23andMe sold for $256 million as buyer pledges to comply with existing privacy policies

Regeneron Pharmaceuticals will buy the beleaguered genetic testing company 23andMe, in a $256 million deal that sparks concerns about sensitive customer data even as Regeneron has pledged to comply with 23andMe’s existing privacy policy.

The pharmaceutical company said it is buying 23andMe’s Total Health and Research Services business, its Personal Genome Service and its “biobank” and related assets, according to a company press release.

Once a Silicon Valley success story, the company has been in financial peril in recent years and filed for bankruptcy in March, raising concerns about what would happen to the genetic data consumers have voluntarily supplied the company for years.

Under the terms of the deal, 23andMe will continue offering genome testing for consumers who remain interested in submitting their genetic information.

The sale is slated to close in the third quarter of this year, according to a press release. A court-appointed privacy ombudsman will examine the transaction and impact on consumer privacy, 23andMe said in a press release.

Privacy advocates, lawmakers and the Federal Trade Commission have in recent weeks expressed alarm that a buyer might not adhere to 23andMe’s existing privacy policies, which does not allow genetic information to be shared with insurers, employers, public databases and law enforcement without a court order, search warrant or subpoena.

The existing privacy policy also allows consumers to delete their genetic data whenever they choose to.

"Without strong federal consumer data privacy protections, Regeneron's intentions to ‘prioritize’ the privacy and security of consumer genetic data still leave consumers concerned about their highly sensitive genetic data,” said Suzanne Bernstein, counsel at the Electronic Privacy Information Center, referring to Regeneron’s language in its press release. 

“23andMe consumers could not have envisioned, or meaningfully consented to, their genetic data being sold or used for purposes outside of the original context to discover family heritage or genealogy." 

In a statement, Regeneron senior vice president Aris Baras said the company would protect 23andMe’s clients. 

“We assure 23andMe customers that we are committed to protecting the 23andMe dataset with our high standards of data privacy, security and ethical oversight and will advance its full potential to improve human health,” he said.

23andMe said that it “required all bidders to guarantee that they will comply with the company’s privacy policies and applicable law.”

The company said the report from the privacy ombudsman will be presented to the bankruptcy court by June 10.

Shortly after 23andMe announced its bankruptcy filing, California Attorney General Rob Bonta cautioned consumers to erase their genetic information from company databases and ask for genetic samples to be eliminated.

In the weeks following that warning and related news coverage, there was a sharp increase in consumer deletion requests.

In March, Federal Trade Commission Chair Andrew Ferguson told regulators that any buyer of 23andMe must follow the company’s current privacy policies and not retroactively change them upon purchase.