What happens to your DNA data if the testing company is sold?

Updated June 2026

Health data privacy

The 23andMe case: a real example of what's at stake

For years, the standard reassurance was that genetic testing companies wouldn't misuse your data. Then in 2025, 23andMe — the most recognizable name in consumer DNA testing, with a database of roughly 15 million customers — filed for Chapter 11 bankruptcy.

Bankruptcy forces a hard truth into the open: a customer database is an asset. In an insolvency, assets are sold to pay creditors, and there is no special carve-out that makes genetic data immune. The prospect of millions of genomes being auctioned to an unknown buyer drew objections from state attorneys general, regulators, and customers, and prompted a wave of people rushing to delete their accounts.

After a court-supervised process, the database was ultimately acquired by a nonprofit led by the company's former CEO, which publicly committed to honoring the existing privacy policy. That outcome was relatively reassuring — but it was not guaranteed at the outset, and the episode showed that the fate of your DNA data can hinge on a courtroom and a list of bidders, not on a promise you read at signup.

Who can end up owning your uploaded genetic data?

When you upload or submit DNA data to a service, you don't lose ownership of your genome in the abstract — but you do give that company a stored copy governed by its terms. From there, several things can change who effectively controls it:

• Acquisition or merger — if the company is bought, your data typically transfers to the new owner as part of the deal. Most privacy policies explicitly reserve this right.
• Bankruptcy or asset sale — as the 23andMe case showed, an insolvent company's data can be sold to satisfy creditors, sometimes to a buyer outside the original industry.
• Shutdown — if a smaller service simply closes, what happens to stored data depends on whether anyone is left to honor deletion requests.
• Policy changes — even with the same owner, a privacy policy can be revised. Permitted uses, research partnerships, and data-sharing terms can broaden over time.

The common thread: the protections you rely on are only as durable as the company holding the data, and that company can change.

What consent and deletion rights do you actually have?

You're not powerless. Depending on where you live and which service you used, you generally have meaningful rights:

• Deletion. Most major services let you delete your account and associated genetic data, and many also let you ask the lab to discard your stored physical sample separately.
• Consent withdrawal. If you previously opted in to research, you can usually withdraw consent for future use — though data already included in completed studies often can't be pulled back.
• Legal protections. In the US, genetic privacy is covered by a patchwork: GINA limits genetic discrimination in health insurance and employment, several states have specific genetic-privacy laws, and frameworks like the EU's GDPR treat genetic data as a special category requiring stronger safeguards.

These rights are real, but they have edges. Deletion may not reach every backup. Anonymized or aggregated data may sit outside deletion entirely. And in a bankruptcy, the timing of your request matters — acting before a sale closes is far cleaner than trying to claw data back afterward.

Why "uploaded" is hard to take back

Genetic data has a property that makes it different from a password or a credit card number: you can't change it. If a card is compromised, you cancel it and get a new one. Your genome is fixed for life, and it partially describes your blood relatives too — none of whom consented.

Once a copy is uploaded to a server, you're trusting not just today's policy but every future owner, every contractor, every backup, and the company's security against breaches. Deletion reduces exposure going forward, but you can't be certain a copy never propagated somewhere during the time it was stored. The most reliable way to keep genetic data out of an acquisition is for it to never have been on the company's servers in the first place.

How to reduce your exposure

You don't have to avoid learning from your DNA to keep it private. A few practical steps go a long way:

1. Download your own raw data and keep it. Whatever happens to the company, you'll have your own copy. See our guide on how to download your 23andMe raw data.
2. Delete what you don't need. If you've extracted your raw file and no longer use the online reports, request account and sample deletion — ideally while the company is stable, not mid-crisis.
3. Prefer on-device analysis. Many interpretation tools ask you to upload your raw file to their servers, which recreates the exact risk you're trying to avoid. Tools that analyze your DNA locally, on your own phone, never put it on a server that can be sold or breached. For the tradeoffs, see on-device vs cloud health data privacy.
4. Read the privacy policy's transfer clause. Look specifically for what happens in an acquisition or bankruptcy, and whether your data can be shared with research or commercial partners.

The bottom line

The 23andMe saga didn't end in a worst-case scenario, but it made the underlying risk concrete: a genetic database is a business asset, and business assets change hands. Knowing what happens to your DNA data in that situation — and that you can download your own copy, delete the uploaded one, and choose tools that keep analysis on your device — puts the decision back in your hands, where your genome belongs.

Want to start by taking control of your file? Browse more guides on the Quanome blog.

Frequently asked questions

Can a genetic testing company sell my DNA data if it's acquired?

Customer genetic data is typically treated as a business asset, so it can transfer to a buyer in an acquisition or bankruptcy. The buyer generally inherits the existing privacy policy, but policies can change over time with notice.

What happened to 23andMe customer data in the 2025 bankruptcy?

23andMe filed for bankruptcy in 2025 and its assets, including the genetic database, went through a court-supervised sale. After regulatory and public concern, a nonprofit founded by the company's former CEO acquired it, pledging to honor existing privacy commitments.

Can I delete my DNA data before or after a company is sold?

Most major services let you request account and data deletion, and many also let you ask the lab to discard your saliva sample. Deletion is strongest before a sale, and some data may persist in backups or anonymized research sets.

How do I reduce the risk of my DNA data being transferred?

Download and keep your own raw data file, then delete your uploaded copy if you no longer need it. For ongoing analysis, prefer tools that read your DNA on your own device instead of uploading it to a server.