Inadequate regulatory protections for consumer genetic data privacy in US

In a Policy Forum, Natalie Ram and colleagues discuss the concerning gaps in robust regulatory protection on direct-to-consumer genetic data and biospecimens. After declaring bankruptcy in March 2025, the direct-to-consumer (DTC) genetic testing company, 23andMe, sold the genetic data of over 15 million people worldwide to a nonprofit founded by 23andMe’s own CEO. Although the nature of the sale meant the data remained under familiar leadership, it was controversial and highlighted critical gaps in legal protection for genetic information. Inevitable future commercial sales of such data – potentially with no connection to the original company and its policies – raise the risk of privacy violations. According to Ram et al., companies can revise privacy policies, undermine consumer consent, or share sensitive genetic information with insurers, researchers, or law enforcement, leaving consumers vulnerable. The authors argue that, without stronger safeguards, biospecimens and data may be subject to exploitation, commercialization, or misuse, raising risks that extend to global security.

Unlike the European Union, the U.S. lacks a comprehensive federal privacy framework when it comes to safeguards for genetic data. Although the U.S. Congress is exploring legislation, including the Genomic Data Protection Act and the Don’t Sell My DNA Act, Ram et al. highlight how these proposals fall short of offering meaningful protection for consumers. “The 23andMe bankruptcy reminds us how vulnerable people’s DTC genetic data are to sale and potential misuse, given gaps in the law and the predictable vagaries of commercial markets,” write the authors. “Congress and other lawmakers must act to robustly protect DTC genetic data and biospecimens into the future.”