The precarious future of consumer genetic privacy

Abstract

After declaring bankruptcy in March 2025, direct-to-consumer (DTC) genetic testing company 23andMe sold the data of more than 15 million people around the world to TTAM Research Institute, a nonprofit organization created by 23andMe’s founder and long-time CEO. 23andMe’s customers might breathe a sigh of relief that their data didn’t end up in the hands of different leadership. But the saga made salient the ways in which existing laws fail to fully protect genetic data against exploitation and misuse. Commercial sales of genetic data have happened before, and they will happen again. The next data sale is likely to involve a buyer unrelated to the seller, which may result in fewer privacy protections. Congress has finally expressed interest in taking action, but proposed legislation does not provide adequate or genuine consumer protection.