Pharmaceutical giant Regeneron Pharmaceuticals has announced its intention to acquire DNA testing company 23andMe, which filed for Chapter 11 bankruptcy in March, in a $256 million deal.
Regeneron aims to rescue the company from financial collapse while preserving its vast repository of genetic data and upholding genetic privacy standards.
As part of the acquisition process, an independent, court-appointed privacy ombudsman will review the potential implications for customer data. The findings are due by June 10, ahead of a court hearing on June 17 that will determine whether the sale can move forward.
Regeneron has emphasized its commitment to protecting user data and expressed willingness to fully cooperate with the ombudsman’s review. For many 23andMe customers, the company holds two sensitive pieces of information: the user-provided saliva sample, and the detailed genetic profile created from it.
“We assure 23andMe customers that we are committed to protecting the 23andMe dataset with our high standards of data privacy, security, and ethical oversight and will advance its full potential to improve human health,” said Aris Baras, senior vice president at Regeneron.
Regeneron also pointed to its track record with sensitive information, including work with anonymized DNA sequences from nearly 3 million individuals, to underscore its experience in managing genomic data responsibly.
While the deal lays a foundation for hope for 23andMe, it has also ignited concern among customers and privacy advocates.
Critics are concerned that there is potential misuse of genetic data if it falls into the wrong hands. This includes discrimination based on disease predispositions or exploitation for commercial purposes. Genetic Information Nondiscrimination Act bars employers and health insurance companies from discriminating against people due to genetic information.
Franco Giandana Gigena, a policy analyst at Access Now, cautioned that although 23andMe claims its data is anonymized and users can permanently delete their records, the company has previously faced security breaches—including a significant data leak in October 2023.
“Depending on who ends up processing the data stored by 23andMe, there are different possible scenarios of data misuse, including segmented advertising and nonconsensual use of sensitive personal data for product development,” Gigena has said.
Adding to the complexity, genetic data is not covered under the Health Insurance Portability and Accountability Act (HIPAA), leaving a regulatory gap.
Andrew Crawford, senior policy counsel at the Center for Democracy and Technology, noted that consumers often struggle to interpret lengthy privacy policies and terms of service.
“We’ve got very sensitive data held by entities that aren’t subject to comprehensive federal data privacy regulations,” Crawford said. “It’s really up to the consumer to do their homework—and that’s a time-consuming, burdensome task.”
Adam Marré, chief information security officer at Arctic Wolf, pointed out that companies’ primary responsibilities lie with shareholders, contractual agreements, and the bankruptcy court—not necessarily with data subjects.
“While I hope the company will act ethically and in the best interest of its customers, the outcome of the proceedings—and any future ownership—could influence how that plays out,” Marré said. “If any current or former customers are concerned about their data and privacy, I would strongly recommend deleting their information from the platform.”
California Attorney General Rob Bonta said in a consumer alert earlier this year that California residents should “consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material” the company has.
Suzanne Bernstein of the Electronic Privacy Information Center said any concerned 23andMe customers should delete their data, request that their saliva sample be destroyed and revoke any permissions they may have given to use their genetic information for research.
“We would recommend taking those actions and advocating to your state and federal representatives to pass strong consumer privacy laws,” Bernstein added, “as this is just the first example of a company like this with tremendous amounts of sensitive data being bought or sold.”
Even before a possible sale goes through with Regeneron, Anya Prince, a University of Iowa law professor has previous said she wonders how many people know what data 23andMe already shares and with whom. For example, the company has given over anonymized data to the pharmaceutical giant GSK for years to help it develop new drugs.
“Everybody’s worried about what a new company can do with the data — and that is a concern — but frankly some of the things that people are worried about, 23andMe already can do or already does,” Prince said.
23andMe filed for Chapter 11 bankruptcy in March 2025 primarily due to struggling demand for its ancestry testing kits and a 2023 data breach that damaged its reputation and caused financial strain.
The data breach had exposed millions of customers’ genetic data, leading to a lawsuit and settlement, further impacting the company’s financial stability. It cost the company $30 million. Additionally, the company’s market value had significantly decreased after its initial public offering in 2021. It was valued at $6 billion after it went public.
Pump Radar
Stock Alerts
