When "Learning About Your Ancestry" Means "Becoming a Saleable Asset"
Your DNA is the most permanent data that exists about you.
You can change your email address. You can move to a new city. You can delete your social media accounts. You can get a new phone number.
You cannot change your genetic code. It's yours forever. It identifies you uniquely among all humans who have ever lived or will ever live.
And if you sent a spit sample to 23andMe, that permanent, immutable, uniquely identifying information is now a corporate asset sitting in a bankruptcy auction.
Sleep tight.
The Bankruptcy
In late 2024, 23andMe's collapse became inevitable. The company that had once promised to revolutionize personal genomics was drowning.
The numbers tell the story:
- Stock price crashed from a peak of $17.65 to under $1
- Market cap collapsed from $6 billion to under $200 million
- Layoffs hit 40% of the workforce
- The CEO was desperately trying to take the company private
What remains: 15 million customers' genetic data sitting on servers, waiting to see who buys it.
A bankruptcy judge looked at the situation and said the quiet part loud: selling genetic data is "a scary proposition." But lawmakers haven't banned it. There's no law preventing your DNA from being sold to the highest bidder.
So here we are. Fifteen million people who paid $99 to learn about their ancestry are about to find out what it means to be a saleable asset.
What 23andMe Actually Has
Let's be specific about what's at stake.
23andMe collected:
- Raw genetic data — Your complete genotyped DNA, hundreds of thousands of genetic markers
- Health reports — Predispositions for diseases, carrier status, wellness traits
- Ancestry information — Ethnic breakdown, migration patterns, genetic relatives
- Family connections — The DNA Relatives feature linked you to genetic matches
- Survey data — Responses to hundreds of questions about health, lifestyle, traits
And here's the part most people forget: 80% of 23andMe customers opted in to "research sharing."
That checkbox you clicked during setup—the one that said something about contributing to research—gave 23andMe permission to use your genetic data for studies, partnerships, and commercial purposes.
You didn't just give them your DNA. You gave them a license to use it.
The Breach Nobody Talks About
Before we get to the bankruptcy, let's talk about the hack.
In October 2023, 23andMe disclosed that hackers had stolen data on 7 million people—nearly half of all customers.
The breach was bad enough. What was stolen was worse.
The hackers specifically targeted and created downloadable lists of:
- 1 million people of Ashkenazi Jewish descent
- 100,000 people of Chinese descent
This wasn't random data theft. This was ethnic targeting. The hackers used 23andMe's DNA Relatives feature to identify people by ancestry and compile lists based on heritage.
Imagine what that data could be used for. Imagine who would pay for it. Imagine living in a world where a database of "genetically verified Jewish people" or "genetically verified Chinese people" exists in the hands of criminals.
That world is this world. The data is out there. It can never be recalled.
Why HIPAA Won't Save You
You might assume your DNA is protected by health privacy laws. It's not.
HIPAA doesn't apply to direct-to-consumer genetic testing companies like 23andMe.
HIPAA covers healthcare providers, insurers, and their business associates. 23andMe is none of those things. They're a consumer technology company that happens to deal in genetic data.
There's a separate law—GINA, the Genetic Information Nondiscrimination Act—that prevents employers and health insurers from discriminating based on genetic information. But GINA has massive gaps:
- Doesn't cover life insurance
- Doesn't cover disability insurance
- Doesn't cover long-term care insurance
- Doesn't prevent data from being collected, only how it's used
Your DNA can be collected, stored, sold, and shared. The law just says certain parties can't discriminate against you based on it. That's not protection. That's a speed bump.
The Buyer Question
When 23andMe's assets go to auction, who might buy 15 million people's genetic data?
Pharmaceutical companies — They've already paid 23andMe for research partnerships. Direct ownership of the database would be even better.
Insurance companies — Life insurers and long-term care insurers can legally use genetic information for underwriting. A database of 15 million people with genetic health data is invaluable.
Foreign entities — There's no law preventing a company from another country from purchasing this data. Chinese pharmaceutical companies have already expressed interest in American genetic data.
Data brokers — Companies like LexisNexis and Verisk could integrate genetic information with their existing consumer profiles.
Unknown parties — The bankruptcy process could result in the data going to a company that doesn't even exist yet, created specifically to monetize this asset.
The judge called it scary. It is scary. And it's completely legal.
The GEDMatch Math
Even if you've never used 23andMe, you might already be identifiable through genetic databases.
In 2018, law enforcement used GEDMatch—a genealogy database—to identify the Golden State Killer. They uploaded crime scene DNA, found distant relatives in the database, and built a family tree until they identified the suspect.
