The genetic testing company 23andMe — which allows users to spit in a tube and send away the sample for a detailed DNA analysis — is filing for bankruptcy.

The California biotech firm announced in a statement this week that it had entered the federal bankruptcy process with the goal of finding a buyer to address its ongoing money troubles. Co-founder Anne Wojcicki also has stepped down as CEO, and said in a post on X she hopes to purchase the company herself. The board rejected an offer she made earlier this month, according to a press release.

23andMe has faced financial hardship for years, struggling to overcome the fact that many people who went to the website for a one-time DNA test didn’t become repeat customers. In November, the company laid off more than 200 employees, or roughly 40% of its staff.

The bankruptcy announcement also comes less than two years after 23andMe suffered a massive data breach affecting 6.9 million customer accounts.

The possibility that the company, once valued at $6 billion after it went public in 2021, could be sold has raised concerns about what would happen to the sensitive information of its more than 15 million users.

In its bankruptcy announcement, 23andMe said the data privacy of its customers would be an “important consideration” in any sale. But federal law does little to secure genetic information given over to a private company, two legal experts on data privacy said.

“Often, if there’s so much personal data that a group has, it’s maybe in a hospital setting or a research setting and can be governed by more meaningful safeguards,” said Suzanne Bernstein, counsel at the nonprofit Electronic Privacy Information Center.

“The scale of how much highly sensitive data 23andMe has is unique,” she said.

Is your DNA data protected by law? It depends

For many 23andMe customers, the company holds two sensitive pieces of information: the user-provided saliva sample, and the detailed genetic profile created from it.

In an FAQ about the bankruptcy posted on its website, 23andMe said a new owner would have to abide by “applicable law” governing the use of user data, but data privacy experts say there isn’t much on the books.

The Health Insurance Portability and Accountability Act, or HIPAA, applies to health care providers and insurers but not direct-to-consumers companies like 23andMe, according to Anya Prince, a University of Iowa law professor who studies health and genetic privacy. Another law called the Genetic Information Nondiscrimination Act bars employers and health insurance companies from discriminating against people due to genetic information.

“That’s pretty much it on the federal level,” Prince said.

Some states have adopted their own laws covering genetic privacy. At least 11 U.S. states have enacted laws giving consumers a say in how their genetic data is used, according to an article published by Prince in 2023. Those laws typically let users request that the companies delete their data and require law enforcement agencies to get a warrant or subpoena to access genetic information, Prince said. 23andMe already adheres to both of those policies, she added.

23andMe also says any genetic data it shares with researchers is stripped of identifying information, such as names and birth dates. In its bankruptcy FAQ, the company said it hopes to “secure a partner who shares in its commitment to customer data privacy.”

How to protect your data, according to experts

23andMe will remain in operation through the bankruptcy proceedings, and the company says customers can still delete their data and shutter their accounts.

California Attorney General Rob Bonta said in a consumer alert last week that residents should “consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material” the company has.

Bernstein of the Electronic Privacy Information Center said any concerned 23andMe customers should delete their data, request that their saliva sample be destroyed and revoke any permissions they may have given to use their genetic information for research.

“We would recommend taking those actions and advocating to your state and federal representatives to pass strong consumer privacy laws,” she added, “as this is just the first example of a company like this with tremendous amounts of sensitive data being bought or sold.”

Even before a possible sale goes through, Prince, the law professor, said she wonders how many people know what data 23andMe already shares and with whom. For example, the company has given over anonymized data to the pharmaceutical giant GSK for years to help it develop new drugs.

“Everybody’s worried about what a new company can do with the data — and that is a concern — but frankly some of the things that people are worried about, 23andMe already can do or already does,” Prince said.