Here's what potential 23andMe buyers could do with your genetic data
Lakshmi Varanasi,Lauren Edmonds
11 min read
23andMe is looking for buyers, raising concerns about how the company's trove of genetic data might be leveraged under a new owner.Getty Images; Alyssa Powell/BI
23andMe filed for bankruptcy amid financial struggles and fallout after a data breach.
Now, potential buyers and investors are weighing the value of its DNA database.
One of the world's largest troves of genetic information, its sale is raising new privacy concerns.
Late last month, genetic testing giant 23andMe filed for bankruptcy.
The San Francisco-based company — cofounded in 2006 by former healthcare investor Anne Wojcicki — rose to fame for offering genetic testing services directly to customers.
When the company went public in 2021, it was valued at just over $6 billion. Now, it says it had debts of $2.3 billion, about $126 million in cash and cash equivalents, and needs additional liquidity.
The company's descent into financial uncertainty wasn't sudden.
23andMe had struggled with its business model, failing to turn a profit almost two decades after it began selling direct-to-consumer DNA test kits. Demand for its premiere product — a one-time test — began waning around 2019, and its effort to provide more consumer value through additional services wasn't enough to close the gap.
Then, in October 2023, hackers accessed the personal details of some users in a data breach that cost the company $30 million in a later settlement agreement. The breach also made potential new customers nervous about the security of their data and more resistant to purchasing kits.
The company's announcement that it was filing for bankruptcy and seeking buyers has now further raised concerns among consumers about the security of 23andMe's database, one of the largest consumer DNA databases in the world.
Cybersecurity experts have urged users to delete their data, pointing to a host of risks: Genetic data can be used to further discrimination, enable financial fraud, and develop biological weapons, they say.
23andMe has said it will continue operating until a buyer is found. A race to acquire the company — and its data — has begun.
Here's everything you need to know about the sale and what might happen to your DNA data.
What genetic data does 23andMe even collect?
23andMe gathers genetic data using saliva samples. Consumers receive a collection kit and submit about 2 milliliters of saliva. Each kit has a collection tube labeled with a 14-digit barcode.
"After the sample passes visual inspection, the barcode — which is the only identifying information shared with the laboratory — is scanned and the sample moves to DNA extraction," 23andMe spokesperson Ann Sommerlath told BI by email. "Once a sample is successfully genotyped, the laboratory sends the resulting data back to 23andMe along with the accompanying barcode, at which point we can begin interpreting your data."
Genotyping is the process identifying variations in someone's genetic code. These variations influence a person's physical traits, their development, and susceptibility to disease.
How does the company handle its genetic data?
Aside from sharing individual genetic reports with customers, if they opt-in, 23andMe says it uses anonymized genetic and self-reported information for research.
"When customers agree to participate in 23andMe Research via our consent document, they give 23andMe permission to share their de-identified, individual-level data with approved, qualified research collaborators outside of 23andMe," Sommerlath told BI. "De-identification (replacing personal information with a random ID) enables researchers to protect the identity of individuals."
23andMe shares some of the resulting research in its blog. In a piece from November 2024, for example, the company wrote that many of its users are descendants of Mayflower passengers.
23andMe was found to offer the "clearest privacy policy" in a review of 10 popular genetic testing services — including Ancestry, Toolbox Genomics, and Everlywell — that was conducted by the data privacy service Icogni.
Does a 23andMe buyer have to comply with its privacy policy?
Yes. And then no.
In order to make a qualified bid, "potential buyers must, among other requirements, agree to comply with 23andMe's consumer privacy policy and all applicable laws with respect to the treatment of customer data," the company said in a letter posted to its website on March 26.
Ron Zayas, CEO of Ironwall, a privacy service offered by Incogni, told Business Insider that the letter is just a guideline and leaves several questions unanswered.
"For how long is the letter good for? A day after purchase, a year?" Zayas asked. "What if a company like a data broker buys the company? It may change the definition of all the terms in the letter and even the privacy statement."
Benjamin Farrow, a partner at Anderson, Williams, & Farrow, said the new owner isn't legally bound to the existing privacy policy after purchase.
"There is no way a court will say the terms of service can never be changed," he told BI. "It's like buying a car. Once you own it, you can paint it, change the interior, do anything you want with it."
Thorin Klosowski, a privacy and security activist at the Electronic Frontier Foundation, said the security of a user's 23andMe data will depend on who purchases the biotech company.
"It doesn't take very many leaps of logic to think through some of the worst-case scenarios," Klosowski said. "Whether that is an insurance company or a company that would grant easier access for law enforcement."
Despite the bid requirements for 23andMe, Klosowski said, "We don't really know how that's going to play out."
"We don't know what would happen if an unscrupulous company didn't do that. We don't know how closely they would be monitored," he said.
Who wants to buy the company?
Wojcicki, for one.
She said she resigned as CEO of the company "so I can be in the best position to pursue the company as an independent bidder," in a post on X on March 24 announcing the bankruptcy.
A handful of other companies have also expressed interest.
Nucleus Genomics, founded by 25-year-old University of Pennsylvania dropout Kian Sadeghi, has explored the possibility of purchasing 23andMe. For Nucleus Genomics — a new player on the genetic testing market focused on whole genome testing — there's some value in the data and technology of a company with a 20-year history, Sadeghi said.
