How 23andMe's bankruptcy led to a run on the gene bank

Speaker 1 This message comes from NPR sponsor Charles Schwab. Financial decisions can be tricky.
Your biases can lead you astray. Financial Decoder, an original podcast from Charles Schwab, can help.

Speaker 1 Download the latest episode and subscribe at schwab.com/slash financial decoder.

Speaker 1 This is Planet Money from NPR.

Speaker 3 A few weeks ago, I hopped onto a video call with a very special friend of the show. Just introduce yourself.

Speaker 2 Who are you? Who am I? Oh, come on.

Speaker 2 No, I see. I'm your auntie.

Speaker 3 This is my aunt, Vovi. I called her up to talk about an experience she had a few years ago with the genetics testing company 23andMe.
Vovi is a lifelong learner.

Speaker 3 She loves anthropology and the story of human migration. So back in 2017, when 23andMe was all the rage, she was interested.

Speaker 3 She thought that taking one of their tests might reveal how she fit into the evolutionary sweep of human history. So was part of the interest about using 23andMe about belonging,

Speaker 2 maybe belonging to a much larger collective?

Speaker 3 Aunt Vovie knew our family had been in Afghanistan for the last few hundred years, but she also wondered if this test might reveal the migration route our ancestors had taken out of Africa.

Speaker 3 She wondered if it might uncover some long-forgotten tale of Star-Cross travelers on the Silk Road.

Speaker 2 And so I bought a kit and I convinced some of my friends to do so as well.

Speaker 3 You were patient zero.

Speaker 2 Yeah.

Speaker 3 Vovey and I actually talked about this at the time. By handing over her genome, she was automatically giving this company part of my DNA.
After all, we share 25% of the same genome.

Speaker 3 And for me, it just wasn't clear what the consequences of all this might be. But...
Vovi's gonna vovey, and she spent about 100 bucks, spit into a test tube, and sent it off to the company.

Speaker 3 And even though she is the most cautious person I know when it comes to putting personal info online, she more or less breezed through 23andMe's terms and conditions.

Speaker 2 Yeah, I just

Speaker 2 said agreed without really reading the fine print.

Speaker 3 Well, that's daily life.

Speaker 2 Who has time for like a 250-page

Speaker 2 memo?

Speaker 3 And when Aunt Vovi's test results arrived, she says they were pretty exciting. They said we had some Mongolian DNA and a little bit from Yakutsk all the way up in Siberia.

Speaker 2 Then there was this thing that in the 1800s or so that there had been some DNA from Great Britain. That was a total shock and surprise.

Speaker 3 Well, there were several wars in Afghanistan in the 1800s.

Speaker 2 Yes, and that was sort of a confirmation of, yes, of course these things happened.

Speaker 3 A mysterious British interloper in the genome? This was the kind of hot ancestral goss Vovi had been hoping for. But then, not too long after, Vovi got an update from 23andMe.

Speaker 2 That's because the database was growing.

Speaker 3 As the company got more customers and more genetic data points, they were apparently updating their genetic results from time to time.

Speaker 3 And the new update had come to a much less complicated conclusion about Vovi's origins.

Speaker 2 So it just said that I was 99.8%

Speaker 2 Afghan, basically.

Speaker 3 Vovi was a bit taken aback by this. After this string of intriguing genetic subplots, finding out her genome reflected the one place she'd known about all along felt a little bit like a letdown.

Speaker 3 And the British interloper had disappeared?

Speaker 2 Yeah, completely.

Speaker 2 The British interloper, all the Mongolian markers, you know, all of those disappeared. And there was actually no indiscretions.

Speaker 2 I had been hoping

Speaker 2 for many indiscretions.

Speaker 2 Maybe

Speaker 2 I was hoping for a little more surprise.

Speaker 3 Vovi had been looking for the real housewives of the Silk Road in her genome, but at the end of her journey of genetic self-discovery, she basically learned, I am what I am.

Speaker 3 After that, Vovi stopped visiting the website, and for a few years, she basically forgot about 23andMe.

