Judge approves 23andMe sale amid privacy dispute

A bankruptcy judge has approved the sale of 23andMe to the nonprofit TTAM Research Institute, owned by cofounder and former CEO of 23andMe Anne Wojcicki, thereby ensuring that the DNA of the company’s customers will not be transferred to a third party. 

Publicly traded 23andMe collects saliva-based DNA from customers via its testing kits to provide information on their ancestry and potential risk for disease. The company stores users’ data and spit samples, then provides an analysis of their genetic information.

TTAM, a nod to “twenty-three and me,” agreed to purchase nearly all of the company’s assets for $305 million, which Judge Brian Walsh of the U.S. Bankruptcy Court in the Eastern District of Missouri has now approved.

THE LARGER TREND

In March, 23andMe filed for Chapter 11 in the Eastern District of Missouri to facilitate a sales process. 

At the time, Wojcicki resigned from her role as CEO and Joe Selsavage, chief financial and accounting officer, was named interim CEO by the board.

During the bankruptcy proceedings, New York-based Regeneron Pharmaceuticals won an auction to acquire the company for $256 million.

Subsequently, a group of 27 states and the District of Columbia filed a lawsuit to prevent 23andMe from selling customers’ genetic data without their explicit consent, specifically in the context of the acquisition by Regeneron. 

The lawsuit argued that genetic data is uniquely sensitive and should not be treated as a commodity or other property.

According to NPR, a lawyer representing Oregon stated the sale satisfies the state’s concerns; however, the judge’s ruling noted that a handful of states, including Kentucky, California, Tennessee, Texas and Utah, remain opposed to the sale. Those opposed have until midnight on July 7 to be granted a stay to appeal the decision. 

Pennsylvania Attorney General Dave Sunday announced that he, along with a coalition of attorneys general, supports the sale of 23andMe, which he says will protect consumer data. Pennsylvania was one of the states that filed a lawsuit to block the sale of 23andMe’s customers’ data.

Following the bankruptcy announcement in March, California Attorney General Rob Bonta issued an urgent consumer alert advising users to request that the company delete their genetic data.

Bonta’s office continues to object to the sale to TTAM, stating that it does not comply with California’s Genetic Information Privacy Act, which requires companies to obtain opt-in consent from customers before selling their genetic information to third parties.   

In 2023, 23andMe experienced a significant data breach that affected approximately seven million of its users. The breach exposed user data, including ancestry information and some health-related data.  

The data breach involved a “credential stuffing” attack, a type of cyberattack in which the attacker collects stolen account credentials, including usernames and passwords, and attempts to log in to other unrelated platforms. 

The incident led to a class-action lawsuit and a proposed settlement of $30 million. 

A bankruptcy judge has approved the sale of 23andMe to the nonprofit TTAM Research Institute, owned by cofounder and former CEO of 23andMe Anne Wojcicki, thereby ensuring that the DNA of the company’s customers will not be transferred to a third party. 

Publicly traded 23andMe collects saliva-based DNA from customers via its testing kits to provide information on their ancestry and potential risk for disease. The company stores users’ data and spit samples, then provides an analysis of their genetic information.

TTAM, a nod to “twenty-three and me,” agreed to purchase nearly all of the company’s assets for $305 million, which Judge Brian Walsh of the U.S. Bankruptcy Court in the Eastern District of Missouri has now approved.

THE LARGER TREND

In March, 23andMe filed for Chapter 11 in the Eastern District of Missouri to facilitate a sales process. 

At the time, Wojcicki resigned from her role as CEO and Joe Selsavage, chief financial and accounting officer, was named interim CEO by the board.

During the bankruptcy proceedings, New York-based Regeneron Pharmaceuticals won an auction to acquire the company for $256 million.

Subsequently, a group of 27 states and the District of Columbia filed a lawsuit to prevent 23andMe from selling customers’ genetic data without their explicit consent, specifically in the context of the acquisition by Regeneron. 

The lawsuit argued that genetic data is uniquely sensitive and should not be treated as a commodity or other property.

According to NPR, a lawyer representing Oregon stated the sale satisfies the state’s concerns; however, the judge’s ruling noted that a handful of states, including Kentucky, California, Tennessee, Texas and Utah, remain opposed to the sale. Those opposed have until midnight on July 7 to be granted a stay to appeal the decision. 

Pennsylvania Attorney General Dave Sunday announced that he, along with a coalition of attorneys general, supports the sale of 23andMe, which he says will protect consumer data. Pennsylvania was one of the states that filed a lawsuit to block the sale of 23andMe’s customers’ data.

Following the bankruptcy announcement in March, California Attorney General Rob Bonta issued an urgent consumer alert advising users to request that the company delete their genetic data.

Bonta’s office continues to object to the sale to TTAM, stating that it does not comply with California’s Genetic Information Privacy Act, which requires companies to obtain opt-in consent from customers before selling their genetic information to third parties.   

In 2023, 23andMe experienced a significant data breach that affected approximately seven million of its users. The breach exposed user data, including ancestry information and some health-related data.  

The data breach involved a “credential stuffing” attack, a type of cyberattack in which the attacker collects stolen account credentials, including usernames and passwords, and attempts to log in to other unrelated platforms. 

The incident led to a class-action lawsuit and a proposed settlement of $30 million.