What Regeneron’s purchase of 23andMe means for the millions of people’s DNA it now owns

A pharmaceutical company that specializes in making DNA-based research agreed to buy 23andMe out of bankruptcy, averting a worst-case scenario as the genetic data of millions of consumers was auctioned off.

Regeneron bought 23andMe for $256 million, the company announced Monday morning. Leading up to the deal, millions of consumers who mailed 23andMe vials of their saliva to learn about their ancestry worried about where their genetic data might end up, so much so that it led to a spike in web traffic to the company’s website to delete their data.

Moving the data to the hands of a pharmaceutical company rather than to a surveillance tech firm, private equity, or data brokers should ostensibly make its customers feel better. Regeneron said it would maintain 23andMe’s privacy policy, which in theory keeps consumers’ data as safe as it was before.

But that’s not saying much, according to Anya Prince, a law professor at the University of Iowa.

“From what we have heard and seen, Regeneron is more like 23andMe in terms of how they might steward the data,” Prince said. “So, in that way it’s the best-case scenario, but there’s not any guarantees in how they will do that going forward.”

For one, 23andMe’s privacy policy is subject to change at any time. Suzanne Bernstein, counsel at the nonprofit Electronic Privacy Information Center, said the bankruptcy highlights how few protections consumers have over their health data.

“When a consumer purchased their 23andMe kit, they could not have envisioned or meaningfully consented to their genetic sample being sold outside of that context,” Bernstein said. “The fact that this highly sensitive data is being sold for profit at all brings up some ethical questions.”

How may Regeneron use that data?

While Regeneron is at the forefront of genetic-based research for drugs and therapies, its most lucrative products were actually not discovered through genetics-driven drug discovery. Eylea, which prevents blindness in some patients, and its COVID-19 antibody cocktail are two of its highest-selling products, and they were not discovered through genetic research.

Still, genetic and health data is highly valuable. Advertising firms may use it to get a more pointed profile of a consumer, or government contractors could use it to track down or surveil civilians. (At $256 million, Regeneron scored each of the estimated 15 million users’ genetic data at $17 a pop, 404 Media noted.)

Bernstein said that consumers might assume their genetic information is protected under the Health Insurance Portability and Accountability Act, or HIPAA, but that doesn’t apply to direct-to-consumer companies like 23andMe. Notably, Regeneron plans to keep 23andMe operating despite its dwindling sales.

“I don’t think they’re trying to emulate 23andMe’s business model; it’s more so that it seems to be an avenue to continue collecting genetic information,” she said.