After Foley Hoag's prior updates regarding the chapter 11 bankruptcy cases of 23andMe Holding
Co and its affiliated debtors (collectively, "23andMe"),
the United States Bankruptcy Court for the Eastern District of
Missouri (the "Court") approved the sale of 23andMe's
genetic data. On July 14, 2025, a notice of the closing of the sale was filed in
bankruptcy court. This sale process informs best practices for
companies and other entities handling sensitive personal
information.
The Court approved the sale of 23andMe's genetic data and
personal information assets to TTAM Research Institute
("TTAM"), an entity founded by Anne Wojcicki, the former
CEO and co-founder of 23andMe. TTAM was deemed the successful
bidder over the bid of a leading biotechnology company, Regeneron. Although several states filed
objections seeking to prohibit or condition the transfer of genetic
data on customers providing explicit, informed consent, the Court
determined the transaction as structured did not violate applicable
privacy policies or state genetic privacy laws and approved the
sale to TTAM.
States' Concerns and Objections
A central point of contention was the transfer of genetic data
without the renewed, opt-in consent of existing 23andMe customers.
Several states argued that, under their specific laws, customers
hold strong property or privacy rights in their genetic material
and data. Those state-level statutes typically require explicit
permission for any sale or transfer of genetic data. In response to
these objections, 23andMe and TTAM contended that because the
acquiring entity would honor the existing privacy commitments and
maintain the company's privacy policy, no separate opt-in
consent was legally required. The states' arguments reached
beyond mere statutory requirements; many contended that allowing a
broad bankruptcy sale would conflict with consumers' reasonable
expectations, particularly individuals who signed up before
23andMe's language on possible bankruptcy transfers appeared in
updated policies.
Outcome and Court's Reasoning
Despite the potential for these arguments to create significant
roadblocks, the Court concluded that the new ownership
structure—often referred to as the "equity toggle,"
whereby 23andMe's genetic data assets are initially placed into
a wholly owned subsidiary ("Newco") before equity in that
Newco is sold—did not constitute a "transfer" to a
third party in a manner triggering explicit consent requirements
under many of the cited state statutes and complied with
23andMe's privacy policy. The transaction's design,
according to the Court, did not violate state law because it did
not involve a direct asset transfer of data to an entirely separate
corporate entity. Rather, the equity sale allowed the
plaintiff-debtor to continue operating under the same data-use
policies, with ownership simply shifting at the parent-company
level.
Additionally, the Court emphasized the enhanced protections TTAM
plans to adopt, including continued respect for customers'
ability to delete data and opt out of research uses. The Court
concluded that such measures serve to mitigate privacy and security
risks otherwise associated with the change in corporate ownership.
California appealed the bankruptcy court's decision overruling its objection, but after a brief administrative
stay, the district court denied its motion to halt the sale. Of
importance, while the Court held that the Privacy Ombudsman's suggestions were
commercially unfeasible and too impractical to impose against the
bankruptcy estate, the Court noted that there were several privacy
concerns that could be addressed to Congress and state legislatures
to evaluate.
Practical Implications for Entities Handling Genetic
Data
These recent proceedings in the 23and Me bankruptcy case highlight
key considerations for any organization that possesses genetic or
similarly sensitive data:
- Maintain Up-to-Date Privacy Policies: Courts may closely evaluate whether an organization's privacy policies have explicitly contemplated the scenario of a sale, merger, or bankruptcy. Clear, early disclosure can help mitigate or defend against future consent objections.
- Obtain Consent Aligning with State Requirements: Entities operating in multiple jurisdictions should track varying levels of consent procedures mandated by genetic privacy laws. Inconsistent or incomplete consent forms may be challenged, particularly where states have strict provisions requiring a renewed, opt-in basis.
- Consider the Corporate Transaction Structure: The 23andMe case illustrates the importance of structuring a transaction so that it does not trigger more onerous or prohibitive state-law requirements. Shifts in corporate ownership may be permissible in some instances without requiring affirmative consent from data subjects—provided existing data protections remain intact.
- Develop Robust Protective Measures: Even where a proposed transaction is permissible under relevant laws, regulators and consumer protection agencies will scrutinize a company's post-transfer safeguards. Strong privacy and security commitments, as well as readily accessible data deletion or opt-out procedures, may help avert steep legal challenges.
- Communicate Transparently with Consumers: Many of the objections against 23andMe and the purchaser arose from concerns that customers did not fully comprehend the possibility of data transfers in bankruptcy. Going forward, transparency and ongoing updates will help customers make informed decisions about their personal information.
Conclusion
The approval of 23andMe's asset transfer to TTAM confirms that
bankruptcy sales may proceed with minimal, if any, new consent
obligations, provided existing policies and regulatory requirements
are satisfied. However, the persistent objections from various
state attorneys general serve as a reminder that consumer data
privacy, particularly where genetic information is involved,
remains a point of intense legal scrutiny. Organizations managing
this type of data should review their own privacy policies,
acquisition and transfer mechanisms and consumer-communication
strategies in anticipation of potential regulatory or judicial
challenges. If you have questions regarding best practices for
structuring a transaction or handling genetic data consistent with
the growing patchwork of state-specific genetic privacy
regulations, our interdisciplinary team remains available to help
navigate these evolving standards.
Summer associate Anna Theil contributed to this alert.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.