Cybersecurity Policy Report, 23andMe Should Obtain Consent From Each Customer for Data Sale, Court Advised, (Jun 13, 2025)
Organizations Mentioned:Washington University
23andMe Holding Co.’s customers should be given the opportunity to consent to the sale of their personal data to whichever entity buys the company’s assets, a consumer privacy ombudsman has told the bankruptcy court handling 23andMe’s Chapter 11 case.
“Putting aside the issue of whether consent is legally required, as a best practice and important safeguard, the optimal solution from a consumer privacy perspective would be to mandate the Company to obtain separate, affirmative consent by each of the Company customers in order to sell or transfer customers’ data to the winning bidder,” according to Neil Richards, a Washington University law professor appointed by the U.S. Bankruptcy Court for the Eastern District of Missouri to advise the court on the privacy implications of 23andMe’s bankruptcy sale.
“Such consent would ideally be obtained by the Company prior to the transfer and would require the Company to request customers’ consent either via email or through the Company’s mobile application or website,” Mr. Richards said in a report to the court (In re: 23andMe Holding Co., et al., No. 25-40976 (Bankr. E.D. Mo. Mar. 23, 2025)).
“The consent mechanism would also be free of dark patterns or other uses of choice architecture or defaults to nudge the customers towards acceptance; in other words, it should be presented as a free and autonomous choice without attempts to influence the customer,” he said.
“Any customer who does not consent (within a reasonable time) should have their data deleted rather than transferred to the winning bidder,” he added.
An alternative safeguard, Mr. Richards recommended, would be for the consent request to come from the winning bidder “prior to using customers’ data (but after obtaining control of such data).”
“Requiring either the Company or the winning bidder to obtain consumers’ separate, affirmative consent would be most consistent with 23andMe’s promises that ‘privacy is in our DNA,’ ‘that each choice you make is an informed choice,’ that it empowered its customers by putting them ‘in control’ of their sensitive genetic data, and telling them repeatedly that it remained ‘your data,’” he asserted.
Mr. Richards also recommended that the winning bidder “commit in its Privacy Statement and consumer-facing representations to litigate any law enforcement requests for customer genetic data to the greatest extent possible under the law, such as, for example, demanding the presentation of a valid search warrant.”
He noted that consumer genomic data was “of great interest to law enforcement in the prosecution of crimes.”
The potential sale of 23andMe data has attracted significant interest from privacy advocates, state attorneys general, and Congress, with lawmakers in both the House and Senate holding hearings and calling for legislation to protect genetic data (CPR, June 11).
The recommendation that 23andMe customers be allowed to give affirmative consent to the transfer and use of their data would be consistent with the demands of state AGs, 28 of whom have asked the court to require individual consent (CPR, June 5), and California AG Rob Bonta (D.), who informed the court that California’s Genetic Information Privacy Act required such individual consent (CPR, June 9).
Mr. Richards’ 211-page report also described the “complex web of at a least a hundred federal, state, and international privacy and security laws implicating the data at issue” and suggested the privacy issues raised by the 23andMe bankruptcy were almost without precedent.
“It would not be hyperbole to conclude that this is one of the most—if not the most—sensitive collections of data about identified people ever sought to be discharged in bankruptcy, a conclusion buttressed by the extraordinary level of media, public, regulator, and lawmaker attention focused on the disposition of the personal data under this proceeding,” he said.
News: FederalLegislation LitigationEnforcement DataPrivacy