohibitive state-law requirements. Shifts in corporate ownership may be permissible in some instances without requiring affirmative consent from data subjects—provided existing data protections remain intact.
4. Develop Robust Protective Measures: Even where a proposed transaction is permissible under relevant laws, regulators and consumer protection agencies will scrutinize a company's post-transfer safeguards. Strong privacy and security commitments, as well as readily accessible data deletion or opt-out procedures, may help avert steep legal challenges.
5. Communicate Transparently with Consumers: Many of the objections against 23andMe and the purchaser arose from concerns that customers did not fully comprehend the possibility of data transfers in bankruptcy. Going forward, transparency and ongoing updates will help customers make informed decisions about their personal information.

Conclusion

The approval of 23andMe's asset transfer to TTAM confirms that bankruptcy sales may proceed with minimal, if any, new consent obligations, provided existing policies and regulatory requirements are satisfied. However, the persistent objections from various state attorneys general serve as a reminder that consumer data privacy, particularly where genetic information is involved, remains a point of intense legal scrutiny. Organizations managing this type of data should review their own privacy policies, acquisition and transfer mechanisms and consumer-communication strategies in anticipation of potential regulatory or judicial challenges. If you have questions regarding best practices for structuring a transaction or handling genetic data consistent with the growing patchwork of state-specific genetic privacy regulations, our interdisciplinary team remains available to help navigate these evolving standards.

Summer associate Anna Theil contributed to this alert.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.