The precarious future of consumer genetic privacy

After declaring bankruptcy in March 2025, direct-to-consumer (DTC) genetic testing company 23andMe sold the data of more than 15 million people around the world to TTAM Research Institute, a nonprofit organization created by 23andMe’s founder and long-time CEO. 23andMe’s customers might breathe a sigh of relief that their data didn’t end up in the hands of different leadership. But the saga made salient the ways in which existing laws fail to fully protect genetic data against exploitation and misuse. Commercial sales of genetic data have happened before, and they will happen again. The next data sale is likely to involve a buyer unrelated to the seller, which may result in fewer privacy protections. Congress has finally expressed interest in taking action, but proposed legislation does not provide adequate or genuine consumer protection.

The Business of DTC Genetics

23andMe held one of the largest genetic databases in the world. In many ways, its DTC model was the paradigm: Consumers buy a testing kit, collect a saliva sample, and ship their biospecimen back to the company. The company extracts DNA from the...