Genetic testing company 23andMe is currently seeking buyers, sparking concerns about the potential use of its extensive genetic database by a new owner. Following financial struggles and a significant data breach, the company has filed for bankruptcy. As the company evaluates potential buyers and investors, the value of its DNA database is under scrutiny. The sale of one of the world’s largest genetic information repositories has raised new privacy apprehensions.
Founded in 2006 in San Francisco by former healthcare investor Anne Wojcicki, 23andMe gained prominence for offering direct-to-customer genetic testing services. Despite being valued at over $6 billion when it went public in 2021, the company now finds itself with debts totaling $2.3 billion and in need of additional funds. The company’s financial woes had been looming for some time, as it struggled to turn a profit in its nearly two-decade history. Demand for its flagship product dwindled around 2019, and attempts to diversify its services fell short.
In a significant blow, 23andMe experienced a data breach in October 2023, leading to a settlement that cost the company $30 million. This breach exacerbated customer concerns about data security and contributed to a decline in new kit purchases. The company’s decision to file for bankruptcy and seek buyers has only heightened worries about the security of its vast genetic database, which is among the largest in the world.
Security experts have advised users to delete their data due to potential risks such as discrimination, financial fraud, and the development of biological weapons using genetic information. 23andMe has stated that it will continue operating until a buyer is secured, sparking a race among interested parties to acquire the company and its data.
For those curious about the fate of their DNA data, it’s important to understand what information 23andMe collects and how it is managed. The company collects genetic data through saliva samples provided by customers. Each sample is labeled with a unique barcode, and after processing, the data is returned to 23andMe for interpretation. The genetic variations identified through this process influence physical traits, development, and disease susceptibility.
Beyond providing individual genetic reports to customers, 23andMe utilizes anonymized genetic and self-reported data for research purposes with customer consent. By participating in 23andMe’s research initiatives, customers allow the company to share their de-identified data with approved collaborators for scientific studies and analysis.
The use of a unique identifier (replacing personal information) allows researchers to safeguard the anonymity of individuals. A report published in November 2024 by 23andMe mentioned that a significant number of its users are descendants of Mayflower passengers. In a study comparing the privacy policies of 10 prominent genetic testing services, including Ancestry and Everlywell, 23andMe was identified as providing the most transparent policy, according to the data privacy service Icogni.
Are purchasers of 23andMe required to adhere to its privacy policy? Initially, yes. However, there are exceptions. Potential buyers are expected to adhere to 23andMe’s consumer privacy policy and relevant regulations concerning customer data to place a legitimate bid, as stated in a letter released by the company on March 26.
Ron Zayas, CEO of Ironwall, an Incogni privacy service, expressed concerns about the ambiguity of the letter, questioning its duration of validity and the implications of ownership changes. Legal experts have highlighted that a new owner is not legally obligated to uphold the previous privacy policy post-acquisition.
The fate of 23andMe’s data security post-acquisition remains uncertain, with privacy advocates emphasizing the potential risks associated with varying ownership scenarios. The bidding process for 23andMe has attracted interest from several entities, including Wojcicki and Nucleus Genomics, as well as the Sei Foundation and Pinnacle.
As the acquisition unfolds, the value of 23andMe’s genetic data continues to be a topic of discussion, with various potential buyers citing the significance of the company’s extensive data pool and technological assets in their bids.
There is no set formula to determine the precise value of the data held by 23andMe. Potential buyers and knowledgeable investors are instead relying on informed estimates. Kanyi Maqubela, managing partner at venture capital firm Kindred Ventures, emphasized the significance of genetic data in pharmaceutical research and development due to its inclusion of early disease indicators. Pharmaceutical companies are keen on acquiring new data pipelines and collecting data on a large scale, making even partial genomic sequencing at an individual level highly valuable. Maqubela highlighted the added worth of data when accompanied by metadata such as demographic details and names. By linking individuals from various regions and health conditions, healthcare companies can draw connections within the data, further enhancing its value.
According to Incogni’s Zayas, the value of 23andMe’s data likely surpasses that of the services it offers. Zayas compared the value of monetized information, noting that while a good cellphone may fetch $50, valuable buyer information like credit card details and demographic data could be valued at tens or even hundreds of dollars per individual. With access to a vast amount of such data, including research for insurance companies, Zayas estimated the data’s value to be in the billions, given the company’s reported 15 million customers.
Jessica Vitak, a data privacy researcher at the University of Maryland, described 23andMe’s data as unique and highly revealing. She emphasized the extensive genetic and survey data associated with user accounts, attracting interest from advertisers, health researchers, and various third parties. Vitak underscored the value of the data due to the insights it provides not just about individuals but also their immediate family members.
In contrast, Sadeghi from Nucleus Genomics refrained from bidding on the data solely based on its value, citing limitations in the genetic markers collected by 23andMe. He highlighted the absence of critical genetic markers crucial for drug discovery and clinical testing. While acknowledging some value in the data, Sadeghi questioned the inflated estimations of its worth. Instead, he emphasized the true value of 23andMe lying in Lemonaid Health, the telehealth company it acquired, and the potential to utilize the genetic data as part of a comprehensive health platform focused on real-time, consumer-centric health monitoring and disease prevention.
In discussing disease treatment, Kindred’s Maqubela expressed that no one wishes for a bankruptcy to occur. However, he views the data from 23andMe as a valuable resource that could advance the field of multi-omics. Multi-omics integrates information from various biological aspects such as the genome, proteome, transcriptome, epigenome, metabolome, microbiome, and more to offer a more comprehensive understanding of human biology. Maqubela believes that while multi-omics is currently mainly utilized in pharmaceutical research and laboratory settings, it is poised to expand into broader applications for providers and patients. Leveraging 23andMe’s data could expedite progress in this area.
He also highlighted the potential of artificial intelligence (AI) in analyzing this data, suggesting that using it to train large language models could yield intriguing results. Vitak remarked that potential buyers could further utilize the data for research purposes, building on existing collaborations with researchers to advance precision medicine and other studies. Considering the sensitive nature of genetic data, both Vitak and Klosowski emphasized the need for robust legal protections to ensure consumer privacy.
While some states like Montana and California have enacted laws safeguarding genetic data, Vitak advocated for federal regulations akin to the EU’s General Data Protection Regulation to fortify data privacy in the United States. She pointed out that existing laws such as the Genetic Information Nondiscrimination Act offer some protections against discrimination based on genetic information by employers and health insurers. The recent data breach and sale underscore the urgency for enhanced data security measures to safeguard consumers’ information.
