What Is Being Sold When a Genetic Company Fails?

This series examines the 2025 Chapter 11 sale of 23andMe’s genetic-testing business to TTAM Research Institute and the state enforcement that followed. The immediate question is not simply whether a database can be listed among a company’s assets. It is what changes when a bankruptcy estate transfers its interest in saliva samples, genetic results, and customer records while the people behind those records still have privacy, deletion, and research-participation rights. The 23andMe case supplies a concrete way to make that judgment: identify what moved, who could access it, which rules survived the sale, and what risks remained afterward.

A company built around intimate information

23andMe was not an ordinary subscription business with a customer list attached. In the bankruptcy court’s description, its core service involved testing saliva samples and giving customers information about their ancestry and susceptibility to certain illnesses. At the time of the sale hearing, the company had approximately 13 million customers, and more than 80 percent had elected to participate in medical-research programs. The business therefore held several connected but distinct kinds of value: physical samples in biobanks, electronic genetic results, account information such as names and email addresses, and an operating system capable of collecting, interpreting, and using that information.

That combination makes the word data dangerously compressed. A name and email address can be sensitive, but genetic results can reveal relationships, ancestry, and medically relevant traits that are difficult to change once exposed. A saliva sample is not merely another file. Research participation adds another layer: many customers had agreed to one kind of use while retaining the ability to opt out. Any later change in custody would have to be understood against those continuing relationships.

The company’s financial distress also followed a serious privacy event. In October 2023, 23andMe disclosed a breach affecting 6.9 million consumers worldwide; the court described the affected population more approximately as about 7 million. The state attorneys general said that some exposed information, including genetic ancestry information in some cases, was later posted for sale on the dark web. Their investigation alleged failures involving stolen credentials, rate limiting, monitoring, unusual login patterns, known vulnerabilities, and security testing. Those allegations appeared in a settlement announcement rather than a trial verdict on every individual theory, but the consequences were not abstract: customers faced exposure, and the company faced legal claims and investigations.

By March 2025, 23andMe had filed for Chapter 11 protection. The bankruptcy thus placed three questions next to one another. Could the business be sold as a going concern? Could the estate transfer the data-related interests that made the business valuable? And could the new custodian continue using the information without undoing the privacy commitments made to customers? The bankruptcy court, the customers, the company and its proposed buyer, and the state attorneys general each approached the same transaction from a different position.

One case, three different events

It is useful to keep the timeline in view because the breach, the bankruptcy sale, and the later settlement are related but not interchangeable.

flowchart LR A["October 2023 breach"] --> B["State investigation and claims"] B --> C["March 2025 Chapter 11"] C --> D["Sale process and court review"] D --> E["TTAM receives business and data-related assets"] E --> F["Customer rights and privacy conditions"] F --> G["July 2026 multistate settlement"] B -.-> G

The first event was an unauthorized access incident. Its central question was whether 23andMe had protected customer information adequately. The second was a court-supervised restructuring. Its central question was whether the bankruptcy estate could transfer the business and its own interests in the information it held. The third was a negotiated resolution of government claims arising from the breach. Its central question was how much the wind-down estate would pay and what restrictions or continuing obligations would remain.

The distinction matters because a later sale did not cause the 2023 breach, and the 2026 settlement did not retroactively turn the breach allegations into a judicial finding on every disputed fact. Nor did the bankruptcy court’s approval certify that future security would be perfect. It approved a transaction after weighing its structure, its safeguards, its alternatives, and the interests of customers and creditors.

The later state announcements make the chain visible from another angle. New York and Colorado said that a coalition of 42 attorneys general reached an agreement for an immediate aggregate recovery of $18 million from available bankruptcy funds. Colorado’s announced share was $394,324, and New York said it would receive more than $705,000. Colorado also described a separate $46.75 million class-action settlement for affected United States consumers who submitted claims by the stated deadline. These figures belong to the enforcement stage, not to the price paid for the business or to a valuation of anyone’s genome.

The words that change the legal answer

The phrase “23andMe sold its customers’ genetic data” is understandable shorthand, but it hides the distinctions that decided the case.

An asset interest is the interest the company itself can transfer. The bankruptcy estate does not automatically own every right a customer may have in a biological sample or test result. The court’s discussion of Texas law illustrates the point: even where a customer has a property or control interest, the debtors represented that they were selling only their own interests. A purchaser could receive the company’s custodial and operational position without receiving a magic power to erase the customer’s rights.

Custody asks who holds and administers the information. A change in custody can occur even when the records stay on the same servers or the same employees continue doing the work. Disclosure asks whether information becomes known or accessible to people who did not previously have it. Use asks what the custodian does with it: continuing the genetic-testing service is different from using genetic results to market an unrelated product. These categories can overlap, but they are not synonyms.

That separation was especially important in the 23andMe transaction. The chosen structure involved a newly formed, wholly owned subsidiary called Newco. Newco would receive the debtors’ assets, including customer data, in exchange for a promissory note. The debtors would then transfer all of Newco’s equity to TTAM Research Institute. In practical terms, TTAM would own the subsidiary that housed the data and operated the business. In legal terms, the court analyzed two connected steps rather than treating the entire result as one undifferentiated sale.

The court also noted that TTAM expected to retain the existing employees and subcontractors and did not anticipate disclosing genetic data to people who lacked access before the transaction. That did not make the first step disappear: the court regarded the movement of the estate’s interest into Newco as a transfer in form. But it did change the disclosure question. The transaction was presented as continuity of a testing business under new ownership, not as a plan to release the database to a new audience or monetize genetic information for an unrelated purpose.

This is why the title question cannot be answered by asking only whether genetic data appeared on an asset list. The relevant questions are narrower and more demanding:

  • What interest did the bankruptcy estate actually own?
  • Did the transaction change the people who could access the information?
  • Did it change the purpose for which the information would be used?
  • What did the company’s privacy policy say when the bankruptcy began?
  • Which statutes required a separate consent or preserved a customer control right?
  • What protections would exist after closing, and what realistic alternative would have been used if the preferred structure failed?

A conditional answer begins with the subject, not the slogan

The bankruptcy court ultimately approved the TTAM transaction, but its reasoning does not amount to a general declaration that genetic information is freely transferable whenever its custodian becomes insolvent. The court rejected a broad theory that bankruptcy law automatically overrides state privacy restrictions. It considered the formal privacy policy in effect when the case began, the fact that the same business and personnel were expected to continue, the deletion and research opt-out rights promised after closing, and the value the sale could generate for creditors, including customers harmed by the breach. It also recognized risks it could not eliminate, such as customers who could not log in to delete their accounts, deceased customers, future changes in the business, and a later security failure.

The court’s conclusion was therefore conditional in both senses. It depended on the facts of this transaction, and it balanced the chosen structure against a real alternative. A demand for universal opt-in consent might have prevented the Equity Toggle from closing. The parties could instead have used a Plan Toggle that left the data inside the reorganized debtors, but the court reasoned that this route could cost tens of millions of dollars and would not carry the same negotiated privacy enhancements. A stronger rule in theory could therefore have produced a weaker outcome in practice if it pushed the parties toward a different structure or toward liquidation.

The next question is the most concrete one: what exactly belonged to the bankruptcy estate, and how could that interest be transferred without erasing the rights attached to the people whose bodies and histories made the business valuable? Answering that requires separating the samples, results, account records, operating business, and customer controls before judging the sale itself.

References