What Happens to Your DNA Data If the Company Is Sold?

Why a sale is different from a breach

A breach is an accident. A sale is a planned transfer, and in most cases your data moves with the business because it is one of the business's main assets. Whether that's allowed, and on what terms, depends on three things: the company's own privacy promises, the laws that apply to it, and, in a bankruptcy, the court. The 23andMe case in 2025 tested all three in public, so it's the clearest example available.

The 23andMe case, step by step

What the ombudsman found

According to a law firm summary of the report, the ombudsman concluded that a typical customer probably didn't understand the privacy statement to cover a transfer in bankruptcy. The statement had been updated many times and didn't mention bankruptcy before June 2022. He recommended affirmative customer consent before transfer, deletion for customers who didn't consent, actual notice to every user, and binding commitments from the buyer to keep or improve existing protections.

What the buyer promised

In the June 13 announcement, 23andMe said TTAM had committed to:

• comply with the company's privacy policies and applicable law;
• keep letting people delete their account and genetic data and permanently opt out of research;
• email customers at least two business days before closing, with instructions for deleting data or opting out;
• not sell or transfer genetic data in a later bankruptcy or change of control unless the recipient adopts TTAM's privacy policies and complies with applicable law;
• set up a Consumer Privacy Advisory Board within 90 days of closing and prepare annual reports available to attorneys general on request.

These are the company's own descriptions of the commitments, not a court ruling. They do show what a buyer can be pushed to promise when regulators and an ombudsman are watching.

Why the court could approve it

Under the Bankruptcy Code, if a company's privacy policy prohibits transferring personal information to unaffiliated parties, it can only sell that information if the sale is consistent with the policy or a court approves it after appointing a consumer privacy ombudsman. Even then, the court has to find no showing that the sale would violate applicable non-bankruptcy law (11 U.S.C. § 363(b)(1)). As reported by AP, Judge Walsh called selling genetic data "a scary proposition" but noted that lawmakers hadn't banned it.

How change-of-control clauses work

Most privacy policies have a clause covering mergers, acquisitions and bankruptcy. They come in roughly three strengths:

1. Data is a transferable asset. The policy says your information may pass to a buyer, with no added conditions.
2. Promises travel with the data. The buyer must honor the existing policy, at least for data collected under it.
3. Restricted transfer. Genetic data can only go to a buyer that meets set conditions and adopts the policy, or not at all. 23andMe's current statement now uses this approach.

Even the strongest clause has a limit. A buyer that inherits a policy can usually change it later, though the FTC has taken the position that a company can't unilaterally apply material privacy policy changes to data it already collected. Our walkthrough of the privacy clauses that matter shows how to find this clause in any company's policy.

What the law requires

As the judge noted, lawmakers have not banned the sale of genetic data outright. Much of the protection comes from state law, which varies widely.

• California. The Attorney General's alert notes that under California's Genetic Information Privacy Act (GIPA), Californians can delete their account and genetic data, have their sample destroyed, and revoke consent for collection, use and disclosure. California's position in the case was that GIPA requires opt-in consent before genetic data is sold to third parties.
• Other states. Many states have their own genetic privacy, consumer privacy or health data laws. NHGRI keeps a searchable Genome Statute and Legislation Database of state bills and statutes (covering sessions through 2024).
• Federal proposals. The Don't Sell My DNA Act (S. 1916), introduced in the Senate in May 2025 with a House companion that July, would add genetic information to the Bankruptcy Code's definition of personally identifiable information and require notice and consent before it is sold in bankruptcy. Check its current status before assuming it is law.

For a broader map of who oversees these companies, see HIPAA, GINA and the gaps.

What you can do if your company is sold

The steps are the same whether a sale is rumored, announced or finished. Do them in this order, because deletion comes last.

1. Download your data. Get your raw data file and any reports you want to keep. Our genome storage and backup guide covers keeping copies safe, and the file inspector confirms what you downloaded without uploading it.
2. Revoke research consent. This stops new research use. It won't reverse research already done.
3. Request sample destruction. If you ever agreed to sample storage, change that setting or contact support in writing.
4. Delete your account and data. Expect a confirmation email. Keep it, along with the date.
5. Check the exceptions. Read what the policy says is kept after deletion, such as lab compliance records, so you know what remains.

If you're choosing a new test, our genetic privacy checklist includes the change-of-control question.

Common questions

Keep going

Sources

Checked in October 2026: filing date, court and closing date from 23andMe's SEC filing; the TTAM agreement and buyer commitments from 23andMe's June 13, 2025 press release; the ombudsman's appointment from WashU Law; the ombudsman's findings from a Loeb & Loeb summary; the state coalition from the Colorado Attorney General; the deletion figure from STAT's report on the June 10, 2025 hearing; the court approval and states still opposed from AP reporting via KPBS; GIPA rights from the California Attorney General; the bill from Sen. Cornyn's and Rep. Lofgren's offices. Left out: purchase prices, the exact approval-order date (reports differ) and the current status of S. 1916, which we could not confirm.

• 23andMe 10-Q note on bankruptcy and sale (SEC)
• 23andMe: Agreement for sale to TTAM Research Institute
• California AG: Consumer alert for 23andMe customers
• Colorado AG: Multistate action in 23andMe bankruptcy
• 11 U.S.C. § 363 (Cornell LII)
• WashU Law: Consumer privacy ombudsman appointment

Educational content, not medical advice. A genetic result is information, not a diagnosis; for anything medically important, talk to a qualified clinician or genetic counselor. Some outbound links are affiliate links; see the disclosure.