Here's the terrifying math: researchers have calculated that with only 1.3 million people in a genetic database, most white Americans become identifiable through relative matching.
23andMe has 15 million. Ancestry has over 20 million. GEDMatch has millions more.
The databases are large enough that even if you've never submitted your DNA, your third cousin did. And from your third cousin, investigators (or others) can work backward to you.
You didn't opt in. But your family did. And that's enough.
What Your DNA Reveals
Your genetic data isn't just about ancestry. It's about:
Health:
- Predisposition to Alzheimer's, Parkinson's, breast cancer, heart disease
- Carrier status for conditions like cystic fibrosis and sickle cell
- Drug metabolism—how your body processes medications
- Mental health correlations
Identity:
- Unique identification more precise than fingerprints
- Ethnic and ancestral background
- Family relationships (including ones you might not know about)
Future insurance and employment:
- Conditions that might not be covered by GINA
- Information that life insurers can legally use
This isn't abstract data. This is a blueprint of your body, your health risks, your family connections. It's the most personal information that exists about you.
And it's sitting in a database waiting to be auctioned.
The "Anonymization" Lie
23andMe and similar companies often claim genetic data is "anonymized" or "de-identified" when used for research.
This is technically true and practically meaningless.
Genetic data is inherently identifying. Your DNA is unique. If someone has your raw genetic data and a sample from you, they can match it. If they have your genetic data and access to any other genetic database, they can potentially identify you through relative matching.
"Anonymized" genetic data is an oxymoron. The data itself is an identifier. Removing your name from the file doesn't change the fact that the genetic code belongs to one person on Earth: you.
What You Can Do (Maybe)
If you're currently a 23andMe customer:
Request complete data deletion. Go to Settings → 23andMe Data → Delete Data. Request deletion of your genetic information, personal info, and account.
Opt out of research. If you previously consented, withdraw that consent before deletion.
Download your raw data first (if you want to keep it). You can store it locally without relying on 23andMe's servers.
Revoke DNA Relatives sharing. Disconnect from the relative matching feature.
Important caveat: Once your data has been used in research or shared with partners, you can't un-share it. You can only stop future use.
If you're considering DNA testing:
Don't. Seriously. The privacy risks are not worth learning you're 4% Scandinavian.
If you must: Use a pseudonym, a burner email, and pay with a prepaid card. This limits—but doesn't eliminate—identifiability.
Consider local-only options. Some testing services let you analyze genetic data on your own computer without uploading to a cloud database. More technical, but more private.
For everyone:
Talk to your family. Even if you haven't tested, your relatives' decisions affect your privacy. Have the conversation.
Support genetic privacy legislation. Current laws are hopelessly inadequate. Push for actual protection.
The Family Problem
Here's the part that's impossible to solve: your genetic privacy isn't entirely within your control.
You share approximately:
- 50% of your DNA with each parent and child
- 25% with grandparents, grandchildren, aunts, uncles, half-siblings
- 12.5% with first cousins
- Decreasing amounts with more distant relatives
When your cousin takes a DNA test, they're also partially revealing your DNA. When your uncle uploads to GEDMatch, you become more identifiable. When your grandmother does Ancestry for Christmas, your genetic privacy erodes.
This is a collective problem, not an individual one. Your DNA is connected to hundreds of living people, and any of them can compromise everyone's privacy.
There is no purely individual solution. There's only awareness and family conversations and hoping we get better laws before the worst happens.
The Bottom Line
You paid $99 to learn about your ancestry.
What you actually did: provided the most permanent, immutable, uniquely identifying information about yourself to a company that has now collapsed, been breached, and is selling off assets.
15 million people are in that database. Half of them had their data stolen by hackers who specifically targeted ethnic groups. All of them are about to find out who buys their genetic code in bankruptcy court.
HIPAA doesn't cover you. GINA has giant loopholes. There's no law preventing your DNA from being sold to pharmaceutical companies, foreign entities, or data brokers.
The judge called it "a scary proposition." He's right. It's terrifying. And there's almost nothing you can do about it now.
If you haven't submitted your DNA yet, don't. The curiosity isn't worth the lifetime of risk.
If you already have, request deletion. Pray it actually works. And start having conversations with your family about genetic privacy.
Your DNA is forever. Your privacy shouldn't be a corporate liquidation asset.
But right now, that's exactly what it is.
Sources: 23andMe SEC filings and investor communications; October 2023 breach disclosure and FTC investigation; academic research on genetic re-identification; EFF reporting on GINA limitations; bankruptcy court filings and judicial commentary; GEDMatch relative identification studies.