23andMe had all the signs of a success story. The unicorn brand became synonymous with consumer-facing genetic testing, went public, and was once valued at $6 billion.
But then, it all came tumbling down. Sales for 23AndMe kits began to fall, attempts to raise new funds hit a wall, the company struggled to find a product that would bring in recurring revenue, and it was still dealing with the fallout from a major data breach.
23andMe filed for bankruptcy and put its assets up for sale in March 2025. But, more concerning than the success or failure of a particular company, was this question: What would happen to 23andMe's vast trove of highly personal customer data? We aren't just talking about usernames and birthdays. 23andMe has DNA profiles for millions of users.
Well, now we know who bought 23andMe and, most importantly, now owns all the DNA data from the company's customers.
Meet Regeneron Pharmaceuticals
On Monday, Regeneron Pharmaceuticals announced that it would acquire most of 23andMe's assets for $256 million. According to Regeneron Pharmaceuticals, the acquisition includes 23andMe's Personal Genome Service, Total Health and Research Services business lines, and the trove of customers' DNA samples and genetic data.
This Tweet is currently unavailable. It might be loading or has been removed.
Regeneron Pharmaceuticals will not, however, be acquiring 23andMe's online doctor and telehealth service known as Lemonaid Health, which will be shuttered.
Based in Tarrytown, NY, Regeneron Pharmaceuticals is a biotechnology company that researches and develops medicines for cancer, cardiovascular disease, and other diseases. The company is currently valued at more than $64 billion.
Regeneron Pharmaceuticals placed a bid for 23andMe as part of a court-supervised sales process. The bid requires Regeneron Pharmaceuticals to comply with the company's existing privacy policies and applicable laws.
Conspiracy-minded consumers might revolt at the idea of a big pharma brand acquiring their DNA profile. However, in a press release, Regeneron has promised "to comply with the Company’s privacy policies" and "process all customer personal data in accordance with the consents, privacy policies and statements, terms of service, and notices currently in effect." Further, the company assured customers it has "a proven track record of safeguarding personal genetic data, and we assure 23andMe customers that we will apply our high standards for safety and integrity to their data." A court-appointed expert will also submit a report about potential privacy and security impacts to the court by June 10.
If the name "Regeneron" sounds familiar, it may be because the company received mainstream attention in 2020 after the company created an experimental treatment for COVID-19 called REGN-COV2. President Donald Trump was treated with the drug when he was infected with COVID-19 in October of that year.
While 23andMe's demise is certainly notable, a most lasting debate will undoubtedly be had regarding the sale of 15 million customers' genetic data.
“Your DNA and your family health history should not be a corporate asset," said J.B. Branch, Big Tech accountability advocate for the consumer rights advocacy group Public Citizen, in a statement. "Of course, Regeneron will promise to ‘respect consent’ and ‘uphold privacy policies.’ Those are bare minimal legal requirements. But time and again these companies fail consumers."
Topics Cybersecurity Politics
