23andMe has officially been sold: What will happen to customers’ data?

The sale of 23andMe was finalized this week, following the company filing for bankruptcy in March. The sale was previously approved by a judge.

The company was purchased by the nonprofit TTAM Research Institute, which is led by 23andMe cofounder Anne Wojcicki. TTAM purchased “substantially all” of the San Francisco based company’s assets for $305 million, per The Associated Press.

“I am incredibly excited and humbled to share with you that TTAM Research Institute (TTAM), a new nonprofit medical research organization that I founded and lead, has completed the acquisition of 23andMe,” Wojcicki wrote in a post on X.

“I formed TTAM and pursued the acquisition of 23andMe because of my strong belief that everyone should continue to have the ability to learn about and benefit from their DNA, and that a non-profit structure is the best way to solidify our values and commitments to our customers, the scientific community and the world at large,” the post continued.

The sale was approved by U.S. Bankruptcy Judge Brian C. Walsh and comes after a months-long bidding war between TTAM and Regeneron Pharmaceuticals, per The AP. Regeneron is a biotech company that previously bid to purchase 23andMe in May for $265 million, but Wojcicki’s nonprofit topped the offer.

Multiple states, including California, Utah, Tennessee and Texas were actively opposed to the sale, according to NPR.

23andMe continues to operate as a part of TTAM

According to a press release from 23andMe, TTAM acquired the company’s Personal Genome Service and its research operations.

23andMe will continue to operate and provide its customers with DNA testing and research services, but now will be structured as a nonprofit.

The company’s customers are able to use saliva-based DNA testing kits to learn about their potential gene-based risks for disease as well as their ancestry, per NPR. 23andMe stores the data along with spit samples, and sends the users a DNA analysis.

“TTAM is committed to providing customers with choice and transparency with their data, including the option to change their decision on whether to participate in research,” per the release announcing the completion of the sale.

Are there still data privacy concerns after the sale?

TTAM says it will be adding additional privacy protections, but there are still concerns about the privacy of customers’ data, per The AP.

“We are changing 23andMe’s privacy practices — to add to and enhance them,” Wojcicki wrote in an email to The Washington Post. “We are giving additional notice, have put further restrictions on use of data, and have agreed to an independent privacy advisory board.”

According to The Washington Post, the attorneys general of Maryland, North Carolina, Connecticut and California recommend that people delete their 23andMe accounts. There are multiple ways for this to be done, even for those who have forgotten their login information.

Keeping the company’s data private is important because 23andMe holds arguably “the most sensitive collections of data about identified people ever sought to be discharged in bankruptcy,” wrote Neil M. Richards, the Washington University professor who served as privacy ombudsman for the bankruptcy court, according to The Washington Post.

People’s genes can’t be changed, and they can be used to discriminate or to reveal information about relatives and future generations that didn’t give permission. As technology and science advances, according to The Washington Post, information about genes become more valuable and potentially dangerous.

Why are people still concerned about 23andMe’s data privacy?

Customers of 23andMe’s genetics services are not protected by America’s health-privacy law HIPAA, because it’s not a health care provider or insurance company, per The Washington Post.

While existing 23andMe customers are able to delete their data, or opt out of TTAM’s research, the new nonprofit is not asking for opt-in permission before taking ownership of information about people’s DNA.

There is also still the possibility that 23andMe’s DNA data could be sold again.

“There is nothing in 23andMe’s bankruptcy agreement or privacy statement to prevent TTAM from selling or transferring DNA to some other organization in the future,” per the Washington Post.

Another reason people have concerns is because of a major data breach that occurred in the company’s past.

In 2023, a data breach impacted around 7 million customers of 23andMe. This “set trust in its business on a downward spiral,” per The Washington Post.