When you spit into a plastic tube and mail it to a genetic testing company, you expect a neat breakdown of your ancestry and a chart of health predispositions. You probably don't expect your intimate biological blueprint to become a bargaining chip in a corporate bankruptcy proceeding. Yet that is precisely what happened with 23andMe, culminating in a fresh $6 million legal resolution with the state of California that highlights just how vulnerable direct-to-consumer genetic records truly are.
California Attorney General Rob Bonta secured a $6 million payout from Chrome Holding Co.—the corporate successor to 23andMe—following a bitter legal battle over a massive 2023 data breach and subsequent asset sales. The breach compromised the records of nearly 7 million users nationwide, including more than 855,000 residents in California alone. While corporate entities shuffle names, file for Chapter 11 bankruptcy protection, and spin off non-profits, everyday consumers are left wondering what happens to their raw DNA sequence sitting on remote servers.
The Real Cost of Corporate Collapse
Direct-to-consumer genetic testing boomed on the promise of self-discovery. Millions paid out of pocket to find out where their ancestors lived or whether they carried markers for specific hereditary health conditions. But companies built on massive databases of sensitive biological data face unique existential risks when they hit financial trouble.
When 23andMe filed for bankruptcy in March 2025, it didn't just lock its doors. It sold off valuable assets, including millions of genetic profiles and biological samples, to TTAM Research Institute—a non-profit founded by the company's former CEO. That asset transfer triggered immediate alarm bells. California regulators objected, arguing the sale violated the state's Genetic Information Privacy Act, which demands explicit, separate customer consent before anyone can transfer or sell biological data.
Although courts initially permitted the asset transfer to move forward, the state's persistent legal pressure forced a reckoning. The newly announced $6 million settlement resolves those lingering claims and appeals, proving that state privacy watchdogs are paying close attention when tech companies try to liquidate human genomes to pay off creditors.
Why the Bankruptcy Loophole Terrifies Privacy Advocates
For years, privacy lawyers warned about the legal gray area surrounding consumer health data during corporate liquidations. Traditional consumer protection laws often treat user data like standard intellectual property or customer lists. If a retail website goes bankrupt, customer email addresses and purchase histories get sold to the highest bidder as part of the inventory.
Your DNA is not an email address. It cannot be changed when compromised, and it implicates your biological relatives, children, and future generations who never consented to testing.
When 23andMe split, reorganized, and transferred assets, it exposed a gaping hole in federal and state oversight. Companies gather the most intimate information imaginable, yet standard corporate bankruptcy rules treat that data as corporate property to be monetized. Even though California's attempt to completely block the asset sale was denied by bankruptcy and district courts, extracting a multi-million-dollar penalty establishes a hard precedent. Companies cannot simply ignore state privacy mandates just because they reorganize under Chapter 11.
How to Wipe Your DNA Clean Right Now
If you were one of the millions who used 23andMe or its successors, you don't have to sit back and hope for the best. You retain legal rights under state laws to take back control of your biological identity.
Do not wait for a check in the mail or a notification email that might end up in your spam folder. Take direct action immediately:
- Request Complete Data Deletion: Reach out to the company or visit the official privacy portal to submit a formal deletion request for your raw DNA data.
- Demand Sample Destruction: Ensure your physical saliva sample is destroyed, not just unlinked from your account profile.
- Revoke Research Consents: If you previously opted in to let your genetic data be used for third-party pharmaceutical or academic research, explicitly revoke that permission.
Data breaches happen because corporate security budgets get slashed when profits dip. When companies fail to protect the vault, you have to lock the door yourself. Delete your records, scrub your profile, and stop trusting tech startups with the keys to your biology.
