Congress launches investigation into 23andMe’s handling of genetic data

Congress to investigate 23andMe over potential sale of customer genetic data

Lawmakers raise alarm over privacy risks following bankruptcy and CEO departure

Biotechnology firm 23andMe, once a leader in consumer DNA testing, is now facing a Congressional investigation into how it handles its customers’ genetic and personal data. The inquiry follows the company’s recent Chapter 11 bankruptcy filing, the departure of its CEO, and ongoing efforts to find a buyer for its assets.

On Friday, the House Committee on Energy and Commerce sent a letter to 23andMe demanding answers on how the company intends to protect the sensitive health and genetic information of its approximately 15 million users in the event of a sale.

Genetic data at risk amid bankruptcy proceedings

The committee, led by Chair Rep. Brett Guthrie (R-KY) and Subcommittee Chairs Rep. Gus Bilirakis (R-FL) and Rep. Gary Palmer (R-AL), raised concerns that 23andMe’s privacy policy explicitly allows the sale or transfer of personal information in the event of bankruptcy.

“A judge recently ruled 23andMe has the right to sell the sensitive medical and genetic information of its 15 million customers, which is considered to be the company’s most valuable asset,” the lawmakers wrote.

The letter underscores the lack of comprehensive federal privacy legislation protecting Americans' health data, especially as 23andMe is not governed by the Health Insurance Portability and Accountability Act (HIPAA).

Key questions from lawmakers

The committee’s letter includes a series of pointed questions directed at 23andMe, asking the company to clarify:

• How it intends to vet potential buyers of its customer data

• What protocols it has in place to prevent misuse of sensitive information

• Whether customers will be notified or given a choice before any data transfer occurs

The lawmakers requested a full response by May 1, 2025. As of this writing, 23andMe has not issued a public comment regarding the investigation.

Privacy concerns grow after past breaches and leadership shake-up

This isn’t the first time 23andMe has come under scrutiny. The company previously faced backlash over a major data breach that led to a lawsuit. The breach affected the personal information of millions of users, many of whom were unaware that their genetic profiles were potentially exposed.

Compounding the crisis, co-founder and long-time CEO Anne Wojcicki stepped down in March, just weeks before the bankruptcy announcement. Her departure marked a turning point for the company, which had once been hailed as a pioneer in consumer genomics.

What customers can do now

In the wake of the bankruptcy news and the mounting privacy concerns, tech and consumer advocates are urging 23andMe users to take control of their data. Guides on how to delete your genetic data from 23andMe have circulated widely, emphasizing that now is the time to act if users want to safeguard their personal information.

The bigger picture: genetic data and digital privacy

The 23andMe case highlights a significant gap in U.S. data protection laws. Genetic data, unlike traditional health records, often falls outside of HIPAA protections, leaving consumers vulnerable when companies face financial distress or change ownership.

As Congress considers broader privacy reforms, the investigation into 23andMe could become a high-profile case study in the risks of unregulated biometric data markets. Whether the company can reassure regulators—and its customers—remains to be seen.

Stay with The Horizons Times for ongoing coverage of data privacy, biotechnology, and Congressional investigations into consumer protection.