Speaker 3 Until she found out that 23andMe had made her part of a different gene pool. a group of people whose genetic information is about to go on the market.

Speaker 3 When did you first hear that something might be financially awry at 23andMe?

Speaker 2 Just last week. I had no idea because as I said, I haven't gone back to look at anything for a few years now.

Speaker 3 Vovi found out along with the rest of us that 23andMe had filed for bankruptcy.

Speaker 3 And the data on Ant Vovi's genome, along with the genomes of millions of other 23andMe customers, was potentially up for sale.

Speaker 3 And it's not like 23andMe is thinking of selling your shopping preferences for shoes or something. These are the blueprints our bodies use to build themselves.

Speaker 3 Ant Fovie read that 23andMe's website was crashing because so many customers were rushing to delete their highly sensitive data. Yeah, it was like

Speaker 3 a run on the gene bank.

Speaker 2 That's right.

Speaker 3 All of which obviously raised some big questions for Aunt Fovie. Like, now that 23andMe was in bankruptcy, was it allowed to just sell her genetic information? Who would want to buy it?

Speaker 3 Could that information affect things like insurance premiums? Could it end up in the hands of law enforcement or a foreign-owned company? And what about the data itself?

Speaker 2 How is that going to be broken into valuable assets? Was that going to be sold to the highest bidder? And how much is my data even worth?

Speaker 3 Hello, and welcome to Planet Money. I'm Alexi Horowitz-Ghazi.

Speaker 2 And I'm Jeff Guo. And Alexi's Antvovi isn't the only one asking these questions these days.

Speaker 2 Over the past two decades, some 15 million people have spit into a tube and handed over over their entire genome to one Silicon Valley company, which now has one of the biggest genetic databases on Earth.

Speaker 3 Today on the show, what might happen to Vovey's genetic data as 23andMe works its way through the bankruptcy process, and what it all reveals about the data that all of us willingly hand over to companies every single day.

Speaker 1 This message comes from Vanguard. Capturing value in the bond market is not easy.

Speaker 1 That's why Vanguard offers a suite of over 80 institutional quality bond funds, actively managed by a 200-person global team of sector specialists, analysts, and traders.

Speaker 1 They're designed for financial advisors looking to give their clients consistent results year in and year out. See the record at vanguard.com/slash audio.
That's vanguard.com/slash audio.

Speaker 1 All investing is subject to risk.

Speaker 2 Vanguard Marketing Corporation distributor.

Speaker 1 This message comes from Schwab. Everyone has moments when they could have done better.
Same goes for where you invest. Level up and invest smarter with Schwab.

Speaker 1 Get market insights, education, and human help when you need it.

Speaker 2 So to understand what might happen to Ant Vovi's genetic data and the data of millions of other people, we need to understand exactly how we got here. How did 23andMe find itself in bankruptcy?

Speaker 3 So 23andMe was founded in part on the idea that if they could build a massive database of consumer data, they'd be able to figure out how to monetize it down the road.

Speaker 3 And the company was successful at building this data set. Over the past couple decades, some 15 million customers have sent their DNA to 23andMe.

Speaker 2 But the company never figured out a way to make a profit because 23andMe customers were kind of set after they took the test once.

Speaker 2 And 23andMe's efforts to use all this genetic data to develop and sell new drugs hadn't yet panned out. Then in 2023, they were hit with a massive data breach that led to class action lawsuits.

Speaker 2 All these problems helped push the company into bankruptcy. By the way, we reached out to 23andMe, but they didn't get back to us.

Speaker 3 All of which brings us to our next question. What's going to happen to my Ant Fovie's data now? See, bankruptcy is a very specific process with some very specific goals.

Speaker 3 And how that process plays out here could have a real impact on what ends up happening to Enfovi's genetic data.

Speaker 2 To get some answers, we called up Laura Cordes, who teaches bankruptcy law at Arizona State University.

Speaker 3 What's your favorite bankruptcy?

Speaker 4 I don't know. Sounds like choosing between children or something.

