Cybersecurity Policy Report, 23andMe Data Must Remain Secure Post-Bankruptcy, FTC Chair Says, (Mar 31, 2025)
Organizations Mentioned:Federal Trade Commission
Overseers of the Chapter 11 bankruptcy filing of 23andMe Holding Co. should ensure that any eventual buyer of the genomics company’s assets abide by the promises 23andMe made to customers about protecting their genetic data, according to Federal Trade Commission Chairman Andrew Ferguson.
In a letter sent today to officials in the Department of Justice’s United States Trustee Program, which oversees federal bankruptcy cases, Mr. Ferguson said any entity that winds up with 23andMe’s data should be required to adopt the company’s existing privacy policy.
“23andMe collects and holds sensitive, immutable, identifiable personal information about millions of American consumers who have used the Company’s genetic testing and telehealth services,” he noted.
“This includes genetic information, biological DNA samples, health information, ancestry and genealogy information, personal contact information, payment and billing information, and other information, such as messages that genetic relatives can send each other through the platform,” he said.
“23andMe recognizes the unique sensitivity of the information it collects and maintains and has made direct representations to its users about how it uses, discloses, and protects their personal information, including how personal information will be safeguarded in the event of bankruptcy,” Mr. Ferguson told the trustees.
“The FTC believes that, consistent with Section 363(b)(1) of the Bankruptcy Code, these types of promises to consumers must be kept,” he said.
“This means that any bankruptcy-related sale or transfer involving 23andMe users’ personal information and biological samples will be subject to the representations the Company has made to users about both privacy and data security, and which users relied upon in providing their sensitive data to the Company,” he said.
“Moreover, as promised by 23andMe, any purchaser should expressly agree to be bound by and adhere to the terms of 23andMe’s privacy policies and applicable law, including as to any changes it subsequently makes to those policies,” Mr. Ferguson added. “These conditions would help protect users’ interests by ensuring that their data and personal information will be used consistent with 23andMe’s promises.”
MainStory: TopStory FederalLegislation LitigationEnforcement DataPrivacy