Consent, Corporate Form, and the Meaning of “Transfer”

In the 23andMe case, the states’ consent objection turned on a deceptively simple word: transfer. The court agreed that the Equity Toggle involved a transfer of the debtors’ interest in genetic data into Newco, even though the data and the people handling it might not physically change. It nevertheless concluded that the transaction did not require separate express consent under the state statutes at issue because the business would continue, existing personnel would retain access, and the purpose was not a new form of monetization. The result shows how transfer, disclosure, ownership change, and new use can overlap without meaning the same thing.

Consent rules meet corporate form

California, Kentucky, Tennessee, Texas, and Utah objected that their genetic-privacy statutes required separate express consent before a direct-to-consumer genetic-testing company transferred or disclosed a customer’s genetic data. The statutes used different wording, but the court described a common pattern: the company had to obtain an affirmative response to notice of the possible disclosure or transfer, and the consent given when a customer first entered the relationship would not necessarily authorize a later transfer to another person or third party.

That argument treated the Newco step as the legally decisive event. The debtors proposed to dispose of their interest in genetic data by selling it to a newly formed subsidiary, and the states argued that the subsidiary was a separate entity. If that counted as a transfer to a “person” or “third party,” the states reasoned, the company should need a new opt-in from affected customers.

The court did not dismiss the concern as a technicality. It accepted that the Equity Toggle involved a transfer in form. Under an ordinary understanding of “transfer,” a party disposes of or parts with an asset interest even if the asset does not move across a room. The debtors would no longer own the data-related interests directly; Newco would. That was a legal change, and the court analyzed it as such.

But the court asked a second question: what kind of recipient was Newco in the context of these statutes? It reasoned that the statutes could not be read to require separate consent for every internal change that allowed a testing company to operate, hire employees, use service providers, or reorganize its corporate structure. Such a reading would make ordinary business continuity nearly impossible. A company that performed all testing in-house could not realistically ask every customer for consent each time a new employee needed access. Nor would a company be able to respond to a security incident if its own staff could not examine affected records without a new consent campaign.

The court therefore found an implicit limit in the statutes. They regulated disclosures and transfers to protect customers from new or harmful recipients and purposes; they did not freeze a company’s internal structure forever. A wholly owned subsidiary receiving the business’s assets as part of continued operation was not treated as the kind of outside person or third party that automatically triggered separate consent under the statutes at issue.

A transfer can occur without a new disclosure

The distinction becomes clearer when the people who can access the information are tracked separately from the entity that owns the business.