23andMe filed for bankruptcy in March 2026. The company is being sold. And buried in its Privacy Statement is a clause that says your genetic data — the most personal information that exists — may be transferred to the new owner as a business asset.
This is not speculation. It is in the archived Terms of Service and Privacy Statement that ConductAtlas has tracked since the company's founding.
What the provision says
The 23andMe Privacy Statement includes a Business Asset Transfer clause that states: if 23andMe is acquired, merges with another company, or goes through bankruptcy, your personal and genetic data may be transferred to the new owner as a business asset.
This is standard boilerplate in most privacy policies. The difference here is that 23andMe holds genetic data — your DNA, your health predispositions, your ancestry, your biological family connections. That data does not expire. It cannot be changed. And it is among the most sensitive information a company can hold about you.
Who might buy it
The bankruptcy court is overseeing the sale. Potential buyers could include pharmaceutical companies, biotech firms, insurance companies, or data brokers. 23andMe has previously shared de-identified genetic data with pharmaceutical and biotech companies for research. A new owner would inherit both the data and the existing consent framework.
23andMe also has a Research Consent provision that allows the company to share de-identified genetic and health data with third-party researchers, including pharmaceutical and biotech companies, if you opted into their research program. That consent travels with the data to any new owner.
The arbitration problem
If something goes wrong with how a new owner handles your data, 23andMe's Terms of Service include a Mandatory Individual Arbitration clause and a Class Action Waiver. You cannot join other affected customers in a collective legal action. You must pursue any dispute individually through private arbitration.
Combined with the bankruptcy transfer provision, this means your data could end up with a company you never agreed to share it with, and your legal recourse to challenge that is severely limited.
What you can do right now
23andMe allows users to delete their data. Before the sale closes, you should consider requesting deletion of your genetic data from 23andMe's systems.
To delete your data: log in to your 23andMe account, go to Settings, scroll to the bottom, and select Delete Account. You can also separately request deletion of your genetic data before closing your account.
Note that deletion requests may take time to process, and some data may be retained for legal compliance reasons. If you previously consented to research use, that consent and the associated de-identified data may already have been shared with third parties and cannot be recalled.
What compliance teams need to know
Organizations that used 23andMe for employee health programs, benefits administration, or any purpose involving employee genetic data have a heightened compliance obligation. A change of ownership in a bankruptcy proceeding may trigger notification requirements under HIPAA, GINA, and applicable state genetic privacy laws including the Illinois Genetic Information Privacy Act and California's CMIA.
ConductAtlas has archived the full 23andMe Privacy Statement and Terms of Service with complete version history and provision-level analysis.