WASHINGTON, D.C. – Today, Congressman Brett Guthrie (KY-02), Chairman of the House Committee on Energy and Commerce, Congressman Gus Bilirakis (FL-12), Chairman of the Subcommittee on Commerce, Manufacturing, and Trade, and Congressman Gary Palmer (AL-06), Chairman of the Subcommittee on Oversight and Investigations, sent a letter to 23andMe regarding the handling of Americans' sensitive data following the company's decision to file for bankruptcy. KEY EXCERPT: “According to 23andMe’s privacy statement, in a bankruptcy, customers’ ‘Personal Information may be accessed, sold or transferred as part of that transaction and this Privacy Statement will apply to [customer] Personal Information as transferred to the new entity.’ Additionally, a judge recently ruled 23andMe has the right to sell the sensitive medical and genetic information of its 15 million customers, which is considered to be the company’s most valuable asset. With the lack of a federal comprehensive data privacy and security law, we write to express our great concern about the safety of Americans’ most sensitive personal information.” Background: On March 23, 2025, 23andMe initiated Chapter 11 bankruptcy proceedings, which could have ramifications for the highly sensitive information of millions of Americans. While Americans’ personal health information is protected under the Health Insurance Portability and Accountability Act (HIPAA), these protections only apply if the information is collected by a HIPAA covered entity. Generally, direct-to-consumer companies, like 23andMe, are not covered by HIPAA. Customers have reported issues accessing and deleting their data from their 23andMe accounts. The Chairmen have requested answers to the following questions: If 23andMe were to sell the personal information of its customers either as a standalone asset or as part of a broader sale of the company, what post-sale data privacy and security protections would be in place for its customers’ personal information? Please describe how the representations made in 23andMe’s privacy statement will continue to apply—and be enforced—if the personal information of 23andMe’s customers is sold to a third party. Please include in this response information about what, if anything, would hold a third-party buyer to 23andMe’s privacy statement or prevent it from subsequently using, transferring, or otherwise selling, such information in the future. Does 23andMe plan to change its privacy statement at any time prior to selling any customers’ personal information? If so, please explain the change 23andMe plans to implement and when those changes will go into effect. Does 23andMe intend to vet prospective buyers to which it may sell its customers’ personal information? If so, please detail the vetting process and whether it will include the prospective buyer’s history of implementing data security protections and compliance with sectoral, state, or any other data privacy and security laws. If not, please explain why. Please detail the categories of customer information 23andMe has, and of that what 23andMe is considering selling. Has 23andMe notified its customers of the company’s bankruptcy announcement? If so, please attach the customer notification. If not, please explain why. Has 23andMe provided its customers with a guide for how to delete, or request to delete any information currently in 23andMe’s possession? If so, please provide a copy of that guide and specify when it was provided to customers. If not, please explain why, and explain whether 23andMe will contact each of its customers and provide an opportunity to delete their personal information prior to a potential sale of the company or personal information maintained by the company. Please detail the number of requests 23andMe received from its customers to delete their personal information between when 23andMe filed for bankruptcy and the date of the response to this letter. Of those requests, please provide a breakdown of how many requests were made by customers through their 23andMe online accounts and how many were made via customer service calls because customers were unable to successfully delete their information through their online accounts. Of those requests, please detail the number of fulfilled requests. Will 23andMe offer for sale any information in which a customer has requested the deletion of such information? If so, does 23andMe’s privacy policy consider selling information a legitimate purpose for retaining information past a customer's request to delete their information? Will 23andMe deidentify its customers’ personal information prior to selling it or the company? If so, please detail which information will be deidentified. If not, please explain why the company is electing not to deidentify information. CLICK HERE to read the full letter. CLICK HERE to read the story from CNBC. ###