Senate Judiciary hearing raises national-security and consumer-privacy concerns over 23andMe bankruptcy sale

Senate Judiciary Committee members and outside experts told a committee hearing that the supervised bankruptcy sale of 23andMe’s customer database raises urgent consumer-privacy and national-security questions because no comprehensive federal law currently bars transfer of genomic data in corporate sales.

The committee heard that 23andMe holds genetic data tied to about 15,000,000 people and that the company is conducting a court-supervised sale with two remaining bidders. Witnesses and senators urged Congress to consider statutory protections requiring affirmative consumer consent before any transfer, greater clarity on deletion and biobanking policies for samples, and tighter oversight of foreign access to sensitive datasets.

Senator Grassley, the committee chairman, opened the hearing by saying, “Genetic data is the blueprint to a person. It's sensitive. It's personal. And in the wrong hands, it can be dangerous.” That theme framed testimony from 23andMe’s interim executive and outside experts on law, bankruptcy, and national security.

Joseph Sell Savage, who testified as interim chief executive and finance officer for 23andMe, told senators the company is conducting a sale under the supervision of a U.S. bankruptcy court and has required bidders to agree to the company’s current privacy policies. “We are requiring that anyone bidding for 23andMe must agree to comply with our privacy policies,” he said. He declined to discuss bid merits because the sale process was ongoing and said two American entities — Regeneron and TTA(T?) Research Institute — remained as bidders.

Harvard Law professor Glenn Cohen told the panel that genetic information “requires special protection because it is immutable, it inherently identifies us, [and] it reveals information about our blood relatives.” Cohen and other witnesses said existing federal privacy protections are spotty: HIPAA generally does not apply to direct-to-consumer genetic testing firms, and the Genetic Information Non-Discrimination Act (GINA) does not cover life, long-term care, or disability insurance. Cohen urged affirmative-consent requirements on asset transfers and broader federal protections for biospecimens.

Bankruptcy-law scholar Brooke Gotberg cautioned against framing the problem as uniquely a bankruptcy issue. She said bankruptcy provides court supervision and transparency that can protect consumers but does not create new substantive privacy law. Gotberg recommended universal (inside- and outside-bankruptcy) statutory protections rather than bankruptcy-only prohibitions, saying a ban limited to bankruptcy sales would likely push transactions outside judicial oversight.

Adam Klein, who testified on national-security risks, said adversaries could use aggregated U.S. genomic datasets to identify, track or target individuals, help train biomedical AI, or gain asymmetric advantages: “Large datasets have great value today for training AI models,” he said, noting China’s attempts to build large biomedical datasets and the strategic value of genetically diverse populations.

Senators highlighted concrete concerns raised in committee questioning: - Deletion requests: Senator Klobuchar said roughly 1,300,000 customers had asked 23andMe to delete their profiles and asked about any backlog; Sell Savage said the company had added staff and was current on deletion requests. Klobuchar framed the deletion demand as a consumer reaction to the bankruptcy announcement. - Minors: Multiple senators pressed whether and how many profiles in the database belong to people under 18 and asked for commitments to prevent sale or to delete minors’ data. Sell Savage said he would take those requests back to the company. - Contractual enforceability: Senators and witnesses discussed whether promises by an acquiring company to maintain a seller’s privacy policy would be meaningfully enforceable, especially across jurisdictions. Gotberg said such promises are contractual and ordinarily enforceable only by the parties to the contract; a buyer could breach and expose harmed parties to a damages claim, but remedies and practical enforcement can be limited. - Government review and foreign buyers: Witnesses pointed to mechanisms such as executive-branch review (CFIUS/FIRRMA-related authorities) that can block purchases by foreign adversaries, and Klein said such processes have improved since 2018. Senators asked when those reviews can occur during bankruptcy due diligence.

Committee members pressed for legislative solutions. Several speakers backed the bill introduced by committee members, described in testimony as the “Don’t Sell My DNA Act,” which would require affirmative consumer consent before the transfer of genomic data in a bankruptcy sale and could extend protections to biospecimens. Senator Durbin and others said a federal privacy law with sector-specific protections would reduce the patchwork of state rules and provide predictability for consumers and companies.

The hearing closed with administrative directions: Chairman Grassley said written questions for the record were due by Wednesday, June 18 at 5 p.m. and asked witnesses to furnish answers within two weeks.

Ending: The committee’s witnesses urged a mix of statutory fixes (affirmative-consent rules and insurance protections), improved cyber and insider-security practices, and use of existing foreign-investment review mechanisms to lessen the risk that sensitive U.S. genomic data could be transferred to actors that would repurpose it. Senator and witness comments made clear Congress must decide whether to create a uniform federal regime for genomic-data protections or continue relying on a patchwork of state laws and private contracts.