Speaker 3 Last month, 23andMe filed for Chapter 11 bankruptcy. Chapter 11, Laura says, is all about finding ways for a struggling company to stay in business.

Speaker 3 It allows a company to hit the pause button on all of its debts and lawsuits and come up with a new plan, either to restructure or to sell itself to someone else.

Speaker 2 And the idea behind Chapter 11 goes back to the big railroads of the 19th century.

Speaker 2 Back then, you had all these different railroad companies that were failing all the time, leaving a lot of debt that they owed to other people, other companies.

Speaker 2 So Congress tried to come up with the best way to get all those creditors paid back without destroying the actual value of the company.

Speaker 4 Because it's going to be much more valuable if we we keep it going as a railroad than if we halt everything, halt operations, and start like cutting up pieces of track and saying to a creditor, okay, you get six feet of track.

Speaker 4 Yeah. Yeah.

Speaker 2 You get the caboose.

Speaker 3 You get the caboose. You get the caboose.

Speaker 3 Anyway, the bankruptcy system is aimed at maximizing the value of the bankrupt company. And in doing so, it's supposed to produce a sort of win-win-win.

Speaker 2 Yeah, the railroad company gets to survive instead of getting ripped apart and sold for scrap.

Speaker 2 Some of the company's employees get to keep their jobs and some of the customers will continue to get a valuable service, which is, you know, to ride the railroads of America.

Speaker 2 And the creditors, they will get made as close to whole as possible.

Speaker 3 And you can think of the bankruptcy process as this giant trade-off machine.

Speaker 3 It's about taking what could be a messy fight between the various parties the company owes money to and forcing everyone to come to an agreement, to compromise.

Speaker 2 And in this compromise, everyone basically has to accept some losses because, as we said, the company is often more valuable intact than in pieces.

Speaker 2 And if that means that some contracts are not honored or some pool of investors don't get paid back, well, that is just the cost of not going out of business.

Speaker 3 In the case of 23andMe, the potentially really valuable asset isn't railroad lines, it's genetic data from customers like Ant Vovi.

Speaker 3 Now, the United States doesn't really have strong federal laws protecting privacy. Europe and some states like California and Illinois do.

Speaker 2 But what 23andMe customers do have is a contract with the company. They have this privacy agreement where they were promised certain protections.

Speaker 2 So one of the big questions here is how will those privacy protections fare in the, you know, thunderdome of the bankruptcy process?

Speaker 3 Is this the first time that bankruptcy law met consumer data privacy?

Speaker 4 No, not at all. This has been going on for a while.

Speaker 2 Laura says there's one particularly important case from back in the year 2000, when consumer data privacy and the bankruptcy system collided.

Speaker 2 A case that sort of set the foundation for the rules around these data sales.

Speaker 3 Is it Toy Smart or Toy Smart?

Speaker 4 I always think of it as Toy Smart, like smart toys.

Speaker 3 Toy Smarter, not harder.

Speaker 4 Yeah.

Speaker 3 Toy Smart was an online toy retailer that crashed when the dot-com bubble burst.

Speaker 3 As part of their bankruptcy filings, the company announced its intention to sell off the names and contact information of its customers.

Speaker 3 Those lists could be valuable to other companies trying to find their own new customers.

Speaker 2 But that announcement raised two big problems. First, Toy Smart's Terms of Service had expressly promised its customers that their data would not be sold to any third parties.

Speaker 2 And second, Toy Smart's customer lists contain details about some of the kids who got toys there.

Speaker 4 There's this concern about we're going to be selling the data of children

Speaker 4 to potentially anybody, right? Not even necessarily a toy manufacturer. And I think that raised a lot of red flags.

Speaker 3 In light of those red flags, the Federal Trade Commission, which is one of the main consumer protection agencies, they sued to block the proposed sale of that data.

Speaker 3 They said that Toy Smart was breaking their privacy policy and engaging in a deceptive business practice.

Speaker 2 Eventually, though, the FTC and Toy Smart came to a settlement, a set of conditions under which the company would be allowed to sell its customer data.

