Consumer Advisory for Utahns: Protect Your Genetic Data Amid 23andMe Bankruptcy Sale

The Office of the Utah Attorney General (OAG) and Utah Department of Commerce’s Division of Consumer Protection (DCP) are issuing a consumer alert regarding the recent sale of 23andMe, a direct-to-consumer genetic testing company. The bankruptcy court approved the sale of 23andMe’s assets, including consumer genetic data and samples, to TTAM, a nonprofit created by 23andMe founder and CEO Ann Wojcicki.  

Utah successfully advocated for safeguards to protect Utah residents’ genetic data and samples following the approved sale of 23andMe. TTAM confirmed it will retain 23andMe’s current policies regarding consumers’ rights to delete their accounts, genetic data, or samples, and to opt out of research. Utah will continue monitoring the transition closely, including enforcement of data deletion rights and compliance with privacy and data security laws. 

Consumers who have 23andMe accounts should have received direct notice of the ownership change from 23andMe and TTAM, including instructions on how to permanently delete their data and their genetic samples if they wish. If you want to rescind access to your genetic information and request the destruction of your test sample, you can follow the instructions 23andMe lays out to do so.  

The state will not be appealing the sale order due to the significant steps taken to ensure the safety and security of consumers’ data, including the ongoing right for individuals to have their data permanently deleted. Key conditions of the sale include: 

• There will be no transfer of customer DNA:All data will remain in place and under the same privacy policies, cybersecurity protections, and management. 
• Customer control over data: TTAM has agreed to allow consumers to permanently delete their data at any time, with new mechanisms in place to ensure that deletion requests are honored and verifiable by state regulators. 
• Benefit to breach victims: TTAM’s $305 million bid will help pay claims to the 7 million people affected by 23andMe’s 2023 cybersecurity breach. 
• Preserving scientific research: The nonprofit status of TTAM enables it to partner more freely with other public institutions and researchers, ensuring ongoing progress in critical health and medical research, using the data of consumers who have opted in to such research. 
• No disruption to service: With the same founder and team at the helm, customers who trusted 23andMe’s vision will see no meaningful change in ownership or use of their data. 

Please visit the Utah Division of Consumer Protection website for more information on your rights under the Utah Consumer Privacy Act (UCPA) and Utah’s Genetic Information Privacy Act (GIPA), guidance in managing your data, or to file a complaint.