Genetic testing company 23andMe is facing growing scrutiny after revealing that nearly 2 million of its users have asked the company to delete their genetic data in the wake of its bankruptcy proceedings.
Speaking before the U.S. House Oversight Committee on Tuesday, interim CEO Joseph Selsavage confirmed that approximately 1.9 million customers—around 15% of the company’s user base—have submitted deletion requests since March, when the company filed for Chapter 11 bankruptcy protection. The move triggered fears among customers and privacy advocates that their sensitive genetic information could be transferred to a third party without consent.
These concerns intensified when pharmaceutical company Regeneron emerged as the winning bidder in a court-approved auction held in May, offering $256 million to acquire 23andMe’s assets. Regeneron stated that it plans to utilize the genetic data to support new drug research while maintaining the privacy protections previously upheld by 23andMe.
A federal bankruptcy court is expected to make a final decision on the sale later in June.
The company’s financial troubles follow a significant cybersecurity incident last year, where the personal and genetic details of 6.9 million users were exposed in a breach. Rather than acknowledging internal security failures, 23andMe controversially placed the blame on users, citing their failure to enable multi-factor authentication. The breach went undetected for several months, raising questions about the company’s ability to protect highly sensitive information.
Adding to the pressure, attorneys general from more than 25 U.S. states—including Florida, New York, and Pennsylvania—filed lawsuits on Tuesday to block the sale of customer data. The legal challenge argues that 23andMe cannot legally transfer user information without obtaining explicit consent from each individual, regardless of the bankruptcy status.
The controversy has cast a shadow over the future of genetic data privacy in the consumer health space. With millions of people having trusted companies like 23andMe with deeply personal information, the current situation serves as a stark reminder of the risks associated with handing over genetic data to private firms—especially those facing financial instability.
The outcome of the court’s upcoming ruling and the states’ legal challenge could set a powerful precedent for how genetic data is handled in similar cases moving forward.