Speaker 3 The FTC did want bankrupt companies to be able to maximize their value, but they also didn't want customers to suffer too much harm by letting Toy Smart break their data privacy promise.

Speaker 2 So they came up with this new trade-off to let Toy Smart sell its customer data, but with a few guardrails, a few conditions. Condition number one.

Speaker 4 The customer information can't be sold by itself. It has to be sold as part of the Toy Smart business.

Speaker 3 Condition number two was that Toy Smart was only allowed allowed to sell the data to a company in a related industry that agreed to uphold the terms of the original privacy policy.

Speaker 3 This is what the FTC called a qualified buyer.

Speaker 3 The thinking was customers had given up their data in order to improve their toy buying experience, so they shouldn't have to worry about how it might be used by some other kind of company.

Speaker 2 In striking this deal, the Toy Smart case kind of set a precedent. It had already been a norm in bankruptcy that contracts with vendors or employees or creditors could be renegotiated.

Speaker 2 Toy Smart established that in the interest of maximizing value, consumer data privacy was also something that could be on the negotiating table.

Speaker 4 And so these Toy Smart guidelines kind of became the blueprint for other companies seeking to sell their data in bankruptcy.

Speaker 4 And I think today, data sales and bankruptcy adopt a lot of the facets of the Toy Smart settlement.

Speaker 3 So in the case of 23andMe, the question of whether or not the company is allowed to sell my Aunt Vovi's Vovi's genome is much clearer.

Speaker 3 In the years after Toy Smart, it became a pretty standard practice for companies to reserve the right to sell customer data in case of bankruptcy.

Speaker 3 And that language was right in the privacy policy that Vovi kind of ignored when she signed up.

Speaker 2 So it looks like Ant Vovi's data, unfortunately, is going to be sold in this bankruptcy process.

Speaker 2 Now, 23andMe has already said that any potential buyers will have to uphold their current privacy policy, but the shape of that final deal, that will be determined by a bigger negotiation.

Speaker 3 Now, consumers are not generally invited to the bankruptcy negotiating table. So, Aunt Vovie won't be getting a seat here.

Speaker 3 But Laura says, often there is a dedicated person tasked by the bankruptcy court with advocating on behalf of consumers' privacy rights.

Speaker 4 Yes, the consumer privacy ombudsman or the CPO is what they're called. We love our acronyms in bankruptcy.

Speaker 3 Same at Planet Money or PM, as we sometimes call it.

Speaker 2 We really do, AHG. Anyway, the CPO or the consumer privacy ombudsman, this was a position created by Congress about 20 years ago.

Speaker 2 There was a time when more and more companies were building their businesses around collecting consumer data.

Speaker 2 And as some of these companies went under, more and more of these data sets were ending up on the bankruptcy auction block.

Speaker 3 The Toy Smart case had established some rough guidelines for these situations.

Speaker 3 But in subsequent cases, it became clear that no one in the bankruptcy system really had the expertise or incentives to dedicate themselves to, you know, scrutinizing the privacy implications of selling any particular kind of customer data.

Speaker 2 The CPO offered a way for the bankruptcy court to appoint a data privacy specialist who could check the fine print of the company's privacy agreements, cross-reference privacy laws, and then come up with recommendations for how to structure a deal that might reduce any harms to the consumer.

Speaker 4 Because consumers, for the most part, aren't parties to a bankruptcy case, but they are affected by what happens in a bankruptcy case, especially when their data is being sold.

Speaker 4 And so the role of the CPO is to try to be that voice, I think, for consumers.

Speaker 3 Since the position was created, CPOs have been brought into dozens of bankruptcies involving the sale of customer data, from the Circuit City bankruptcy to General Motors to Borders Books.

Speaker 2 Laura says one example of the impact a CPO can have on one of these cases is the RadioShack bankruptcy from 2015.

Speaker 4 RadioShack had a ton of customers, over 100 million. It was like a significant percentage of like the entire U.S.
population.

Speaker 3 It was in fact about a third of the U.S. population whose personal data RadioShack was proposing to sell.

