23andMe After the Bankruptcy: Who Owns Your DNA Data Now and What to Do (Updated October 2026)

23andMe did not disappear. It went through Chapter 11 in 2025 and now belongs to TTAM Research Institute, the nonprofit that Anne Wojcicki founded after resigning as CEO. The service runs as the personal genetics arm of 23andMe Research Institute, raw-data downloads still work, and deletion is still a few clicks away. Here is who holds your DNA data today, what changed in 2026, and what to do about it.

The short answer#

Sources: the TTAM closing announcement filed with the SEC, the 23andMe home page and the 23andMe press release of June 13, 2025, all checked October 14, 2026. The settlement figures are in the timeline below.

What to do now#

The order matters: download first, delete last. Deletion is irreversible, and the raw file is the only part of the service you can take with you. Our step-by-step guide to downloading and then deleting your 23andMe data goes through each screen; the short version follows.

1. Download your raw data. Open your profile menu, choose Settings, scroll to 23andMe Data and click View. Confirm the date of birth, check the consent box and submit the request. An email with a download link follows; confirm the date of birth again and the .zip downloads. In the US this often takes about a week, abroad usually under 48 hours. For an immediate copy, open Resources, then Browse Raw Genotyping Data, and use the Download link at the top (MyGeneFood guide, updated September 15, 2026, checked October 14, 2026). Menu labels have changed more than once since 2025, so older walkthroughs may point to the wrong place. Our guide to downloading raw DNA data covers AncestryDNA and MyHeritage too.
2. Verify the file before you delete anything. Unzip it and open the .txt in a text editor. You should see a comment header that names 23andMe, then one line per SNP with an rsID, chromosome, position and your two-letter genotype. A file of a few hundred thousand lines and 15 to 25 MB unzipped is normal. If it is empty or truncated, request it again.
3. Store two copies, encrypted. One on an encrypted disk or password manager vault, one offline or in a second location. The file identifies you and your relatives for life; a leaked password can be changed, a genome cannot.
4. Decide about the stored sample. 23andMe keeps your saliva sample only if you chose storage (it calls this biobanking). To discard it while keeping the account, go to Settings, then Preferences, and change the sample storage choice to discard (TechCrunch, updated June 14, 2025, checked October 14, 2026). The privacy statement says "a discard choice cannot be reversed" (23andMe privacy statement, last updated October 17, 2025, checked October 14, 2026). If you delete the account, 23andMe discards the sample automatically.
5. Delete the account, or just withdraw research consent. To delete: Settings, then 23andMe Data, click View, scroll to Delete Data and click Permanently Delete Data; then confirm the link in the email 23andMe sends (same TechCrunch guide). Deleting "cannot be cancelled or reversed" and opts you out of research (same privacy statement). If you want to keep your reports but stop contributing to studies, go to Settings, then Research and Product Consents, and withdraw consent there instead; TTAM committed to honor that choice "in perpetuity" (see below). Deletion does not reach de-identified data already used in completed studies, and TechCrunch has pointed out that backups and data shared with research partners may be out of reach as well.

If you want a health report from the file without uploading it anywhere, Full Human reads the raw file inside your browser tab and nothing is sent to a server; the security page explains how to verify that yourself. Our comparison of 23andMe alternatives for health reports covers the other options.

Timeline: 2023 to 2026#

Every source in this list was checked on October 14, 2026.

