After 23andMe, a well-known DNA testing company, filed for bankruptcy in March, the death of more than 15 million users ‘ genomic data is still in doubt. The data is available for purchase, which stokes concerns about how it might be used, and has prompted attorneys general from more than a few states to advise people on deleting your data.
In a statement released in March, Democrat attorney general of North Carolina said,” Your genomic data is your most individual, personal information, and you should be able to protect who has entry to it.”
Choose act quickly because you can remove your data right away.
Dr. Adam Brown, a leader of a health maintenance strategy company in Washington, D.C., immediately deleted his info from 23andMe after telling Stateline.
What happens to your genomic data when the organization holding it goes bankrupt, asks him,” The bankruptcy ?”, which federal and state laws don’t completely address.
Federal safeguards are illogical. In recent years, claims have strengthened their biological privacy laws, but many experts disagree.
The bankruptcy will not have any impact on how it stores, manages, or safeguards its trove of sympathetic customer information, according to 23andMe . Any potential buyers would have to agree to comply with 23andMe’s consumer protection legislation and all relevant laws, according to a media release released shortly after the bankruptcy statement. Stateline contacted the business, who declined to comment on anything the company had published in media releases and information it posted on its website for customers.
However, researchers noted that a company’s privacy policy may change after the information is in the hands of another business at any time.
There may not be those similar warranties or the same attitude a new business may have around private protections for consumers once you get to the point of bankruptcy court, Brown said.
” I want people to know that there aren’t many data privacy protections for consumers, particularly for these direct-to-customer-type companies,” he said.
HIPAA is not effective.
Companies like 23andMe provide their users with potentially groundbreaking information about their heritage and health. A saliva test is sent in for the company to create an unique genetic account that you reveal details about a person’s risk of developing a condition like cancer or Alzheimer’s.
This important personal information supports a direct-to-customer genetic testing market, which was valued at$ 1.93 billion in 2023 and is expected to grow, according to market research firm Grand View Research.
Before a massive  data breach in 2023 that affected the records of nearly 7 million users, 23andMe was a major player in the sector. Then came the arrangement of the$ 30 million class-action lawsuit.
The business filed for bankruptcy in later March of this year, and it was later revealed that it is up for sale.
Shortly afterward, state attorneys general across the nation issued a string of emails. Similar press produces recommended that customers request that their companies cancel their genetic profiles and eliminate the saliva test used to make them, as recommended by AGs from states like Alabama, Arizona, California, Kentucky, Kentucky, New Hampshire, North Carolina, and Texas.
In a statement released in April, Texas Attorney General Ken Paxton, a Republican, stated that” we have strong express privacy rules that include information termination right, and I would encourage any Texas concerned about their information to exercise the right to have their information safely deleted.”
The company’s current privacy legislation doesn’t allow for a new 23andMe owner to choose how to use or share delicate individual biological data. There is concern that it could be used to, for instance, increase people’s life insurance premiums or make them more discriminated against.
And not many guardrails exist to stop that from occurring.
HIPAA, the Health Insurance Portability and Accountability Act, is not applicable to businesses like 23andMe. When handled by doctors, hospitals, and health insurers, the landmark federal law protects patients ‘ sensitive health information. However, direct-to-customer businesses like 23andMe and Ancestry are not regarded as medical professionals, and their non-invasive saliva collection kit is not regarded as a medical test.
The main federal statute that shields people from discrimination based on their genetic information is nearly 20 years old. Long before the rise of at-home testing kits, the Genetic Information Nondiscrimination Act ( GINA ) was passed in 2008, was passed. It applies to employers and health insurers, but not life insurance companies, mortgage lenders, or other non-health organizations. Additionally, it doesn’t explicitly protect epigenetic information, which is information about how a person’s genes and, consequently, their health are impacted by external factors like smoking, disease, or stress.
What are the states doing?
At least 14 states have passed laws in the past five years that govern direct-to-consumer genetic testing offered by businesses like Ancestry and 23andMe. There are variations, but generally the laws require businesses to obtain customers ‘ consent before using or sharing their data and permit users to request that their genetic data be deleted and biological samples be destroyed.
Anya Prince, a law professor at the University of Iowa with a focus on health and genetic privacy, said it’s a good start but doesn’t go far enough.
The Coalition for Genetic Data Protection, an industry group with two members, 23andMe and Ancestry, developed a model law for many of those state efforts.
The coalition pushed for legislation to be influenced and set industry standards as DNA testing kits gained traction and attracted more scrutiny from lawmakers. According to experts, the privacy protections in the laws contrast with what 23andMe and Ancestry were already using their own privacy policies.
According to Prince,” They do have some incredibly reasonable privacy protections.” It’s wonderful that people can delete their genetic information, and it’s wonderful that law enforcement needs a warrant to access it. However, there might have been more and more broader protections if a privacy advocate had created a model law.
She cited the privacy requirements that are only addressed by direct-to-consumer DNA testing companies in many state laws. State laws no longer apply if, say, a pharmaceutical company purchases 23andMe’s data.
The coalition’s website is now gone, and it appears to be inactive.
Potrivit to a Stateline analysis, more than a dozen states have passed some form of a genetic information privacy law since 2020, including Alabama, Arizona, California, Florida, Kentucky, Maryland, Montana, Nebraska, South Dakota, Tennessee, Texas, Texas, Utah, Virginia, and Wyoming. The governor’s desk is currently being handled by the Indiana legislature’s bill andnbsp this year. Bills have been passed in other states this year, including West Virginia and  .
According to Prince, state laws rely far too heavily on consumers to manage their data privacy. When studies have shown that the general public frequently ignores privacy notices and doesn’t fully understand how companies use their data, they are expected to understand a company’s policy. Additionally, many state laws do not specify how law enforcement and other third parties can access and use consumer genetic data.
Additionally, it’s unclear who will oversee the enforcement of the laws or how they will be done.
She said,” I believe there is a disconnect between how people perceive their privacy as being protected and how it is actually protected.”
However, some states have passed stronger laws. For instance, California does have a general data protection law, as well as a state version of the federal GINA law that extends genetic anti-discrimination protections into areas like housing, education, and licensing.
The use or sale of an individual’s DNA without their consent is a felony punishable by up to 15 years in prison and a fine of up to$ 10,000 in Florida in recent years. Florida was the first state to forbid the use of genetic data to determine coverage by life, disability, and long-term care insurance companies.
You can get in touch with your state attorney general’s office if you have questions. Find yours at www.  . naag. org/find-my-ag/.
___
© 2025 States Newsroom.
distributed by Tribune Content Agency, LLC.
