DNA For Sale: The Human Rights Crisis in the 23andMe Bankruptcy

Kaori Kawaguchi and Moon Hwan Lee

The auction of identity

This month, a federal judge in Missouri may authorize the sale of one of the most sensitive genetic archives ever assembled. Through the bankruptcy process of 23andMe, corporate bidders have competed to acquire control over the DNA of over fifteen million people. The company built this database through direct-to-consumer saliva kits that provided ancestry insights and health-related information. Around 80% of users opted in to allow their de-identified genetic data to be used for research. This participation helped the company create one of the largest privately held genomic archives in the world. These inherited disease markers, ancestry lines, and familial connections across generations. Some belong to the deceased; others foreshadow the traits of future generations.

These genomes remain specific, relational, and permanent. Attorneys general from 28 jurisdictions describe the data as immutable and everlasting, as it captures each customer’s singular identity. The court must now decide whether to approve the transfer without renewed consent from those whose DNA forms the archive. The dispute asks whether the law continues to recognize biological identity as a matter of rights or treats it as a transferable asset once bankruptcy proceedings begin.

DNA as identity

A single genome reveals connections to parents, siblings, and descendants. When paired with phenotype annotations and family trees, the dataset creates a multi-generational portrait of vulnerability, kinship, and risk. These records affect insurance, jobs, criminal cases, and reproductive choices. No other personal data is as deep or permanent.

The UNESCO Declaration on Bioethics and Human Rights and Article 9 of the General Data Protection Regulation (GDPR) define genetic data as a distinct category requiring explicit, contextual consent. In the United States, informed consent typically depends on a clear purpose and the ability to withdraw. Chapter 11 bankruptcy law does not reflect these principles. Once labeled assets, genomic profiles fall under doctrines that override the original terms of consent.

This legal architecture converts hereditary identity into a tradable asset. These actions shift the definition of personhood to the mechanics of commercial insolvency. Anne Wojcicki’s nonprofit leads the sale, but the data is still legally treated as an asset, with no enforceable structure to preserve consent or restrict future use.

The bankruptcy of consent

Informed consent serves as a legal foundation. It defines the scope, duration, and revocability in medical ethics and research law. 23andMe customers agreed to limited use framed by clinical expectations and regulated trust.

Bankruptcy law follows a different logic. It converts consent-bound records into liquidatable assets. Sale procedures permit transfer “free and clear” of prior obligations, including the terms that governed how data could be used. What began as a voluntary contribution to science now risks becoming a commodity of bankruptcy.

Twenty-eight attorneys general argue that insolvency cannot remove the consent terms customers originally agreed to. Their filing describes the data as immutable, everlasting, and biologically singular. As Jorge Contreras warns, the real harm lies beyond privacy. It stems from turning a gift of trust into an open asset ledger.

These failures expose a deeper structural problem. While consent forms the ethical backbone of medical research, private companies also carry independent human rights obligations. Under the UN Guiding Principles on Business and Human Rights, corporate actors must avoid causing or contributing to rights violations and must mitigate risks linked to their operations. Respecting rights goes beyond ticking boxes or meeting regulatory thresholds. It requires that businesses to treat identity-linked data not as a transferable asset, but as a reflection of human dignity. The bankruptcy court now faces a test: whether to enforce that duty or erase it through liquidation.

Sovereignty after death

These frameworks establish limits, require ethical review, and preserve posthumous autonomy. Yet statutory protections stop short when genomic archives remain in corporate hands. Once a customer dies, legal control dissolves.

The 23andMe dataset contains genetic code from individuals who have died but their records remain active in research databases. A buyer gains authority to exclude researchers, monetize access, or restrict distribution. These decisions extend beyond the deceased and determine the genetic futures of descendants and extended kin.

Attorneys general warned that this transfer encodes identity into corporate property long after lifespans end. Family members lack formal channels to challenge future uses. International frameworks offer no enforceable protection against ancestral DNA appropriation through insolvency.

Indigenous communities have already confronted this pattern. The Havasupai Tribe’s samples were retained and reused beyond their initial consent; genetic repositories outlast the dignity of those who contribute.

This case asks a foundational question: Does legal death terminate genomic sovereignty? Or does biological identity continue to carry human rights across generations?

A public genomic trust

Illinois protects biometric identity, such as fingerprints, under the Biometric Information Privacy Act (BIPA). Yet genetic data, which reaches deeper across generations, lacks equivalent safeguards in bankruptcy.

When 23andMe users shared their DNA for research, they entered a social contract rooted in public trust and scientific purpose rather than commercial exchange. That commitment deserves a legal structure: a public genomic trust. Under this model, any consented dataset would transfer automatically into fiduciary stewardship once insolvency begins. A court-appointed genomic trustee would take temporary legal custody of the data, prevent unauthorized sale, and uphold irrevocable, royalty-free access for public-interest research.

This framework already exists in principle. The US fiduciary doctrine, Japan’s METI guidelines, and the GDPR all support similar protections. A public genomic trust would translate these principles into a structural safeguard: it would preserve research data from being liquidated, sold, or repurposed beyond its original scope. Courts could apply this model to distinguish scientific contribution from commercial inventory using clear legal boundaries. Dignity remains when the law protects public trust from being treated as a commercial asset.

Kaori Kawaguchi is a fellow in the Trilateral Technology Leaders Program at Johns Hopkins School of Advanced International Studies, Washington DC, United States.

Moon Hwan Lee is a graduate of Northwestern Pritzker School of Law, United States.