23andMe's Bankruptcy Exposes Fragility of How Genetic Data Is Utilized Beyond Fee-for-Service, Says Villanova Law Professor

When individuals sign up for direct-to-consumer genetic testing, the extent to which they ever think about their genetic data is likely in the context of the service for which they paid: information on predisposition to a genetic illness, or confirmation of an ethnic background, for example.

But that data doesn’t just sit on a shelf, and while the most mainstream concern for such services is the privacy of your data, there is also the question of what else the companies do with it, and how.

Ana Santos Rutschman, SJD, LLM, professor and faculty director of the Health Innovation Lab at Villanova University Charles Widger School of Law, is particularly interested in the latter. In June 2025, she co-authored an amicus brief centered on data protection and patient’s interests amid genetic testing company 23andMe’s bankruptcy proceedings. In December, many of those same co-authors published a paper in Nature Genetics, highlighting 23andMe’s bankruptcy as “an inflection point for the direct-to-consumer genetics market,” especially as it pertains to the broader corporate use of individuals’ scientific data.

The reason?

“How that data is used all depends on the policies of the individual companies,” she said.

Genetic Testing Companies Use Your Data For More Than The Services You Pay For

Those who utilize genetic testing companies—for any reason—are likely also consenting, often unknowingly, to other unrelated items. This includes acknowledgment of information related to how your data might be further used or monetized.

“Most people don't think about secondary and tertiary uses of their data,” said Professor Rutschman. “[What they consent to] is displayed on the website somewhere, but it’s not easily understandable and accessible. It’s fine print.”

Such companies often operate beyond the traditional “fee for a service” relationship with consumers. Yes, they will give you the information you paid for—finding out whether you have German ancestry or are predisposed to certain genetic disease—but instead of that genetic data just being stored somewhere, it’s often sold for research purposes.

Today, in the age of AI big data, that might look something like this: The company puts your data in a box with parameters, along with thousands of others. Perhaps they are then able to observe a pattern that, until all that data was compiled, was previously unknown. They come up with a diagnostic or a medicine and patent it. That patent is licensed to somebody else, and the company makes money on the product.

The use of that data for scientific purposes—even ones that turn a profit— is not problematic in itself, says Professor Rutschman.

“Some people may even choose a company that allows scientific research over one that doesn’t. Many people may not care, but some will. The uses are not common knowledge, and that is worrisome. The public should be well-informed about what’s happening.”

Deeper problems may arise when they aren’t informed of those potential uses of their data. Professor Rutschman cited the infamous Henrietta Lacks case, in which Lacks’ cells were, and continue to be, one of the most valuable cell lines in cancer research. Neither Lacks nor her family were paid for the widespread use of her genetic material until a settlement was reached long after her death.

“When you have biologics involved, a concern is that if you have something potentially valuable, you may not see any money from it.”

Bankruptcy Can Cause Policy Upheaval

To understand the role bankruptcy can play in all of this, one needs to refer back to the power of individual company policy in this space. There are no external laws that dictate how these companies can further monetize their data, says Professor Rutschman, as long as they don’t violate other laws, such as privacy laws.

That means that when a company like 23andMe goes bankrupt, as was the case in 2025, new ownership could enact completely different corporate policies for use of their property. In their specific case, the company was essentially bought back by 23andMe founder and CEO Anne Wojcicki’s non-profit, all but ensuring policies would remain the same. But that is exactly why Professor Rutschman and others are highlighting this specific case.

“Bankruptcy is bad in the sense that there's a lot of uncertainty,” she said. “In this instance, the person coming in was the person who was there before, so the policy is likely to continue. But that's very rare. There are a roster of companies with access to biological materials. 23andMe is a good example of something not going horribly wrong, but with the understanding that it absolutely could.”

Ways in which that could happen could be new ownership undermining the original intent of the data use by cessation of the company’s previous policies, or charging exorbitant prices to other entities to use that data for scientific research.

“Because there is no law, these new owners can essentially do as they please with their proprietary data, unless they do something incredibly careless that amounts to the level of illegal,” Professor Rutschman said. “And that is concerning.”

Onus Falls to Companies to Enact Safeguards

To ensure a worst-case scenario for such companies does not unfold in a bankruptcy situation, Professor Rutschman points to a number of safeguards they could enact to protect their original commitments, ensure equitable access to data for scientific research and promote fair trade.

One of which is implementing a company policy stating that commitments from a previous iteration of the company need to be honored if ownership is transferred. Those could include, as the authors recommend, policies “honoring original research-oriented commitments under which the data were collected,” as well as not “enclosing the dataset for exclusive commercial use.”

She also highlights the need for Fair, Reasonable, and Non-Discriminatory (FRAND) voluntary licensing commitments, which are inherently more science and market friendly.

“Companies in many sectors have committed to this approach, and we are saying it should apply in this space as well. You’ll charge your royalty, but it can’t be a billion dollars for a data set, nor would it be done by exclusively selling to one entity. You can get that billion dollars by selling to 15, 50 or 100 companies, and from a scientific research perspective, that’s what we want. Otherwise, you have a monopoly or duopoly.

“There are a lot of different models that can be used, but ultimately what we are arguing is leaving this unaddressed is a really bad idea. It leaves everything exposed, and something bad is more likely to happen.”