--- title: "Consent does not travel" subtitle: "What happens to your data when the company is sold" type: essay canonical: https://offline.ltd/smaller-kingdom/consent-does-not-travel markdown_url: https://offline.ltd/docs/Consent_Does_Not_Travel.md publisher: Offline.Ltd (Meanwhile) author: Twan site: https://offline.ltd topics: [privacy, bankruptcy, 23andMe, GEDmatch, genetic data, consent, warrants] summary: > You consented to a privacy policy, not to a party. When 23andMe went bankrupt in 2025, a court held that transferring fifteen million people's genetic data needed no fresh consent. GEDmatch shows the same drift in the terms rather than the owner. key_claims: - "A privacy policy is a description of current intentions by a current owner, not a contract with the future." - "Consent attaches to a moment, and data persists past that moment." - "Opting out can be overridden by a warrant obtained by a third party." license: Quotation permitted with attribution to Offline.Ltd (https://offline.ltd) --- # Consent does not travel. *You agreed to a privacy policy. You did not agree to whoever ends up owning it. Those are different things, and only one of them is durable.* Two cases, both recent, both entirely legal, both involving data people handed over willingly for reasons they felt good about at the time. Neither is a breach. That is the point of putting them together. ## Fifteen million genomes in a bankruptcy estate 23andMe filed for Chapter 11 bankruptcy protection on 23 March 2025 in the Eastern District of Missouri. Roughly fifteen million people had given the company their saliva, and about four in five had additionally consented to their genetic data being used in research. In bankruptcy, that data was an asset. The first auction, in May 2025, was won by the pharmaceutical company Regeneron at $256 million. Bidding was reopened, and in June the winning bid of $305 million came from TTAM Research Institute, a nonprofit led by the company's own co-founder. The sale was approved on 27 June 2025. The part worth reading closely is not the price. It is the reasoning. The court held that transferring the genetic data did not require customers to opt in, because a wholly owned subsidiary is not a "third party" under the relevant state genetic privacy laws, and because customers were already on notice through the privacy policy that their information could be shared with corporate affiliates. Read that again as a customer. The protection you thought you had was a promise made by a company about itself. When the company changed shape, the promise travelled with the assets, and your consent was deemed to have covered it in advance. ## The regulators saw it coming California's Attorney General, Rob Bonta, issued an urgent consumer alert on 21 March 2025, two days before the filing, reminding Californians that they could direct the company to delete their data and destroy their stored samples. In June, twenty-eight state attorneys general went to the bankruptcy court to try to block the sale without explicit customer consent. By the time of a congressional hearing that same month, about 1.9 million of the roughly 15 million customers had submitted deletion requests. Which means roughly thirteen million had not, most of them presumably because they were not following bankruptcy news about a company they had used once, years earlier, and then forgotten. That is the ordinary case. Not negligence: just life. Nobody monitors the corporate health of every company holding a piece of them. ## The rules drift too: GEDmatch The second case is about terms rather than owners, and it moves in four steps. **Step one.** People uploaded DNA profiles to GEDmatch, a free genealogy matching site, to find relatives. That was the deal. **Step two.** In April 2018, investigators used the site to identify Joseph James DeAngelo as the Golden State Killer, having uploaded a profile built from crime scene evidence. The site's operator said this had been done without the site's knowledge. In May 2018 the terms were rewritten to permit law enforcement use, defined narrowly as homicide and sexual assault. **Step three.** Later that year the site granted an exception outside its own published rules, allowing a search in an aggravated assault case in Utah. When this emerged, the genealogy community reacted badly, and in May 2019 the site flipped police matching to opt-in. The searchable pool fell from roughly 1.2 million profiles to zero overnight. By October, about 181,000 people had opted back in. **Step four.** In November 2019 a detective in Florida obtained a warrant for the entire database, including the roughly one million people who had not opted in. It was handed over within about a day. The following month the site was acquired by a forensic genomics company. At no point did the people who uploaded their DNA in 2015 do anything wrong, or fail to read anything. The terms they agreed to were simply not the terms that governed their data five years later. And the final step shows the limit of consent as a mechanism: opting out was overridden by a court order obtained by a third party. ## What this means in practice A privacy policy is not a contract with the future. It is a description of current intentions by a current owner, revisable by that owner, transferable in a sale, and overridable by a court. The lesson is not that these companies behaved badly. Mostly they behaved lawfully and, in places, better than they had to. The lesson is structural: **consent attaches to a moment, and data persists past that moment.** Which leaves exactly one category of data with no future exposure: the data that was never collected. ## Where to read more - [The Smaller Kingdom](https://offline.ltd/smaller-kingdom): the whole argument, and what to do about it. - [Anonymous does not stay anonymous](https://offline.ltd/smaller-kingdom/anonymous-does-not-stay-anonymous): why de-identified data keeps being re-identified. - [Records outlive regimes](https://offline.ltd/smaller-kingdom/records-outlive-regimes): the Amsterdam population register, and what was done with it. - [The philosophy](https://offline.ltd/philosophy): why we build software that cannot collect anything. ## Frequently asked **What happened to 23andMe customer data in the bankruptcy?** It was treated as an asset of the estate. After a reopened auction, TTAM Research Institute, a nonprofit led by the company's co-founder, bought the business for $305 million, and the sale was approved on 27 June 2025. The court held that transferring the genetic data did not require fresh opt-in consent from customers. **Can a company sell my data if it goes bankrupt?** In general, customer data can be transferred with the business as part of the estate, subject to the privacy policy in force and applicable state or national law. In the 23andMe case the court found that customers had been on notice through the privacy policy that data could be shared with corporate affiliates, so no separate opt-in was required. **Can police search consumer DNA databases?** It depends on the site's terms and on what a court orders. GEDmatch permitted law enforcement matching from 2018, restricted it to opt-in in 2019, and then complied with a warrant in November 2019 covering the entire database including users who had opted out. **Does deleting my account remove my data?** Sometimes, and it is usually worth doing, but it depends on the provider, on what has already been shared or licensed onward, and on legal retention obligations. Deletion is a request made to a holder; it is not the same as the data never having existed. --- *From Offline.Ltd, Amsterdam. The web version of this page lives at https://offline.ltd/smaller-kingdom/consent-does-not-travel and is kept current there.*