• October 1, 2023. A hacker claims to hold millions of 23andMe profiles. The company finds that about 0.1 percent of accounts (roughly 14,000) were opened with passwords reused from other breaches, and that the intruder used the DNA Relatives feature to scrape profile data of about 6.9 million people: names, ancestry estimates, birth years, locations and family-tree entries, not raw genotype files (NBC News, December 4, 2023; California Attorney General, May 28, 2026).
• March 23, 2025. 23andMe Holding Co. files for Chapter 11 in the US Bankruptcy Court for the Eastern District of Missouri to sell the business. Anne Wojcicki resigns as CEO the same day; CFO Joe Selsavage becomes interim CEO (USA Today via Yahoo Finance, March 24, 2025).
• May 19, 2025. After an auction that ended on May 16, 23andMe announces a definitive agreement to sell substantially all of its assets to Regeneron Pharmaceuticals for $256 million, subject to court approval at a hearing set for June 17 (23andMe press release filed with the SEC, May 19, 2025).
• June 10, 2025. A coalition of 27 states and the District of Columbia sues in the bankruptcy case, arguing that genetic data "is too sensitive to be sold without each customer's express, informed consent" (New York Attorney General, June 10, 2025).
• June 2025. At a House Oversight Committee hearing, the interim CEO says 15 percent of customers have asked for deletion since the filing (TechCrunch, June 14, 2025); TechCrunch's deletion guide puts the figure at about 1.9 million people (TechCrunch, updated June 14, 2025).
• June 13, 2025. The court reopens bidding and TTAM Research Institute wins with $305 million, an agreement that "will fully replace and nullify" the Regeneron deal (23andMe press release).
• June 17, 2025. The UK Information Commissioner's Office fines 23andMe £2.31 million for the breach, which touched 155,592 UK residents; the ICO notes there was no extra verification before raw genetic data could be downloaded (ICO).
• June 27, 2025. The bankruptcy court approves the sale to TTAM (Missouri Attorney General, July 2, 2025); 23andMe announces it on June 30 (SEC exhibit).
• July 14, 2025. Two things on one day. The bar date for filing claims in the bankruptcy passes (TechCrunch, May 11, 2025), and TTAM completes the purchase of the Personal Genome Service and Research Services lines; "23andMe is continuing to operate" (SEC exhibit).
• October 30, 2025. 23andMe Research Institute names its Privacy Advisory Board: Peggy Bodin (HCA Healthcare), Fred Cate (Indiana University) and Jonathan Zittrain (Harvard Law School) (press release).
• January 30, 2026. Bankruptcy Judge Brian C. Walsh grants final approval of the class settlement for the 2023 breach; the administrator, Kroll, had begun notifying class members in November 2025 (Keller Rohrback).
• February 17, 2026. Claim deadline (Keller Rohrback). The class was US customers who were notified that their data was affected by the 2023 breach; the exact class definition is on the settlement website, 23andmedatasettlement.com, which we could not load at the time of writing.
• May 28, 2026. California's Attorney General sues Chrome Holding Co., the bankrupt shell formerly known as 23andMe, in San Francisco Superior Court over the breach, citing nearly 7 million affected users and 855,541 Californians (oag.ca.gov). The suit targets the estate, not TTAM's operating business. The estate has asked the bankruptcy court to halt the suit; Judge Walsh had not ruled as of June 8, 2026 (Bloomberg Law, June 8, 2026).
• July 7, 2026. The bankruptcy court approves the final settlement amount of $46.75 million; $14.29 million had already been paid, leaving $32.46 million to distribute (Gizmodo).
• October 1, 2026. Claimants report payments from "23andMe Data Settlement" arriving by Venmo; the administrator, Kroll, has not published per-claim amounts (Open Class Actions, updated October 9, 2026).

A correction to the earlier version of this article: it said the claims window for the breach closed on July 14, 2025. That was the bankruptcy bar date for proofs of claim. The class settlement's claim deadline was February 17, 2026.

What TTAM committed to, and what you cannot check#

The sale agreement and the state attorneys general extracted a list of promises (23andMe press release, June 13, 2025; Missouri Attorney General):

• Comply with the existing privacy policies and process data under the consents and terms in effect at the sale.
• Keep the right to delete your account and data at any time, and to opt out of research "in perpetuity".
• Email every customer at least two business days before closing.
• No sale or transfer of genetic data in a future bankruptcy or change of control unless the buyer is a qualified domestic entity that adopts the same commitments; no sharing with entities tied to countries of concern.
• A three-person Consumer Privacy Advisory Board, privacy procedures, notice of material changes, and annual reports available to state attorneys general on request.
• Two years of Experian identity-theft monitoring.
• De-identified data continues to be used for research by opted-in customers.