Speaker 3 An ombudsman named Elise Freika was brought in to evaluate privacy concerns, and the plan she came up with did end up making a big difference.

Speaker 2 The biggest recommendation that Freika gave had to do with the amount of data being sold.

Speaker 2 She argued that instead of selling the data for every RadioShack customer ever, the sales should only apply to customers who had been in contact with the company in the past two years.

Speaker 4 So, I mean, you could argue that that's an effective use of the CPO or an effective use of privacy protections.

Speaker 4 Because if your last interaction with RadioShack was like 10 years prior to the bankruptcy, your data was not getting sold. That was not part of the sale.

Speaker 3 So, this is an example of the CPO system kind of pushing back against the initial proposal to sell this huge swath of customer data.

Speaker 4 Exactly.

Speaker 3 Now, some critics have argued that the consumer protection the CPO really offers is mostly performative.

Speaker 3 CPOs are generally brought in at the tail end of the bankruptcy process after a prospective buyer has already been chosen.

Speaker 3 They're often given as little as seven days to do their research and submit a report to the court. And their recommendations to the bankruptcy judge are just recommendations.
They are non-binding.

Speaker 2 But whether or not any of this is performative, the CPO process can also be really expensive. And so there's also a lot of pressure against appointing a CPO at all.

Speaker 4 The CPO, I should mention, is being paid by the bankruptcy estate.

Speaker 4 And so the money that is going towards the CPO's work in terms of gathering all this information and making this report is coming out of funds that could potentially go to creditors.

Speaker 3 So in a lot of cases, a bankrupt company's creditors, the people who are owed money, they don't necessarily want the CPO because it might mean a smaller payout for them.

Speaker 3 And the bankrupt company itself often doesn't want a CPO because it could slow down the sale process and make their portfolio of assets less valuable to potential buyers.

Speaker 2 The default here is that there is no CPO unless a privacy policy is being expressly broken in a sale.

Speaker 2 If some party in the bankruptcy requests a CPO, then it's up to the court to decide to appoint one.

Speaker 3 In the case of 23andMe, the company's lawyers argued that they should be allowed to skip the CPO and just hire their their own private privacy monitor.

Speaker 3 But the Texas Attorney General and the federal watchdog over the bankruptcy process have pushed back, saying, no, given this highly sensitive data, the case should get its own official ombudsman.

Speaker 3 So now it is up to the bankruptcy court to decide.

Speaker 2 Okay, so that is the basic framework that a bankruptcy court is using to sell Ant Vovey's genome. After the break, who might actually end up buying 23andMe's genetic database?

Speaker 2 Could Could it be a foreign-owned tech company? Ah, a law enforcement agency. Oh, no.
And will Aunt Vovi choose to stay or to delete her genetic data forever?

Speaker 1 This message comes from Apollo Global Management, who believes the global industrial renaissance is transforming the world.

Speaker 1 Over the next decade, industries like energy, infrastructure, and technology will need an estimated $75 to $100 trillion to modernize and meet demand. Long-term projects need long-duration capital.

Speaker 1 That's where Apollo steps in. With scale, flexibility, and a focus on growth, they're partnering with companies to drive the future one innovation at a time.

Speaker 1 Learn more at thinkitnew.com slash renaissance. This message comes from LinkedIn Ads.
One of the hardest parts about B2B marketing is reaching the right audience. That's why you need LinkedIn ads.

Speaker 1 You can target your buyers by job title, company, role, seniority, and skills. All the professionals you need to reach in one place.
Get a $250 credit on your next campaign so you can try it yourself.

Speaker 1 Just go to linkedin.com slash nprpod. That's linkedin.com slash nprpod.
Terms and conditions apply. Only on LinkedIn ads.
This message comes from the International Rescue Committee.

Speaker 1 Co-founded with help from Albert Einstein, the IRC has been providing humanitarian aid for more than 90 years.

Speaker 1 The IRC helps refugees whose lives are disrupted by conflict and disaster, supporting recovery efforts and responding within 72 hours of crisis. Donate today by visiting rescue.org slash rebuild.

