Judge OKs sale of 23andMe — and its trove of DNA data — to a nonprofit led by its founder

A bankruptcy judge has approved the sale of the insolvent genetics firm 23andMe to a nonprofit run by one of the company’s co-founders. The deal effectively avoids the controversial transfer of DNA data to a third party.

The prospect of 23andMe’s trove of genetic information on millions of people passing to the highest bidder had sparked outcry when it was announced in May that New York-based Regeneron Pharmaceuticals had won an auction to acquire the firm for $256 million.

23andMe customers use saliva-based DNA testing kits to learn about their ancestry and potential gene-based risks for disease. The company stores the data — and spit samples — and sends users an analysis of their genetic information.

Despite Regeneron’s pledges to honor 23andMe’s privacy policies, more than two dozen states sued to halt the deal, arguing that genetic information is a unique and fundamentally different type of property than the kind that might normally change hands in a bankruptcy sale. (Think real estate, or office furniture.)

The bidding was re-opened, and the nonprofit TTAM Research Institute won with a bid of $305 million.

TTAM Research Institute was set up in May by Anne Wojcicki, a co-founder and former CEO of 23andMe, to acquire the company’s assets and use the DNA data for medical research. Some 80% of 23andMe’s more than 15 million customers have agreed to allow their data to be used for research, according to the company.

The TTAM acronym is a nod to “twenty-three and me.” The institute also pledged to improve privacy policies, and continue to allow customers to delete their data at will, as 23andMe already does.

In a filing late on Friday, Judge Brian Walsh of the U.S. Bankruptcy Court in the Eastern District of Missouri, in St. Louis, wrote that the current structure of the deal “involves a sale of customer data only in a technical sense.”

The states’ suit had sought to ensure that consumers have full control over genetic information, which is highly personal and unchangeable.

Justin Leonard, a lawyer who represented Oregon in the states’ lawsuit, said that this outcome would satisfy the states’ concerns: “It’s going to be under the same privacy policies, the same cybersecurity protections, same management as it was before.”

But not all of the states agree. The judge’s ruling noted that a handful of states — California, Kentucky, Tennessee, Texas, and Utah — “remain actively opposed to the sale.” Leonard says those opposed to the sale have until midnight on July 7 to be granted a stay in order to appeal.

23andMe and TTAM did not immediately respond to a request for comment about the ruling.

The legal battle has centered on the risks and unknowns of selling consumers’ DNA data to a third party after a bankruptcy. And for customers like Kyle, that sense of risk was heightened after 2023, when hackers accessed the genetic information of millions of 23andMe customers.

Kyle said he began to worry about his family’s genetic data even more after a 2024 lawsuit alleged that 23andMe had failed to notify Chinese and Ashkenazi Jewish customers that their data had been targeted and was being sold online in curated lists — a potential safety risk. Kyle’s family had learned, through a 23andMe test, that one side was Ashkenazi Jews.

“It was definitely affirming,” said Kyle, who asked NPR to use only his first name out of concern that his family may be targeted. “And I would say we mostly forgot about it after that.”

That, in a nutshell, was the problem with 23andMe’s business model: It was a one-and-done product. Once people learned about their genealogy and genetic health risks, many forgot about 23andMe, and the company struggled to attract repeat customers.

When it was announced that 23andMe would be sold to Regeneron, Kyle decided to delete his family’s data altogether.

“I think historically there is a concern amongst the Jewish community for people knowing who we are, where we live and our genealogy. And if that information gets into the wrong hands it’s very dangerous,” he said.

He said he is not confident the data is guaranteed to be secure, even under TTAM Research Institute.

In his ruling, Judge Walsh wrote that the sale of genetic data “is a scary proposition.” But he added that lawmakers had not banned it, and in this case an “absolute prohibition” could result in missed opportunities, although he did not spell out what those opportunities might be.

Last year, 23andMe agreed to a settlement in the data breach suit without admitting wrongdoing. Walsh wrote that the funds from the sale to TTAM Research Institute “may be sufficient to compensate all of the company’s creditors, including customers who were harmed by a data breach.”

The case casts a spotlight on the lack of laws safeguarding genetic privacy and questions about how DNA data should be considered as legal property, says Laura Coordes, an expert in bankruptcy at Arizona State University’s law school.

“My hope is that the issues that this case raises and the attention that it’s gotten will in turn spur some meaningful thought about data privacy protections, and those protections in a bankruptcy,” she said.

“I do think on some level there are legislative moves that need to be made and that I would like to see,” she said. “That’s how you ensure that you don’t have all of this upheaval and all of these reactions from the state and the federal government, and the public … you work to strengthen the baseline protections in the long term.”