Most of this has happened on paper: the board exists, the privacy statement was refreshed in October 2025, and deletion still works. What you cannot check from the outside: whether a deletion reaches backups and datasets already shared with research partners; what the annual privacy reports say, since they go to attorneys general on request rather than to the public; and whether "in perpetuity" survives another owner. The commitments bind TTAM. A future owner is bound only through TTAM's promise to require the same commitments as a condition of any transfer; no court order reaches that owner directly. The only controls you can count on are the ones you exercise yourself: hold the file, and delete the account if you no longer want to be a customer.

How 23andMe got here#

23andMe began selling direct-to-consumer tests in November 2007 on a one-time kit purchase. In November 2013 the FDA ordered it to stop marketing health results; new US customers lost health reports from December 5, 2013 until carrier reports returned in October 2015. In June 2021 the company listed on Nasdaq through a merger with VG Acquisition Corp at a $3.5 billion valuation, under the ticker ME (Wikipedia, checked October 14, 2026). A subscription tier and a drug-discovery partnership with GSK never replaced the revenue of a market where most people buy one kit, once. The 2023 breach and the lawsuits arrived while the share price was already below a dollar; the bankruptcy followed in March 2025, and the ICO fine came after it. The lesson for customers is older than the bankruptcy: a company's privacy promise lasts as long as the company, and the raw file is the one asset you can take with you.

Changelog#

• 2026-10-14. Rewritten answer-first. Corrected the claims-window sentence (July 14, 2025 was the bankruptcy bar date; the settlement deadline was February 17, 2026). Added the January and July 2026 settlement approvals, the October 2026 payments, the May 2026 California lawsuit, the October 2025 Privacy Advisory Board and the 23andMe Research Institute name. Removed a sentence that described analysis "in secure environments"; our reports are generated in the browser and nothing is uploaded.
• 2026-10-09. Updated the TTAM sale details.
• 2025-05-04. First published.

FAQ#

Is 23andMe going out of business?

No. The company went through Chapter 11 in 2025, but the consumer service and the research programme were bought by TTAM Research Institute and continue to operate. Kits and reports are still sold at the time of writing. What changed is the owner, the nonprofit structure and the name; the privacy risks of holding a genome on someone else's server did not.

Who owns 23andMe now?

TTAM Research Institute, a California nonprofit public benefit corporation founded and led by co-founder Anne Wojcicki. It paid $305 million and closed the purchase on July 14, 2025. The consumer service now describes itself as the personal genetics service of 23andMe Research Institute, a 501(c)(3), and the website lives at 23andme.org.

Did Regeneron buy 23andMe?

No. Regeneron won the first auction in May 2025 with a $256 million bid, but the court reopened bidding and TTAM's $305 million offer replaced the Regeneron agreement on June 13, 2025. Regeneron never took possession of customer data. Articles that still say 23andMe was sold to a pharmaceutical company were written before the second round.

Can I still download my raw data from 23andMe?

Yes. Go to Settings, scroll to 23andMe Data, click View, confirm your date of birth and submit the request; an email with a download link follows, and the .zip downloads after you confirm your date of birth again. Resources, then Browse Raw Genotyping Data, gives an instant copy. Third-party guides updated in September 2026 confirm the path. Download and verify the file before you delete anything.

Can I still claim money from the 23andMe breach settlement?

Not any more. The $46.75 million settlement covered US customers who were notified that their data was affected by the 2023 breach, and the claim deadline was February 17, 2026. The bankruptcy court approved the final amount on July 7, 2026, and claimants reported payments arriving from October 1, 2026. Only valid claims filed in time are paid.