Speaker 3 Okay, so we've learned about how private consumer data has been sold in bankruptcy in the past. To understand how the bankruptcy court will settle on a buyer for 23andMe, we called up Melissa Jacobi.

Speaker 3 She's a professor of bankruptcy law at the University of North Carolina.

Speaker 5 And the author of a book, Unjust Debts, How Our Bankruptcy System Makes America More Unequal.

Speaker 3 And just keep in mind, you're talking to me as if we're at a bar.

Speaker 5 You don't think I talk at a bar like a robot? I have no idea what you're talking about.

Speaker 2 If a company decides to use Chapter 11 bankruptcy to sell itself off to a new buyer, Melissa reminds us that a big part of the process is about finding the right kind of buyer who will pay, you know, the highest price.

Speaker 3 23andMe has already proposed a set of conditions for who will be eligible to bid here, several of which follow the ToySmart settlement. A qualified bidder can't buy the genetic data set on its own.

Speaker 5 And the qualified bidder has to promise that they are going to keep the privacy commitments that 23andMe had going into this bankruptcy case intact.

Speaker 3 Okay, let's dive into those commitments. I'm getting out my printed copy of 23andMe's privacy agreement.

Speaker 3 Bring it with me everywhere now.

Speaker 3 So, this is the document where 23andMe reserved its right to sell Vovi and everybody else's data.

Speaker 3 But this agreement also gives customers some protections that will be relevant to the sale and what happens after.

Speaker 3 It promises that the company will not share their data with law enforcement unless legally mandated.

Speaker 3 And it gives the customers the right to delete their information at any time and to have their saliva samples destroyed. A new buyer would have to honor all of that to qualify.

Speaker 2 Which brings us back to Aunt Vovie's question about who might buy this data and whether she should be worried.

Speaker 2 We talked through some options with Melissa, and she reminded us that a bankruptcy acquisition is still subject to all sorts of legal scrutiny.

Speaker 5 It still has to comply with the law.

Speaker 5 And by the law, I don't just mean bankruptcy law, but I do mean all the other oversights that come from privacy law, antitrust, foreign security concerns, and the like.

Speaker 3 We asked Melissa about some of the more dystopian potential buyers.

Speaker 3 For example, could a Chinese tech company with ties to the Chinese Communist Party put in a bid for 23andMe and get access to its genetic database?

Speaker 3 Kentucky Congressman James Comer recently raised this concern and opened a House oversight investigation into the 23andMe bankruptcy.

Speaker 2 Melissa says, okay, that question would likely fall to the Committee on Foreign Investment in the United States, or CIFIAS, as we acronym obsessives like to call it. Actually, everyone calls it that.

Speaker 2 This agency vets foreign investments in the U.S. for national security concerns, and it can recommend that a deal be blocked.

Speaker 3 Okay, next up, could a law enforcement agency like the FBI or the NSA buy the data from these 15 million genomes?

Speaker 3 There isn't anything in the bankruptcy code expressly forbidding this kind of sale, but this option seems like it would potentially violate 23andMe's privacy agreement, which promises, unless required by law, not to share genetic information with law enforcement.

Speaker 2 As for the more likely bidders in this case, at this point we know that 23andMe's co-founder and former CEO, Anne Wojciski, has expressed interest in buying the company.

Speaker 2 In fact, she stepped down as CEO last month with the stated goal of making a bid for it in bankruptcy.

Speaker 3 And a few other companies have expressed interest.

Speaker 3 A genetic testing company called Nucleus Genomics, for one, along with a crypto nonprofit that posted on X that it wanted to return Americans' intellectual property back to them, including their their DNA.

Speaker 2 But there's another way of looking at Aunt Vovie's question about whether or not she should be worried.

Speaker 2 Because no matter who buys 23andMe, there's still the question of what they could do with all this genetic data. Like, what do the actual laws say?

Speaker 2 Legally speaking, what could a new owner get away with? And what's not allowed?

Speaker 3 To hear about some of the best and worst case scenarios, we called up one last expert, Harvard Law Professor and bioethicist Glenn Cohen.

