Congress Launches Investigation into 23andMe Bankruptcy Over Genetic Data Concerns

The House Committee on Energy and Commerce has opened an investigation into 23andMe’s Chapter 11 bankruptcy, raising alarms over the security of the company’s vast troves of sensitive genetic data.

In a letter sent Thursday to interim CEO Joe Selsavage, Republican Reps. Brett Guthrie (Ky.), Gus Bilirakis (Fla.), and Gary Palmer (Ala.) demanded answers about the company’s data handling and privacy practices by May 1. The lawmakers warned that customers’ genetic information—arguably the most personal type of data—is at heightened risk of being exposed or misused as the company restructures.

The inquiry comes just weeks after 23andMe filed for bankruptcy protection in Missouri federal court. Once a Silicon Valley success story valued at $6 billion, the company has struggled to build a sustainable business beyond its popular DNA testing kits. With its assets now on the auction block—including its enormous genetic database—privacy advocates and policymakers are increasingly sounding the alarm.

“There is currently no comprehensive federal law safeguarding data privacy and security, which makes this situation especially troubling,” the congressmen wrote. They expressed “great concern” about what could happen to customer information during the asset sale process.

Other government bodies, including the House Oversight Committee and the Federal Trade Commission, have also reached out to the company in recent weeks, asking for clarity around how it plans to protect consumer data during bankruptcy proceedings.

The company has been under scrutiny since a major data breach in 2023, when hackers accessed the profiles of nearly 7 million users. Because genetic data is inherently identifiable and cannot be fully anonymized, experts warn that leaks of such information could lead to identity theft, insurance fraud, and other malicious uses.

Despite these concerns, 23andMe has maintained that its privacy standards will remain intact. In a March statement, the company said any buyer of its assets must commit to its existing privacy policies and applicable laws. “To constitute a qualified bid,” the company said, “potential buyers must, among other requirements, agree to comply with 23andMe’s consumer privacy policy.”

Still, the lawmakers noted that some customers have reported difficulty deleting their data, despite the company stating that users retain that option via its website.

“Regardless of whether the company changes ownership, we want to ensure that customer access and deletion requests are being honored,” the letter read.

Under current law, most direct-to-consumer genetic testing firms like 23andMe fall outside the scope of HIPAA, which governs how traditional healthcare entities handle personal health information. That regulatory gap, lawmakers say, leaves millions of consumers vulnerable.

Guthrie chairs the House Energy and Commerce Committee, with Palmer and Bilirakis leading key subcommittees on oversight and trade. Their letter underscores growing bipartisan calls for stronger federal safeguards over biometric and health data—especially as tech companies face financial turmoil.