Who Owns Your DNA? 23andMe’s Collapse Sparks Debate Over Data Rights

In the spring of 2025, the once-celebrated genetic testing company 23andMe filed for Chapter 11 bankruptcy, marking a dramatic fall from its $6 billion peak just four years prior. The Silicon Valley darling, co-founded by Anne Wojcicki in 2006, had promised to unlock the secrets of ancestry and health through a simple saliva test. Millions obliged—over 15 million, to be exact—spitting into tubes and entrusting their genetic code to a company that marketed itself as a gateway to self-discovery. Now, with its stock value in tatters, a major data breach staining its reputation, and its assets poised for a court-supervised sale, a pressing question looms: Who really owns your DNA?

The collapse of 23andMe has ignited a fierce debate about data rights in an era where personal information is both a commodity and a liability. Unlike a password you can reset or a credit card you can cancel, DNA is immutable—uniquely yours, yet inextricably linked to your family, present and past. When you handed over your genetic material to 23andMe, you may not have realized you were also implicating your parents, siblings, and even distant cousins who never signed up. As privacy expert Carissa Veliz noted, "If you gave your data to 23andMe, you also gave genetic data of your kin who did not consent to that." This ripple effect amplifies the stakes of what happens next.

The Promise and the Peril

23andMe’s allure was irresistible: for about $100, you could trace your lineage back centuries or uncover genetic predispositions to conditions like Alzheimer’s or breast cancer. The company thrived on this one-and-done model, amassing a trove of 15 million genetic profiles. But its business faltered as customers rarely returned for more, and a devastating 2023 data breach—exposing the data of nearly 7 million users—shattered trust. By March 24, 2025, Wojcicki had resigned as CEO, and the company’s valuation had plummeted to a mere fraction of its former glory.

What remains is 23andMe’s most valuable asset: its genetic database. As part of bankruptcy proceedings, this data could be sold to the highest bidder—be it a pharmaceutical giant, a tech conglomerate, or even a foreign entity. The company’s privacy policy has always reserved the right to transfer customer information in the event of a sale or bankruptcy, a clause buried in fine print that few likely read. While 23andMe insists it prioritizes consent—80% of users opted into research partnerships like its deal with GlaxoSmithKline—new owners might not honor those commitments. A new privacy statement could emerge, and customers would face the familiar dilemma: agree or lose access.

The Legal Gray Zone

Here’s the rub: your DNA isn’t protected the way you might think. The Health Insurance Portability and Accountability Act (HIPAA), often cited as a shield for medical privacy, doesn’t apply to direct-to-consumer companies like 23andMe. Federal safeguards are scant, leaving a patchwork of state laws to fill the void. California and Florida, for instance, grant consumers rights to request data deletion, but even that’s not foolproof. Once anonymized and shared—say, with a drug company or research lab—your genetic data can’t be clawed back. “You can’t find it because it doesn’t have your name attached anymore,” explains Anya Prince, a genetic privacy expert at the University of Iowa.

This legal ambiguity fuels the debate over ownership. When you mailed your saliva to 23andMe, did you surrender your DNA to a corporation? Or does it remain yours, a sacred extension of your identity? The company’s terms of service lean toward the former, treating your genetic data as an asset it can leverage—albeit with consent for research. Critics argue this setup exploits consumer naivety. “People didn’t understand the downstream risks,” says Eva Galperin of the Electronic Frontier Foundation, which has urged users to delete their data before it’s too late.

The Stakes Beyond the Individual

The implications stretch far beyond personal privacy. Your DNA could end up in the hands of insurers, who might raise premiums based on genetic risks (a practice legal for life, disability, and long-term care policies despite the 2008 Genetic Information Nondiscrimination Act). Law enforcement could tap it for cold cases, as they’ve done with other databases like GEDmatch, even though 23andMe has resisted such requests to date. Pharmaceutical companies might mine it for profit-driven drug development, a prospect 23andMe itself pursued with mixed success. And in a globalized world, there’s no ruling out foreign buyers—imagine a state-backed entity with your family’s genetic blueprint.

Then there’s the familial fallout. Your decision to test with 23andMe didn’t just expose your data—it exposed your relatives’ too. A 2018 study showed that with just 1.3 million profiles, most white Americans could be identified through genetic likenesses. If 23andMe’s database is sold, the privacy of millions who never consented could be compromised. It’s a collective vulnerability that challenges the very notion of individual control.

A Call for Clarity

As 23andMe’s fate unfolds, advocates are pushing for stronger protections. California Attorney General Rob Bonta has advised residents to delete their data, citing the state’s robust privacy laws. But deletion isn’t a panacea—data already shared or retained for “legal compliance” (like birth dates and sex) may linger. Some propose a radical rethink: treat genetic data as a public trust, not a corporate asset, with strict rules on its use and transfer. Others suggest companies like 23andMe should pay users for their DNA, flipping the script on who profits.

For now, the debate rages as 23andMe’s customers watch anxiously. Did they trade their most intimate information for a fleeting glimpse of ancestry? Or can they still reclaim what’s theirs? One thing is clear: the collapse of 23andMe has laid bare a truth we’ve long ignored—your DNA may be yours by nature, but in the digital age, ownership is up for grabs.