Speaker 6 The happy scenario is it's bought by another company that's even more public-spirited and even more privacy-sensitive and even more cybersecure than 23andMe is. And then actually, guess what?

Speaker 6 You've got an upgrade in terms of your protection.

Speaker 3 Other happy scenarios? Maybe some 23andMe competitor buys up this data, combines it with their own genetic database, and is able to offer even more comprehensive genealogy services.

Speaker 3 Or there's a world in which these databases eventually help lead to groundbreaking scientific discoveries, or where they help develop new medicines and treatments.

Speaker 2 But there's also a world in which the company that ends up buying 23andMe's genetic database ends up sharing it with third parties, or using it in ways that its customers probably wouldn't have agreed to when they, you know, originally spit into those tubes and sent them in.

Speaker 6 The negative story is that it's sold by someone who initially agrees to abide by the 23andMe privacy statement, but privacy statements can change and then changes it pretty rapidly.

Speaker 6 And one would hope that the company would offer you an opportunity to opt out. But guess what? I get a million of these privacy statement kind of notifications all the time.

Speaker 6 And I often just ignore them or click through or don't realize it's something I'm supposed to do.

Speaker 3 In other words, a new buyer could change the privacy policy.

Speaker 3 They could allow more open access to law enforcement or share the data with insurance companies or even revoke the right of consumers to delete their data.

Speaker 3 Former 23andMe customers would likely get the opportunity to either opt in or opt out, but we all know what it's like to get an email from some company about their new terms of service.

Speaker 2 Delete!

Speaker 2 But even if a new buyer changes the privacy policy, it's not like they could just do anything with Ant-Vovi's data. Glenn says there are some legal protections that might apply here.

Speaker 2 Now, Ant-Vovi's genetic data is not considered privileged health information, which would be covered by HIPAA.

Speaker 2 That's because HIPAA is for healthcare providers, like doctors and hospitals, not not consumer-facing companies like 23andMe.

Speaker 2 But he explained that there is one federal law that is meant to prevent abuses of specifically this kind of genetic data. It's called the Genetic Information Non-Discrimination Act, or GINA.

Speaker 6 So if for some reason if your information was shared with your employer, right, so it's to say you have a predisposition towards Alzheimer's, for example, right?

Speaker 6 That would be the kind of thing that if an employer tried to act on it, the Genetic Information Non-Discrimination Act, GINA, might prevent them from discriminating.

Speaker 6 You could bring a lawsuit, just as you could for racial discrimination or other kinds of discrimination. That's a practical protection.

Speaker 3 The same goes for health insurance. GINA prohibits health insurance companies from setting their premiums or denying coverage based on your genetic information.

Speaker 3 So if a 23andMe buyer were to share your genetic data with your health insurer, they couldn't just kick you off their plan based on the fact you have certain genes.

Speaker 2 Still, Glenn points out that GINA is a relatively narrow law. It does not apply to life insurance or disability insurance.

Speaker 2 Those companies could still potentially change their coverage based on this genetic information.

Speaker 2 And also, there are just still a lot of unknown potential consequences to allowing your genetic data to circulate on the market.

Speaker 3 So when Glenn talks to people like my aunt Vovi about whether or not to delete their 23andMe data, he says they should keep in mind there is a very real trade-off here.

Speaker 6 Ask yourself whether you feel as though you've gotten the benefit or what you hope from the product now.

Speaker 6 If you don't think there's much more you're intending to get out of it, you might consider deleting your account.

Speaker 6 Now, of course, that's going to terminate the ability for people to use it to develop drugs and therapeutics, right?

Speaker 6 So there's a downside to this, and I don't want people just to do this willy-nilly, but think about whether you feel like you want to have an ongoing relationship with this company or the possibility of successor company.

Speaker 3 As of now, multiple state attorneys general have issued public statements encouraging 23andMe customers to forego all of these risks by deleting their genetic data immediately.

Speaker 3 And huge numbers of customers seem to have taken them up on it.

