23andMe turned genetic data into a bankruptcy-governance test
In 2025, 23andMe filed for bankruptcy while holding genetic and linked personal data from more than 15 million customers.1 The case raised a basic question consent forms rarely answer: what protections follow genetic data through a sale, merger or institutional collapse? Consumer genetic testing companies generally sit outside HIPAA unless they are acting as covered entities or business associates, which leaves much of this protection to privacy policies, consumer-protection law and bankruptcy-court process. The signal is not that the data was simply unprotected. It is that the protection depended too much on the survival of the company holding it.