Impact of the 23andMe bankruptcy on preserving the public benefit of scientific data

Abstract

23andMe’s bankruptcy was an inflection point for the direct-to-consumer genetics market. While consumer data privacy has been highlighted by many as a concern, we discuss another key tension in this case: the corporate enclosure of scientific data that has significant potential value for biomedical research and public health.

From its inception in 2006, the direct-to-consumer (DTC) genetics company 23andMe operated along two axes: consumer-facing and research-facing. On the consumer side, the company provided ancestry, trait, and health reports to paying customers via an intuitive and user-friendly interface that differed significantly from the dense clinical reports generated by other genetic diagnostic services. On the discovery side, it helped to expand a novel form of biomedical research participation through a private multiuse platform¹ (https://mediacenter.23andme.com/press-releases/23andme-1million).

In June 2021, the company went public at a valuation of $3.5 billion and soon reached a market capitalization of $6 billion (https://www.wsj.com/tech/biotech/23andme-went-from-a-6-billion-giant-to-bankruptcy-its-former-ceo-wont-walk-away-8df3a9d4). However, a combination of corporate, market, and policy factors coupled with a massive data breach in 2023 weakened the company². This corporate instability, compounded by diminished consumer enthusiasm, high costs of drug discovery, and little repeat customer business, culminated in Chapter 11 bankruptcy proceedings in 2025. The initial bidder for the company’s assets was Regeneron, a biopharmaceutical research company. Regeneron bid $256 million for the assets of the company, but was eventually outbid by TTAM Research Institute, a newly established non-profit research foundation led by 23andMe’s founder and former CEO Anne Wojcicki, which bid $305 million.

In this Comment we examine the normative stakes of the 23andMe bankruptcy, focusing on the fate of the valuable scientific data contributed by the company’s customers. The experience of the 23andMe bankruptcy emphasizes the need to ensure that the acquirers of scientific data in corporate sales are required to honor the intentions of data donors and preserve the public benefits of data that has been made available to researchers.

Research Consented Data and its scientific value

For years, 23andMe invited its customers to consent to the use of their genomic data as well as other types of data including survey responses, self-reported demographic and phenotypic data, and microbiome data, for scientific research. As a result, the company amassed a dataset representing millions of individuals - what we call Research Consented Data.

The 23andMe Research Consented Data were not an incidental corporate asset. They were the product of systematic and large-scale enrollment of individuals into a research framework that, while managed by a private company, functioned in many respects to enhance the advancement of science. The company made its Research Consented Data available to a range of corporate research partners, as well as academic researchers around the world. While the lines between public and private interest are blurred in corporate science, it is hard to dispute the fact that scientific data can benefit the public more when it is shared. Indeed, the Research Consented Data have yielded between 258 and 276 scientific publications (Fig. 1), as well as advances in drug discovery and development.

Fig. 1: Overview of papers 23andMe data and staff have contributed to.

A. Publications listed by 23andMe on https://research.23andme.com/publications/.

B. Publications in PubMed which list 23andMe in the affiliations of at least one author. Analysis is based on 2024 PubMed Baseline files and only considers publications listed in PubMed as research articles, but not reviews or comments or similar.

C. Publications, excluding comments and reviews etc., in PubMed which list 23andMe in the text of the abstract. Analysis is based on 2024 PubMed Baseline files and only considers publications listed in PubMed as research articles, but not reviews or comments or similar.

Unlike the human subjects violations that are the subject of cautionary tales found in the literature^3,4, the Research Consented Data were not taken from unsuspecting medical patients, but voluntarily contributed by 23andMe’s customers. Consent to participate in research was not buried in a lengthy consent document, but was explicitly presented as an opportunity to “[make] and [support] meaningful scientific discoveries,” and “become part of something bigger” (https://customercare.23andme.com/hc/en-us/articles/212195708-Research-Participation-and-Consent. While 23andMe is not subject to the same human subjects regulations as entities receiving federal funds, the 23andMe Research Consent Document is consistent with the basic principles outlined by the US Common Rule (45 CFR part 46, subpart A). Participants received no financial compensation for the use of their data, and instead may have paid 23andMe for the ancestry and health information services that accompanied the inclusion of their data in the dataset. Framing the 23andMe product offering in a research context was integral to the company’s recruitment strategy and central to the narratives it offered to customers.

