What Protection Looks Like After Closing
The 23andMe sale answered a question about legal transfer, but customers still needed protection after the ownership change. The practical test is whether rights and safeguards remain usable when the custodian becomes TTAM Research Institute, later described by the states as 23andMe Research Institute. That requires looking past the word “approved” and asking how deletion, research opt-out, security governance, future transactions, inaccessible accounts, and enforcement work in practice. Promised controls can reduce risk without proving that the risk has disappeared.
Rights have to survive as actions
Before the sale, customers could delete their accounts, direct the company to dispose of saliva samples, and opt out of medical research. The court said approximately 1.9 million customers had deleted their accounts after the Chapter 11 cases began. That figure matters because it shows that customer control was not merely a sentence in a policy. People used an available mechanism to change what the company could retain and how it could continue the relationship.
The court-approved transaction was intended to carry those controls forward. TTAM agreed to preserve the petition-date privacy policy and to continue offering account and data deletion and research opt-out rights in perpetuity. The “in perpetuity” commitment matters because a change in ownership can otherwise turn a past promise into a temporary condition of the sale. A successor that keeps the service but drops the controls would not be preserving the same customer relationship the court used to justify continuity.
The controls are still not identical. Deleting an account concerns the customer relationship and associated data. Directing disposal of a saliva sample concerns physical biological material. Opting out of research concerns a distinct use of information. A customer may exercise one without automatically exercising the others. The custodian therefore needs processes that reflect what each request governs rather than a single button labeled “privacy.”
The post-sale commitments also included broader limits. TTAM agreed to comply with applicable privacy laws even if its non-profit status might otherwise provide an exception. It agreed to limit future mergers, acquisitions, bankruptcy transactions, and asset sales, and not to share personal information with insurance companies. It also planned to form an independent consumer privacy advisory board within ninety days and to provide two years of identity-theft monitoring. The states’ later announcements summarized overlapping protections as risk analysis, security governance, advisory-board oversight, comprehensive privacy-law compliance, and continuing deletion rights.
These commitments address different failure modes. Deletion and research opt-out give customers direct control. Compliance commitments constrain the organization’s legal choices. Risk analysis and an advisory board create decision and oversight structures. Limits on future transactions reduce the chance that another ownership change will arrive without scrutiny. Identity-theft monitoring responds to the consequences of the earlier breach. None is a substitute for the others.
The customer’s role remains important. The court treated deletion as the clearest example of a person affirmatively exercising later control; it did not treat silence as a universal veto over every corporate change. A right that depends on customer action therefore needs an accessible account process and clear notice.