23andMe Sells DNA Database to Regeneron in £256m Deal: Is Your Data Safe?

Genetic information submitted by millions of 23andMe users is now in the hands of pharmaceutical giant Regeneron, following a £200 million acquisition deal.

Originally provided by customers seeking personal health or ancestry insights, the data may now be used to develop new drugs — with limited control or consent from the individuals it came from.

The Sale That Shook Consumer Genetics

In a shocking deal, it was announced that Regeneron would acquire 23andMe for £256 million (roughly $330 million). The deal includes most of 23andMe's assets, notably its biobank of about 15 million genetic samples and associated data. The company filed for bankruptcy earlier this year after a data breach compromised millions of user profiles, exposing concerns about privacy and misuse.

The acquisition offers Regeneron access to one of the largest collections of consumer genetic data ever assembled. This information, given voluntarily by customers seeking insights into their health and ancestry, now sits in the hands of a pharmaceutical firm eager to turn it into new drugs. While Regeneron claims it will respect existing privacy policies, critics warn that the sale significantly expands the commercial reach of personal data, especially since it includes genetic information from relatives and ancestors.

What Does This Mean for Your Privacy?

When you joined 23andMe, you agreed to their privacy policies, which stated that your data would be used for research and personalised reports. However, the sale of the company's assets to Regeneron shifts the landscape. The firm has a history of large-scale genetic research, but it also develops and sells medicines. This raises questions about whether users will be compensated or even fully aware of how their data is subsequently used.

A spokesperson for Regeneron expressed confidence that the company would handle the data responsibly. Yet, the real concern remains: once genetic data leaves the consumer platform, it's challenging to control its future use. The company has promised to process data following privacy policies and has appointed a consumer privacy ombudsman to monitor the situation. Still, history suggests that once data is in the commercial sphere, guarantees are hard to uphold.

Legal and Ethical Concerns

The deal, subject to approval by the U.S. Bankruptcy Court for the Eastern District of Missouri, faces scrutiny over privacy and ethical considerations. The court hearing is scheduled for 17 June 2025, with the expectation that Regeneron will take control later in the year. In the meantime, the company has stressed its commitment to privacy and security, citing its experience in handling large datasets securely.

Yet, the core issue remains: consumers gave their DNA voluntarily, believing it would be used for personal insights or health research. Now, it could be harnessed to develop new drugs, possibly generating significant profits without direct compensation or consent. The question lingers—if your genetic data helped create a profitable medicine, would you ever see a share of those benefits?

What Should You Do?

If you sent your DNA to 23andMe, it's worth reviewing what you agreed to. Most privacy policies include clauses allowing data sharing with third parties, often without explicit consent for each new use. Given the recent sale, it's wise to consider how your information might now be utilised.

While regulators and the company itself emphasise privacy safeguards, the reality is that once genetic data is sold, control is limited. If you're concerned about future uses, you might want to delete your account and genetic data from 23andMe's servers. However, it's uncertain whether this will prevent your data from being further exploited, especially if it has already been shared or anonymised.