Speaker 3 In the week following the bankruptcy announcement, 23andMe's website apparently crashed and many users found it difficult or impossible to delete their data.

Speaker 2 Which puts 23andMe in this kind of ironic position, right?

Speaker 2 The very same customer privacy policy that gave them the right to sell their customers' data also gives their customers the right to, you know, boop, delete themselves.

Speaker 2 And every customer that removes themselves from this database makes it a tiny bit less valuable as an asset in bankruptcy, which for 23andMe makes closing this bankruptcy sale as quickly as possible even more urgent.

Speaker 3 Last week, I ran all the stuff we'd learned by my aunt Vovi, the protections of the bankruptcy system, the promise of the consumer privacy ombudsman, as well as where her data could end up.

Speaker 3 So knowing all of this, what do you want to do with your 23andMe data?

Speaker 2 Yeah, I just, uh, don't want to

Speaker 2 the possibility that my data would get into the wrong hands, so let's delete it.

Speaker 2 I mean, make it all go away.

Speaker 3 And with that, Vovi and I were off to 23andMe's website to tell them that it was time to let my genome go.

Speaker 3 We just go into your settings

Speaker 3 and scroll all the way down to the bottom. Okay.

Speaker 2 Memberships, preferences, get a reward. No, don't be tricked.
No. A reward?

Speaker 2 It just popped at me.

Speaker 2 Okay, now I'm in delete your data.

Speaker 3 After a couple hurdles, we found ourselves staring down a giant red delete button.

Speaker 2 It's right here. Why are you requesting to delete your data?

Speaker 3 What would you put in there?

Speaker 2 I don't trust you anymore. Sorry, 23andMe.
Yeah, you messed up.

Speaker 3 For a moment, Fovey just kind of hovered over the button.

Speaker 3 How are you feeling? Are you feeling nervous?

Speaker 2 Oh, no, not at all. Should we do it? Let's do it, both.
Okay.

Speaker 3 Hold my hand.

Speaker 2 Yes, your virtual hand. Okay, count down.
In three,

Speaker 3 two,

Speaker 3 one.

Speaker 2 Press.

Speaker 2 Okay, now I have a new screen. Your data is being deleted.
Hey!

Speaker 3 Now, it'll still take a little time for the company to actually destroy the physical saliva sample that Fovey sent in to start her genetic journey.

Speaker 3 In the meantime, she says she'll think twice before breezing through the next privacy agreement she encounters.

Speaker 3 Because these days, you never know what intimate personal data might end up on the bankruptcy auction block.

Speaker 3 For listeners out there who are new to Planet Money, first of all, welcome.

Speaker 3 Second, check out the rest of the feed for stories on Canadian tariffs, why many economists hate the idea of the president firing a Federal Reserve chair, or why everybody and their pet squirrel seem to have a meme coin these days.

Speaker 2 This episode was produced by Sylvie Douglas. It was edited by Jess Jang, fact-checked by Tyler Jones, and engineered by Harry Paul and Neil Rauch.
Alex Goldmark is our executive producer.

Speaker 3 Special thanks to Sarah Gurke and Elise Freka. I'm Alexi Horowitzkazi.

Speaker 2 And I'm Jeff Guo. This is NPR.
Thanks for listening.

Speaker 1 Support for NPR and the following message come from Edward Jones. A rich life isn't always a straight line.
Unexpected turns can bring new possibilities.

Speaker 1 With a hundred years of experience navigating ups and downs, Edward Jones can help guide you. Let's find your rich together.
Edward Jones, member SIPC.

Speaker 1 This message comes from Vanta. What's your 2 a.m.
security worry? Is it, do I have the right controls in place? Or are my vendors secure? Enter Vanta.

Speaker 1 Vanta automates manual work so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires.

Speaker 1 Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. Get started at Vanta.com.
That's V Anta.com.

Speaker 1 This message comes from Solodyne. Yesterday's approach to storage can't meet the demands of today's AI ambitions.

Speaker 1 Bigger, faster, and more energy-efficient, Solidyme solid-state storage solutions are optimized for AI. Learn more at storageforai.com.