In a March 31, 2025 letter, the Chair of the FTC,
Andrew Ferguson, wrote to the Acting U.S. Bankruptcy Trustee and
set out the FTC's expectations for the protection of consumer
information held by 23andMe.
As we noted in our client alert last week, "The Federal
Trade Commission plays a crucial role in protecting consumer
privacy, especially in cases involving the sale or transfer of
personal information during bankruptcy cases. The FTC has a history
of intervening in such cases to ensure that consumer data is
handled in accordance with privacy policies made by the original
data collectors." And so the FTC has intervened, with a letter
containing a number of forceful statements about consumer
expectations and privacy.
The Chair's letter starts with a recitation of 23andMe's
stated privacy commitments, including in the event of
bankruptcy:
- "Importantly, 23andMe promises users that these
protections (and its entire Privacy Statement) shall apply
continuously to their personal information, even if the data is
sold or transferred in a bankruptcy proceeding:
- 'If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction and this Privacy Statement will apply to your Personal Information as transferred to the new entity.'"
The FTC then set out its position in this matter:
- "The FTC believes that, consistent with Section 363(b)(1) of the Bankruptcy Code, thesetypes of promises to consumers must be kept. This means that any bankruptcy-related sale or transfer involving 23andMe users' personal information and biological samples will be subject to the representations the Company has made to users about both privacy and data security, and which users relied upon in providing their sensitive data to the Company. Moreover, as promised by 23andMe, any purchaser should expressly agree to be bound by and adhere to the terms of 23andMe's privacy policies and applicable law, including as to any changes it subsequently makes to those policies."
- "These conditions would help protect users' interests by ensuring that their data and personal information will be used consistent with 23andMe's promises."
These statements come as no surprise, as they are consistent with the FTC's position the bankruptcy case of RadioShack and of XY Magazine.
To view Foley Hoag's Security, Privacy and The Law Blog please click here
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
