23andMe privacy ombudsman recommends company obtains consent for sale of customer data

The consumer privacy ombudsman overseeing how genomics company 23andMe’s bankruptcy sale will impact consumer privacy on Wednesday said that customers should be allowed to give their “separate and affirmative” consent before their data is sold.

The sale of millions of consumers' genetic data without such consent may be in conflict with 23andMe’s privacy policy and public statements, ombudsman Neil Richards said in a court filing.

Richards’ recommendation to the bankruptcy judge overseeing the sale is partially based on messages from 23andMe customers who told him they are worried about their genetic data’s inclusion in the sale, the filing said.

Many shared “the difficulties experienced while trying to delete their own account, as well as the accounts of deceased relatives,” according to the filing.

Customer data is by far 23andMe’s most valuable asset. At a tense Tuesday Congressional hearing, 23andMe interim CEO Joe Selsavage would not commit to allowing consumers to give opt-in consent for their data to be sold despite being pressed on the matter several times by multiple lawmakers.

23andMe — a direct to consumer service marketed as a way for individuals to learn about their ancestry — processes saliva samples customers provide to it, allowing the firm access to particularly sensitive DNA data.

Millions of 23andMe customers have not logged into their accounts at all since the company updated its privacy statement to include the word “bankruptcy” in June 2022, Richards said, citing information provided by the company. 

Many customers therefore do not understand that the company at that point amended its policy to “expressly note the potential for a sale of customer data in bankruptcy,” the filing said.

The company’s privacy policy has been revised many times, Richards said, noting that the “frequent representations and promises” 23andMe made about privacy publicly were for the most part “far more visible (and thus likely to be understood by consumers) than technical language about change in control deep in the Privacy Statement.”

Bloomberg Law first reported the contents of the filing.

Data deletion requests spiked after a massive 2023 hack of 23andMe's vast trove of data, Richards said, and again when the company declared bankruptcy in March. Nearly 2 million of 15 million people whose genetic data 23andMe holds have requested deletion of their data since the bankruptcy filing, Selsavage told Congress Tuesday.

Richards’ position that consumers should be allowed to give affirmative consent for the sale of their data echoes comments made at the Tuesday congressional oversight hearing.

“You claimed that 23andMe is all about consumer empowerment, but most people ended up actually exploited, not knowing that they signed up to have their genetic data auctioned off for the highest bidder,” Rep. Ayanna Pressley (D-MA) told 23andMe co-founder and former CEO Anne Wojcicki.

Pressley said that notice to consumers is “not good enough,” without their consent to the sale. “People trusted you with their more personal information. Show them you respect them.”

“We're talking about names, birth dates, genetic lineages, literal DNA data that implicates entire families, not just the person who gave the sample.”

Richards’ report similarly underscored the sensitivity of the data being peddled at the bankruptcy auction.

“It would not be hyperbole to conclude that this is one of the most — if not the most — sensitive collections of data about identified people ever sought to be discharged in bankruptcy,” he said in the filing.

If the court does not require 23andMe to obtain separate and affirmative consent from consumers for their data to be sold, another option would be to require the winning bidder — two are vying to acquire the firm — to obtain such consent before using the data, Richards said.