The DNA data of more than 15 million customers of DNA testing firm 23andMe is set to be returned to the control of 23andMe co-founder and former CEO Anne Wojcicki, after the non-profit she leads outbid previously announced buyer, biotech Regeneron, by $70 million.

The Wojcicki-led TTAM Research Institute (TTAM), which focuses on DNA-based research, lodged a $470 million ($US305 million) offer for 23andMe’s assets after Regeneron Pharmaceuticals had agreed to pay $400 million ($US256 million), forcing the bankruptcy court to reopen the sale.

Regeneron ultimately declined to lodge a counteroffer, leaving TTAM to buy 23andMe’s data with a bid that 23andMe chair of the board Mark Jensen said “resulted in significantly more value to our stakeholders while enhancing critical protections around customer privacy, choice, and consent.”

Wojcicki’s return to control of 23andMe marks yet another chapter in the turbulent history of the company, which became a household name after its founding in 2006 and was worth over $9 billion ($US6 billion) before a massive 2023 data breach led to its March bankruptcy.

A “thrilled” Wojcicki – whose previous attempts to acquire 23andMe were reportedly rebuffed by its board – welcomed the chance “to continue the mission of 23andMe to help people access, understand and benefit from the human genome.”

Anne Wojcicki leads TTAM Research Institute which has acquired 23andMe. Photo: Shutterstock

“We believe it is critical that individuals are empowered to have choice and transparency with respect to their genetic data and have the opportunity to continue to learn about their ancestry and health risks as they wish.”

Data security doesn’t get more personal than this

TTAM’s stewardship of 23andMe’s controversial data set – which contains intimate and unchangeable data derived from home saliva swab testing – will be guided by seven binding provisions designed to protect data privacy and security.

These include allowing customers to delete their data; notifying them about the acquisition and their right to opt out; committing not to sell it to a third party unless they adopt similar protections; and implementing and reporting on privacy procedures and any data breaches.

23andMe customers will also get two years of free identity theft monitoring, while TTAM will establish a Consumer Privacy Advisory Board and continue allowing university and non-profit researchers to access deidentified data while refusing donations from entities in specific countries.

Despite its outward commitment to privacy, concerns that its data could be abused for nefarious purposes – or sold to the highest bidder for marketing or other purposes – have weighed down its efforts to move past the breach.

Wojcicki’s bid drove no fewer than 22 “concerned” US Congressional representatives to write to TTAM, asking for additional detail about how it would fulfil its obligations under the bid’s provisions and requesting that it “adopt the broadest possible interpretations of previous policies.”

“Unlike breaches of mutable identifiers, the leak of genetic data presents a threat to victims potentially in perpetuity,” they wrote, warning “genetic data is highly sensitive and its inclusion in a commercial bankruptcy proceeding presents enormous and unprecedented privacy risks.”

Walking a fine line around personal data

Such scrutiny is certain to persist as TTAM, which doesn’t seem to have existed before 13 June, works to rebalance the company while ramping up its security controls to meet strict privacy requirements.

In TTAM’s native California, enforcement of the state’s California Consumer Privacy Act (CCPA) is different for non-profits than for-profit companies – theoretically giving TTAM more leeway than a for-profit company like Regeneron would have had, although Wojcicki will have to tread carefully.

And while a core conceit of 23andMe’s growth has been its promise to help customers better understand family histories, medical predispositions, citizenships and ethnicity – and the often confronting discovery of unknown family secrets – TTAM has other uses in mind for the data.

The organisation has just one basic web page, on which it calls itself “a nonprofit medical research organisation dedicated to helping scientists and non-scientists join together to unravel the mysteries of DNA” – suggesting that Wojcicki sees the 23andMe data as a rich medical resource.

“The 23andMe community of consented individuals,” she said, “will have the opportunity to be part of making novel genetic discoveries that improve our knowledge of DNA – the code of life – and the health and wellness of everyone…. The future of healthcare belongs to all of us.”