Given the number of 23andMe customers who contributed their data in support of biomedical research, the terms under which those data were governed became important, both from an ethical and a contractual standpoint.^5–7

The threat of data enclosure

In contrast to an ordinary commercial acquisition, the purchaser of a debtor’s assets in a U.S. bankruptcy sale typically acquires these assets “free and clear” of all existing encumbrances. As such, concerns were raised during the 23andMe bankruptcy regarding the degree to which an acquirer would be required to honor 23andMe’s commitments regarding the Research Consented Data. In this Comment, we do not focus on the individual privacy concerns that were raised during the bankruptcy, which have been the subject of extensive public debate,^2,6 a lengthy report submitted by the Customer Data Ombudsman in the case (Suppl note) and a set of legal actions by individual US states and amici curiae, literally “friends of the court”, individuals or groups who have an interest in the outcome of a case and wish to inform the court of additional facts or arguments that might not otherwise be raised (Suppl. Note). Rather, we focus on the legal and ethical risks posed by the potential transfer of Research Consented Data to a single purchaser that might lack the public-facing approach to data sharing of 23andMe.

Enclosure of assets

23andMe, as a DTC genomics service provider, was open to sharing the Research Consented Data with collaborators conducting biomedical research in a range of areas, as well as academic researchers around the world. However, a biopharmaceutical company that acquired the assets of 23andMe would likely be less inclined to make the Research Consented Data broadly available to the field, and instead use the data for its own internal research purposes and thereby “enclose” it within its corporate boundaries. Such enclosures of intangible resources are well-known in the literature^8,9, and while they may be profitable to the organization that creates them, they reduce overall public benefit and social welfare by reducing (or dramatically delaying) the number of potential discoveries that can be made using the resource¹⁰. Thus, instead of the Research Consented Data being used by companies around the world to develop diagnostics and therapeutics for a range of conditions, the Research Consented Data could have been limited to use in the pursuit of a single company’s commercial targets. Such commercial enclosure would capture all value for a single corporation at the expense of the greater public value of non-rivalrous use.

Undermining donor intent

A second risk inherent in the enclosure of the Research Consented Data by a single company is the inconsistency of this commercial approach with the premises under which such data was contributed by 23andMe’s customers. That is, 23andMe told its customers that if they participated in research, they would be contributing to something greater than themselves. The business model of 23andMe, with multiple collaborations across the industry, was highly publicized. In the absence of empirical research on the actual intentions of 23andMe customers, we can only rely on the representations made by 23andMe to customers, and which presumably influenced their decision to participate in research¹¹. Confining the Research Consented Data to a single company for its own research, without broad or equivalent sharing for research, arguably runs counter to the intentions of at least some of the 23andMe data donors.

Addressing the threat

As noted above, a number of risks emerged from the potential acquisition of 23andMe’s Research Consented Data by a private “free and clear” buyer. One of the principal concerns raised by commentators and state attorneys general was the continuation of 23andMe’s data privacy policies.¹² The buyer, TTAM, contractually committed that following the acquisition it would comply with 23andMe’s privacy policies in effect on the date of the acquisition, including their right to delete their accounts and opt out of research. [Asset Purchase Agreement § 7.11] (Supp Note).

These privacy-related commitments, however, did not address the above-mentioned concerns regarding data enclosure and access by the research community, leading a group of scholars to file a Limited Objection with the court on these grounds (Supplemental Note). Partially addressing these concerns, Ms. Wojcicki filed a formal declaration with the court stating that

“as an independent nonprofit, TTAM will have the capacity to partner with worthy third-party researchers, including hospitals, universities, pharmaceutical companies, and other research institutions - meaning the data will not be inherently monopolized by one entity only for the benefit (and profitability) of that entity. Such an outcome would be antithetical to the approach of 23andMe, which sought to democratize access to data for researchers, and asynchronous with the type of DTC company that customers contracted with.”

