Attorney General Todd Rokita continued his leadership in the fight to hold tech companies accountable for consumer privacy today, announcing that the entity buying 23andMe has agreed to consumer protections as part of a bankruptcy sale.
“Hoosiers who have provided sensitive information to this company deserve assurance that their data will remain confidential and secure amid these bankruptcy proceedings,” Attorney General Rokita said. “The agreement we forged with the new owners of 23andMe helps achieve this objective, and I’m proud of our team’s work toward achieving a resolution.”
Before 23andMe filed for bankruptcy in March 2025, Attorney General Rokita co-led a coalition of 44 attorneys general to investigate a 2023 data breach that impacted over 6.9 million 23andMe customers.
After the breach, sensitive data stolen from 23andMe customers was posted on the dark web for sale, including targeted sales within days of the 2023 Hamas attack on Israel of the data of at least 1 million individuals with Ashkenazi Jewish heritage. Attorney General Rokita demanded that 23andMe comply with security and privacy safeguards to protect consumer data.
Undeterred by the bankruptcy filing, Attorney General Rokita took additional decisive action, including:
- Issuing a consumer alert to Hoosiers reminding them of their right to delete their 23andMe accounts if they choose.
- Being the first state to appear in the bankruptcy proceeding to stand up for consumers’ right to control their own genetic information.
- Pressing the Indiana General Assembly to pass HEA 1521, Indiana’s new genetic privacy law, on an emergency basis, effective May 6, 2025, to further protect Hoosiers and ensure direct-to-consumer genetic testing companies like 23andMe act responsibly.
- Leading states to work with the entity buying 23andMe to include consumer protections in the sale order, including security and privacy safeguards that Indiana demanded 23andMe adopt before it filed for bankruptcy.
TTAM — a nonprofit created by 23andMe founder and CEO Anne Wojcicki — was selected as the winning bidder in the bankruptcy sale. Key conditions of the sale include:
- No transfer of customer DNA – Because TTAM is affiliated with 23andMe, no genetic data will be transferred to a third party.
- Customer control over data – TTAM has agreed, in perpetuity, to allow consumers to permanently delete their data at any time, with new mechanisms in place to ensure that deletion requests are honored and verifiable by the Attorney General.
- Compensation for data breach victims – TTAM’s $305 million bid will help pay claims to the over 6.9 million people affected by 23andMe’s 2023 data breach.
- Preserving scientific research – The nonprofit status of TTAM enables it to partner more freely with other public institutions and researchers, ensuring ongoing progress in critical health and medical research for data of consumers who have opted in to such research.
- No disruption to services – With the same founder at the helm, consumers who wish to continue to receive the services they paid for will see no meaningful change in ownership or use of their data.
Attorney General Rokita will continue monitoring the transition closely, including enforcement of data deletion rights and compliance with privacy and data security laws.
