Congress Demands Answers on Data Privacy Ahead of 23andMe Sale

US Representatives Alexandria Ocasio-Cortez and Jan Schakowsky on Thursday sent letters to the two potential buyers of troubled genetic testing firm 23andMe demanding details about consumer data privacy should either of them acquire the company.

Signed by 20 other Democratic members of Congress, the letters—which can be read here and here—were sent to Regeneron Pharmaceuticals and TTAM Research Institute, which have put forth separate bids to buy 23andMe. In the letters, they ask Regeneron and TTAM if they will continue to give customers the option to delete their data and withdraw consent for their data to be used in medical research. They also want to know if 23andMe’s current policy of not sharing genetic data with law enforcement without a warrant will be upheld, and whether both entities intend to proactively notify 23andMe customers about the sale.

After struggling for years to turn a profit, 23andMe filed for bankruptcy protection in March and put its assets up for sale. Shortly after, its CEO, Anne Wojcicki, resigned. Wojcicki had tried unsuccessfully to take the company private, but her proposals were rejected by a special committee formed by 23andMe’s board of directors.

In May, biotech company Regeneron announced that it was named the successful bidder in a bankruptcy auction, offering $256 million to acquire 23andMe. “We believe we can help 23andMe deliver and build upon its mission to help those interested in learning about their own DNA and how to improve their personal health, while furthering Regeneron’s efforts to use large-scale genetics research to improve the way society treats and prevents illness overall,” said George Yancopoulos, cofounder and chief scientific officer of Regeneron, in a company statement last month.

But after the auction closed, Wojcicki put in a bid of her own—offering $305 million through a newly formed nonprofit, TTAM Research Institute. The offer prompted a federal judge to reopen the sale process, and now both Regeneron and TTAM will have a chance to put in a final bid.

Founded in 2006, 23andMe pioneered the field of personal genomics with its DNA test kits, which allow customers to learn about their ancestry, family connections, and certain medical risks after submitting a spit sample. Despite selling more than 12 million of its DNA testing kits, the company never achieved profitability and struggled to diversify its revenue streams after going public in 2021. In another blow to the company, a major data breach in 2023 exposed the personal data of millions of customers, including a leak that targeted users with Chinese and Ashkenazi Jewish heritage.

The new owner of 23andMe would acquire its vast trove of genetic data, raising questions about how that data would be used. Under 23andMe’s current policy, customers can choose to make their genetic data and other personal information available for medical research. They also have the option of deleting all of their data and directing 23andMe to destroy their saliva sample. The members of Congress who sent the letters on Thursday are seeking clarity from Regeneron and Wojcicki on whether they plan to continue those practices.

The signees are also concerned about genetic data being shared with law enforcement and immigration authorities and the possibility of genetic and other personal data being used to train AI models. They’re also asking Regeneron and TTAM to disclose a full list of all third parties who currently have access to 23andMe data and the steps both entities will take to ensure transparency of third-party access in the future. 23andMe previously had a multi-year research collaboration with pharma giant GlaxoSmithKline.

The representatives are asking Regeneron and TTAM to respond by June 26.

Wojcicki and 23andMe's interim CEO, Joe Selsavage, testified during a House Oversight Committee hearing this week on the privacy and national security concerns surrounding 23andMe’s sale. During that hearing, Selsavage told lawmakers that 1.9 million people, or about 15 percent of its customer base, have asked for their genetic data to be removed from the company’s servers since the company filed for bankruptcy protection in March.

This week, more than two dozen states and the District of Columbia filed a lawsuit against 23andMe, arguing that the company cannot auction 15 million customers’ highly sensitive personal genetic information without their consent or knowledge.