Crypto nonprofit Sei Foundation has also expressed interest in acquiring 23andMe. "This isn't just another bankruptcy. It's a digital land grab on one of history's most profoundly intimate data sets," the Sei Foundation said in an X post on March 31. "We're invested long-term in returning intellectual property (including your DNA) to the people. It's the American thing to do."
Pinnacle, an analytics company, is also apparently interested. In a LinkedIn post addressed to 23andMe's shareholders, Pinnacle cofounder and CEO Ryan Sitton wrote: "We will give you $100 million for 23andMe today."
How valuable is its genetic data?
There is no formula for quantifying the value of 23andMe's data, so potential buyers and informed speculators are making educated estimates.
Kanyi Maqubela, managing partner of venture capital firm Kindred Ventures, which has invested in several healthcare companies, told BI that genetic data is particularly valuable for pharmaceutical research and development because it often includes early disease markers.
Pharmaceutical companies are typically "very data hungry, always looking for new data pipelines, and always looking to collect it at scale," he said. So, "even partial genomic sequencing at the individual level is quite valuable."
It's even more valuable "if you've got metadata attached to it, so like demographic information, name," he said. By connecting people across geographies and disease levels, health companies can start drawing correlations across the data, which makes it all the more valuable, he added.
Incogni's Zayas said that 23andMe's data "is probably worth more than the service they were selling."
"If you look at the value of monetized information, a good cellphone can go for $50," he said. "Good buyer information, good credit card information, good demographic information, you can start looking at tens or even hundreds of dollars per individual."
23andMe has access to all of that and more, he said. "Just in research for insurance companies, that's got to be worth at least a few hundred dollars per individual."
The company says it has over 15 million customers, so by Zayas' calculations the data itself is worth several billions, at least.
Jessica Vitak, a professor at the University of Maryland's College of Information who researches data privacy, told BI that 23andMe's data is "fairly unique" and "extremely revealing."
"There's a tremendous trove of not just genetic data tied to those accounts, but the majority of people who use the service also completed surveys, so there are other data points that would interest various third parties," Vitak said. "Whether it's advertisers, health researchers, or people selling data to a whole range of entities."
Vitak said the depth of information is one reason 23andMe's data is so valuable.
"It's one thing if I decide to share information about myself, but genetic data isn't just about me," Vitak said. "It's about all my direct family members, too."
Sadeghi from Nucleus Genomics, however, said he is not making a bid because he thinks the data is valuable but instead because of another company 23andMe acquired.
23andMe only gathers "a small sliver of someone's DNA and the most critical genetic markers are actually completely absent from the data. They're just not there, and that's why it actually doesn't work for drug discovery. That's why it never worked as a clinical test either," he told BI. "The data is worth something, but is it worth anywhere near what people are positing today? Absolutely not."
Sadeghi said the real value of 23andMe is in Lemonaid Health — the telehealth company it acquired for $400 million in 2021 — as a way to connect with customers.
What can the new owners do with the company — and its genetic data?
Sadeghi said he sees the data as one component of a "real-time, consumer-centric, quantified health platform" he wants to build.
"There's no reason why you can't bring together someone's blood, genetics, drugs, urinary analysis, full body MRIs, wearables, all together in a single platform that can basically completely revolutionize disease prevention, disease diagnosis, and also disease treatment," he said.
Kindred's Maqubela said that "no one roots for a bankruptcy," but 23andMe's data is a "treasure trove" that he thinks could help grow the burgeoning field of multi-omics.
Multi-omics combines data from the genome (genes), proteome (proteins), transcriptome (RNA transcripts), epigenome (modifications to DNA), metabolome (molecules produced in metabolism), microbiome (fungi, bacteria, viruses), and more to create a more comprehensive picture of human biology.
"It's a very young field, mostly stuck right now in pharma R&D, and then in some bench and lab research, and so it hasn't yet broken into scaled provider and end patient uses, but it's going to soon," he said. 23andMe's data, he added, could accelerate the development of mult-omics.
Maqubela said the recent advances in AI also present new opportunities to use this data. "If you put it in pre-training for a big LLM, what comes out on the other end of that is actually very hard to know and could be very, very, very interesting," he said, referring to large language models like OpenAI's ChatGPT.
Vitak said potential buyers could use the data for research. "23andMe partnered with numerous researchers, so there could be buyers that would continue to expand access to that type of data to advance precision medicine or other types of research," she said.
Given the breadth, nature, and potential of 23andMe's data, Vitak and Klosowski said the sale is unprecedented.
"Any organization dealing with data as sensitive as our genetic material has a moral responsibility to take extra care," Vitak said.
Are there laws that exist to protect you?
Vitak and Klosowski said consumers need more federal protections regarding genetic data privacy.
Some states have implemented laws to help protect consumer data, including Montana, where, in 2023, state legislators passed the Genetic Information Privacy Act, which is focused on protecting consumers' genetic data. California has similar protections for genetic data with direct-to-consumer testing companies.
The federal government, meanwhile, enforces the Genetic Information Nondiscrimination Act, which bars employers and health insurers from discriminating against individuals based on genetic information.
However, Vitak said the United States also needs something like the EU's General Data Protection Regulation, which enforces broader protections for data processing.
"The data breach and the sale are further making the case for why we need stronger data protection for consumers," Vitak.
