My first week at 23andMe, the Wall Street Journal declared the company was worth “nearly $0.” By the time I left, a little more than a year later, the company had filed for bankruptcy.
As a board-certified genetic counselor, I believe that genetic information can empower healthier decisions. I joined 23andMe because I believed in the company’s mission: giving people access to their genetic information. I still do. But belief alone couldn’t save 23andMe, and only time will tell if 23andMe’s bankruptcy is a harbinger of consumer genomics’ death altogether.
On May 20, Regeneron Pharmaceuticals — a U.S.-based biotechnology company best known for drugs like Dupixent and Eylea — was approved as the lead bidder to acquire substantially all of 23andMe’s assets, including its vast database of de-identified genetic and survey data from roughly 12 million customers. A backup bidder — TTAM Research Institute, a new entity led by 23andMe co-founder and former CEO Anne Wojcicki — remains on standby. Until the deal closes later this year, the future of this data remains uncertain.
For those of us who believed in the promise of consumer genomics, it’s a sobering moment.
The approval of Regeneron to acquire 23andMe’s assets offers a chance to reflect on what went wrong, and what we need to get right in the future. Here are three critical things I hope future leaders in this space will take to heart.
1. 23andMe was never meant to be HIPAA-compliant
Many observers have pointed out 23andMe’s HIPAA status —specifically, its lack thereof — as a potential threat to customer privacy. But they often failed to note something key: 23andMe was not a HIPAA-covered entity by design. HIPAA applies only to traditional health care entities like hospitals and insurers, not consumer platforms within the internet economy. HIPAA doesn’t apply to 23andMe in the same way FCC broadcasting rules don’t apply to Netflix. As a 23andMe consumer, you have access to your personal genetic information without HIPAA regulations dictating the experience.
23andMe’s bankruptcy doesn’t diminish its impact
HIPAA allows broad internal data sharing across connected health care entities. As a patient, I can’t prevent my dermatologist from seeing my gynecology notes and lab results in their full form, without anonymity. That’s helpful for care coordination, but not always ideal for privacy.
By contrast, 23andMe users have full control over who sees their identifiable results. You could use a pseudonym. You could choose whether to share your results with your doctor. You could delete your account. Becoming HIPAA-compliant would have required 23andMe to overhaul its infrastructure and business model, likely increasing costs and reducing access. Paradoxically, HIPAA compliance may have meant less privacy and autonomy for users.
HIPAA sets a privacy floor, not a ceiling. Unfortunately, data within HIPAA-covered entities can also be hacked. In my view, 23andMe’s downfall wasn’t due to the company not being a HIPAA-covered entity. Instead, we all placed too much trust in the combination of cybersecurity practices, privacy policies, and consumer privacy laws.
2. The company underestimated the importance of deep, sustained partnerships with clinicians
23andMe revolutionized access to personal health data. But it underestimated how much buy-in it would need from health care providers. Instead of consistently integrating meaningful clinical collaborations within its growth strategy, the company prioritized rapid consumer expansion and research/biopharma partnerships. The company had brilliant internal advocates for clinician education and engagement, but their efforts were often sidelined in favor of higher-growth initiatives. This left both consumers and clinicians with a persistent knowledge gap.
In my decade of genetic counseling experience, the overwhelming sentiment from my peers toward 23andMe was frustration. Genetic counselors consistently found themselves correcting patients’ misperceptions: They believed they’d had a comprehensive, diagnostic genetic test, rather than the population health screening test that is the 23andMe Personal Genome Service. And while genetic counselors understood 23andMe’s limitations, many non-genetics providers didn’t know its benefits. At medical conferences, I spoke with countless doctors and nurse practitioners who were shocked to learn that 23andMe even offered FDA-authorized health reports. Most were only aware of 23andMe’s ancestry testing.
What the company missed is that public health information, even when consumer-generated, can’t be implemented properly without broad clinician buy-in. That’s true with genomics, too. Patients turn to their primary care provider when deciding whether to test, and how to act on results. A successful consumer genomics company will need to bridge that gap.
3. The fall of 23andMe reveals a fault line in how we define, govern, and trust health information in the modern world
Regeneron to buy 23andMe out of bankruptcy for $256 million
23andMe didn’t fail because people just stopped caring about their DNA.
To be clear, the company needed a better recurring revenue strategy. A one-and-done business model was never going to be sustainable. Consumer health platforms must continually attract new users while keeping existing ones engaged with meaningful, high-touch services. Periodic health and wellness reports weren’t enough to compete with platforms like Apple Fitness, Oura, or Noom, which drive daily use through personalized biometric feedback.
23andMe launched a new category before the infrastructure existed to support it. Most clinicians lacked the genomic training to incorporate results into patient care. Regulatory frameworks hadn’t yet adapted to direct-to-consumer testing. And consumers had only limited access to genetic counselors — the very professionals trained to help interpret genetic test results and apply them responsibly.
While 23andMe hired genetic counselors to help design its product and scale delivery ethically, the broader clinical community remained skeptical that consumers could meaningfully engage with genetic insights outside traditional care settings. This created a flywheel of friction: Clinician skepticism slowed adoption, limiting integration, which in turn reinforced 23andMe’s outsider status in health care. Meanwhile, the company faced Silicon Valley’s relentless pressure to grow — delivering more insights, more frequently, in a digital health landscape that rewards speed, scale, and novelty over caution. In trying to lead before the system could follow, 23andMe outpaced the very guardrails that might have legitimized it.
The real lesson here is bigger than any one company. We’re living in a world where health data flows through phones, wearables, and consumer platforms — often outside the scope of traditional laws. Companies like 23andMe force us to ask: Who owns health data? Who uses it? And what happens when platforms collapse?
Recent news has made these questions more urgent. The federal government has launched new initiatives to collect lab and genomic data from veterans and indigenous patients, with low-income, elderly, and disabled Americans as near-term additional targets. At the same time, protections like those within the Genetic Information Nondiscrimination Act (GINA) could plausibly face political scrutiny as part of a broader effort to deregulate health care, dismantle administrative agencies, or minimize federal oversight. It’s not hard to imagine a world in which de-identified genetic data is combined with behavioral analytics to shape insurance access, voter targeting, or public surveillance.
What comes next may not resemble 23andMe at all. Regeneron may choose to preserve the consumer-facing product, but it could just as easily shutter it in favor of leveraging the existing database to accelerate drug development. That’s not inherently unethical, but it raises questions about consent, equitable access, and who benefits from decades of consumer contributions. Will drugs built on this data be affordable? Will they serve the populations who provided the data in the first place?
The connections between biotech leaders also deserve examination. Dr. Huda Zoghbi, a renowned geneticist, sits on Regeneron’s Board of Directors and also chairs the Board of the Breakthrough Prize — a science prize co-founded by Anne Wojcicki and Mark Zuckerberg, among others. These circles are small, and as the lines between private capital, public trust, and scientific authority blur, oversight matters more than ever.
We need a better framework for the future of health data — one that extends beyond HIPAA, centers informed consent, and enforces public accountability even when platforms collapse. We need transparency about how that data is used. And we need public oversight of platforms that traffic in health information, even if they don’t call themselves health care providers.
23andMe didn’t get everything right. But its collapse shouldn’t mean we completely abandon consumer genomics. It should be our reason to rebuild it, better.
Katie Sagaser, M.S., is a licensed, certified genetic counselor who has worked across clinical, start-up, and industry settings to expand access to innovative genomic technologies. The views and opinions expressed in this piece are solely her own and do not represent those of her employer, past or present, or any affiliated institutions.