While this statement is not legally binding on TTAM, it is a material representation made by TTAM’s principal under oath, and is thus unlikely to be ignored in the foreseeable future. The commitment embodied in this declaration, if honored, appears to preserve the ethical principles that 23andMe represented to its customers.

In this regard, it may be fortuitous that the acquirer of 23andMe’s assets was a non-profit research foundation rather than a commercial entity. This outcome, however, was not assured, and may not be the case with the next DTC vendor whose assets are subject to sale in bankruptcy. In the absence of a public-benefit buyer, other means for ensuring the continued availability of consented data to the research community must be considered.

Indeed, treating such data as ordinary property without any restrictions on its use creates a contradiction between its origin and its disposition¹³. The contradiction? That the data are treated as an asset that can be liquidated, while the ethical and contractual commitments that supported its collection could be eliminated through the operation of the bankruptcy laws.

One approach proposed by the Limited Objection was the court’s imposition of a requirement that the buyer of the Research Consented Data continue to make such data available to academic and commercial researchers in a manner consistent with that of 23andMe. With respect to non-commercial researchers, such access would be free of charge, while access for commercial researchers could be provided on “fair, reasonable and nondiscriminatory” (FRAND) terms. If FRAND terms could not be agreed by the buyer and a potential data user, such terms could be imposed or supervised by the court – an oversight framework that has been utilized historically in antitrust cases involving the licensing of patents¹⁴.

Conclusion

As outlined above, the 23andMe bankruptcy exposed a structural vulnerability in the treatment of large, consented datasets. In such cases, the legal system must be prepared to treat data not solely as a commercial asset, but also as a public research resource with enduring obligations. That obligation is derived not only from legal entitlements to underlying assets, but from the reasonable expectations of the participants who contributed to the datasets.

The 23andMe bankruptcy thus presents a cautionary tale. When genomic data are collected through explicit, opt-in consent for the express purpose of contributing to biomedical research, they occupy a category that is not easy to classify. Such data are not public resources in the traditional sense, but neither are they simply private commodities. Their value arises through collective participation and through the invocation of public benefit as a condition of the contribution. As such, the successive owners of such data must be legally required to preserve the public benefits and individual expectations associated with their original collection (see Box 1).

Box 1: A framework for preserving public benefit in bankruptcy sales of Research-Consented Data.

To avoid treating Research Consented Data as an ordinary asset of a debtor in bankruptcy, courts and policymakers could adopt a structured framework modeled on fair, reasonable, and non-discriminatory (FRAND) licensing:

1. Recognition of Research Consented Data as a special asset

   • Courts should classify datasets contributed under explicit research consent as a distinct asset category; that is, neither a purely public nor purely private asset.
   • This classification triggers heightened duties for purchasers.
2. Mandatory continuity of access commitments

   • Purchasers must continue to honor the original research-oriented commitments under which the data were collected.
   • This includes respecting donor expectations of broad scientific contribution and not enclosing the dataset for exclusive commercial use.
3. FRAND-based licensing mechanism

   • Academic researchers should retain cost-free access consistent with past practice.
   • Commercial researchers may access the data on FRAND terms: access fees set transparently, non-exclusively, and without discriminatory restrictions.
   • In case of disputes, the bankruptcy court (or an independent trustee) could supervise or impose FRAND terms, as has been done historically with patents subject to antitrust orders.
4. Oversight and accountability

   • A court-appointed trustee or special master should monitor compliance with FRAND-based obligations.
   • Regular reporting on access requests, licensing terms, and denials ensures transparency.
5. Flexibility for future cases

   • While nonprofit acquisition (as in the 23andMe case) may mitigate risks, the proposed framework ensures public benefit is protected even when assets are acquired by commercial entities.