Federal Trade Commission Chairman Andrew Ferguson said he’s keeping an eye on 23andMe’s bankruptcy proceeding and the company’s planned sale because of privacy concerns related to genetic testing data. 23andMe and its future owner must uphold the company’s privacy promises, Ferguson said in a letter sent yesterday to representatives of the US Trustee Program, a Justice Department division that oversees administration of bankruptcy proceedings.

“As Chairman of the Federal Trade Commission, I write to express the FTC’s interests and concerns relating to the potential sale or transfer of millions of American consumers’ sensitive personal information,” Ferguson wrote. He continued:

As you may know, 23andMe collects and holds sensitive, immutable, identifiable personal information about millions of American consumers who have used the Company’s genetic testing and telehealth services. This includes genetic information, biological DNA samples, health information, ancestry and genealogy information, personal contact information, payment and billing information, and other information, such as messages that genetic relatives can send each other through the platform.

23andMe’s recent bankruptcy announcement set off a wave of concern about the fate of genetic data for its 15 million customers. The company said that “any buyer of 23andMe will be required to comply with our privacy policy and with all applicable law with respect to the treatment of customer data.” Many users reacted to the news by deleting their data, though tech problems apparently related to increased website traffic made that process difficult.

23andMe’s ability to secure user data is also a reason for concern. Hackers stole ancestry data for 6.9 million 23andMe users, the company confirmed in December 2023.

The bankruptcy is being overseen in US Bankruptcy Court for the Eastern District of Missouri.

FTC: Bankruptcy law protects customers

Ferguson’s letter points to several promises made by 23andMe and says these pledges must be upheld. “The FTC believes that, consistent with Section 363(b)(1) of the Bankruptcy Code, these types of promises to consumers must be kept. This means that any bankruptcy-related sale or transfer involving 23andMe users’ personal information and biological samples will be subject to the representations the Company has made to users about both privacy and data security, and which users relied upon in providing their sensitive data to the Company,” he wrote. “Moreover, as promised by 23andMe, any purchaser should expressly agree to be bound by and adhere to the terms of 23andMe’s privacy policies and applicable law, including as to any changes it subsequently makes to those policies.”