DNA Fire Sale: Why 15 Million Genomes Are Up for Grabs
The bankruptcy court that approved the sale of fifteen million Americans’ DNA last summer wasn’t violating the country’s signature genetic privacy law, because that law was never written to apply.
In the summer of 2025, a bankruptcy court in the Eastern District of Missouri approved the sale of genetic data on roughly fifteen million Americans. The buyer was a nonprofit research institute founded and controlled by the same person who founded the company being sold. The Genetic Information Nondiscrimination Act of 2008 was not violated. It was not even implicated.
The law that most Americans believe protects their DNA was never written to apply to a sale of this kind. Six months later, on April 27, 2026, a content recycle of a 2024 Lund University paper traveled widely under the headline “Researchers Solve 50-Year-Old Blood Group Mystery.” What both the original coverage and the recycle missed was the structural point: the biology American law was drafted to govern in 2008 is no longer the biology Americans have.
GINA was already broken when it was signed
George W. Bush signed the Genetic Information Nondiscrimination Act on May 21, 2008. Then-NIH director Francis Collins called it “a great gift to all Americans.” The law had been thirteen years in the making, first introduced in 1995, when the Human Genome Project was the dominant scientific frame and “epigenetics” was a research-paper word.
GINA defines genetic information as DNA sequence variants and family medical history. It prohibits health insurers and employers with fifteen or more workers from using that information for discrimination. It does not apply to life insurance, long-term care insurance, or disability insurance. It does not regulate the collection, use, or transfer of genetic information generally.
The Lund team’s discovery, published in Nature Communications in 2023 and extended in Transfusion the following year, is one example among many of what GINA never covered in the first place. Variation in blood antigen expression turns out to be governed by epigenetic regulatory elements outside the DNA sequence itself. The same is true of methylation patterns, expression-state biomarkers, polygenic risk scores derived from common variants no individual instance of which would trigger the statute, and AI risk scores trained on biological data that aren’t legally “genetic information” as defined.
The mismatch was structural at the moment of signing. The law was written for a biology we don’t have anymore.
The bankruptcy that proved the point
23andMe filed for Chapter 11 protection on March 23, 2025. The company had been valued at six billion dollars after its 2021 public listing. Its database held genetic data from roughly fifteen million customers. It collapsed after a 2023 data breach, declining test-kit sales, and the costly failure of its drug-development arm.
On July 14, 2025, after thirty-plus state attorneys general had objected, the bankruptcy court approved a $305 million sale of the genetic database to a newly created nonprofit called TTAM Research Institute, founded and controlled by 23andMe’s own founder, Anne Wojcicki. The for-profit company shed its debts, rebranded as a nonprofit, and reacquired its most valuable asset.
About 1.9 million customers managed to delete their data during the proceedings. The remaining roughly thirteen million did not.
The legal architecture worked as designed. It permitted this. As University of Illinois bankruptcy law professor Robert Lawless told Bloomberg Law: “If outside of bankruptcy court, 23andMe just sold equity to somebody else, none of this would have applied.”
The privacy laws don’t cover changes in ownership structure. GINA doesn’t cover sales of data. There is no federal genetic-privacy statute that does.
The conventional defense of GINA is that documented cases of genetic discrimination have been rare. That’s true and it’s misleading. Discrimination doesn’t generate court cases when the algorithms doing the work don’t take “genetic information” as legally defined as inputs, when the products doing the work are explicitly outside GINA’s reach, and when self-selection out of testing makes the harm invisible by design. The 23andMe sale generated no GINA litigation, and there was nothing to litigate.
The script the country has run before
Sickle cell trait, 1970s. New York State required SCT testing for marriage licenses for “non-Caucasian” applicants, and several states screened “urban” schoolchildren. Insurers denied coverage to carriers, almost all of them Black Americans. Employers refused jobs.
The Air Force grounded Black pilots with the trait in 1981. The genetic marker that arrived as a public-health tool became a discrimination infrastructure inside a decade. The corrective came not from a comprehensive genetic-privacy law, because there wasn’t one, but from civil-rights litigation, federal executive action, and slow institutional reform. People got hurt in between.
The mechanism then was overt: state laws targeting specific populations for testing, denials of insurance and employment that named the underlying trait, medical-liability defenses dressed as concern for the carrier. The mechanism now is algorithmic: risk scores trained on inputs that aren’t legally defined as genetic information, generating outputs that don’t legally count as discrimination. The architectures look different, but the downstream pattern is the same: a marker travels faster than its governance, and the people most exposed to the harm are the ones least equipped to refuse the testing.
GINA’s drafters knew this history. Senator Ted Kennedy cited fear of genetic discrimination as the bill’s animating concern. The drafters were also constrained by what was politically achievable: an insurance industry that successfully carved out life, long-term care, and disability products, an employer lobby that secured a fifteen-employee threshold, and a definitional fight over what counted as “genetic information” that the bill won by drawing the category narrowly.
The narrow drawing was the cost of passage. The cost of the cost is the regulatory vacuum the country now occupies.
The coalition that could fix this no longer exists
The 2008 GINA coalition was specific to its moment. Disease advocacy groups in the breast and colon cancer communities provided human stories, civil-rights organizations provided historical memory, biotechnology companies provided technical credibility, and research scientists provided the future-of-medicine argument. The coalition held for thirteen years and dissolved at the moment of victory.
The coalition that would expand GINA today doesn’t exist in any operational sense. Disease advocacy is fragmented across hundreds of conditions with competing priorities. Civil-rights organizations have post-2020 priorities that compete with bioethics for attention and money. Biotechnology has consolidated into a small number of companies whose interests align with insurers as often as with patients.
Research scientists are mostly silent on regulatory questions outside their immediate funding concerns. The thirteen-year coalition that produced GINA took a generation of advocacy and a uniquely bipartisan cancer-genetics moment to assemble. The political conditions that would assemble its successor are not present and aren’t coming.
That’s the thing about regulatory vacuums. They aren’t always temporary, and the one around epigenetic data, AI underwriting, and direct-to-consumer genetic information has all the markers of a stable equilibrium: too few interested parties to produce reform and too many entrenched interests to permit it. Expecting Congress to close it is a category error.
The Lund team’s findings will help blood banks. They will also be available, for whatever purposes, to insurance underwriters, to employers in states without genetic-privacy laws, and to the buyer of the next bankrupt consumer-genomics company.
The 1970s told the country what happens when biological markers travel faster than the regulatory architecture meant to govern them. The country knew.
It chose, in 2008, to draw the architecture narrowly. It chose, in 2025, not to widen it. The next discovery will arrive in a country that has already decided how to use it.