Chrome Holding Co.

Wojcicki made several attempts to take the company private. An initial bid of $2.53 per share in February 2024 did not proceed. In July 2024, she offered 40 cents per share for all outstanding shares not already owned by her, but a special committee of the board rejected the proposal. In September 2024, all seven independent board members resigned. The company subsequently filed with the SEC indicating it was no longer open to third-party acquisition offers. Users attempting to delete their genetic data discovered that the company retained it for three years to comply with legal obligations. Further layoffs followed in November 2024.

In January 2025, 23andMe disclosed it needed additional liquidity and was exploring strategic alternatives including a potential sale. Wojcicki made a third offer of 41 cents per share in March 2025. On March 23, 2025, 23andMe filed for Chapter 11 bankruptcy protection as part of a plan to sell its assets, listing assets and liabilities each between $100 million and $500 million. Wojcicki stepped down as CEO and was replaced by CFO Joe Selsavage. Trading in the company's shares was suspended on March 31 and the stock was delisted from Nasdaq, subsequently trading over-the-counter.

California Attorney General Rob Bonta issued a consumer privacy alert reminding Californian users of their right to request deletion of their genetic data.

TTAM acquisition (2025)

The initial bankruptcy auction was won by Regeneron Pharmaceuticals for $256 million. As part of that agreement, Regeneron would have acquired all units of 23andMe except its telehealth service Lemonaid Health. However, the bankruptcy court reopened the auction after Wojcicki argued that her nonprofit, TTAM Research Institute, had been unfairly excluded from the bidding process. In the final round, TTAM submitted a winning bid of $305 million. 23andMe had separately announced it would cease being a public company and deregister from the SEC effective June 6, 2025.

TTAM completed the acquisition of substantially all of 23andMe's assets—including the Personal Genome Service, Research Services, and Lemonaid Health—on July 14, 2025. TTAM committed to honouring 23andMe's existing privacy policies, establishing a Consumer Privacy Advisory Board, and restricting future sale or transfer of genetic data unless any new owner adopted equivalent privacy protections.

Product history and pricing

Product tiers

In late 2009, 23andMe briefly split its service into three products—an Ancestry Edition, a Health Edition, and a Complete Edition—but recombined them a year later. A monthly subscription for research-based updates, introduced in late 2010, proved unpopular and was eliminated in mid-2012.

From November 22, 2013, to October 21, 2015, 23andMe sold only raw genetic data and ancestry-related results in the US due to FDA restrictions, after which it resumed providing health information in the form of carrier status and wellness reports.

Pricing

The US price declined from $999 at launch in 2007 to $399 in 2008 and to $99 in 2012, effectively serving as a loss leader to build the customer database. In October 2015, the price was raised to $199. In September 2016, an ancestry-only version was reintroduced at $99 with an optional $125 health upgrade. The product launched in Canada in October 2014 at CA$99 and in the United Kingdom in December 2014 at £125.

Ancestry and diversity initiatives

In February 2018, 23andMe enhanced its ancestry reporting to provide country-level rather than region-level estimates, adding 120 new regions. Acknowledging gaps in genomic data for Asia and Africa, the company launched the African Genetics Program in October 2016 (supported by a National Institutes of Health grant) to recruit sub-Saharan African participants. This was expanded into the Global Genetics Program in February 2018, targeting 61 underrepresented countries, and the Populations Collaboration Program in April 2018, establishing formal research partnerships.

23andMe+ and Lemonaid Health

In October 2020, 23andMe launched "23andMe+", a subscription service priced at $29 per year, offering additional health and pharmacogenetic reports to Health + Ancestry customers genotyped on version 5 of its microarray chip. In late 2021, the company completed its $400 million acquisition of Lemonaid Health, a telehealth company.

2023 data breach

In October 2023, a significant data breach was disclosed. Hackers accessed data on approximately 6.9 million users—roughly half of 23andMe's customers at the time—through a credential stuffing attack. Stolen data included names, addresses, and genetic information, and was subsequently offered for sale online. The affected accounts had enabled the platform's "DNA Relatives" feature, and the attack specifically targeted Ashkenazi Jewish and Chinese-descent users.

In June 2025, the UK's Information Commissioner's Office (ICO) fined 23andMe £2.31 million for failing to adequately protect user data, citing inadequate security measures—including the absence of multi-factor authentication—and a slow response to the breach.

In May 2026, the California Attorney General filed a lawsuit against 23andMe for failure to safeguard sensitive personal information under the California Consumer Privacy Act (CCPA) and other related privacy statutes.

Research

Overview

Over 80% of 23andMe customers have opted in to having their data used for research. The company's research programme has produced hundreds of peer-reviewed publications using its large genotyped and phenotyped participant database. Aggregated customer data is studied by researchers employed by 23andMe and through collaborations with academic, government, and pharmaceutical partners; de-identified customer data has also been licensed to pharmaceutical and biotechnology companies. In July 2012, 23andMe acquired CureTogether, a crowdsourced treatment ratings startup with data on over 600 medical conditions.

23andMe offers an optional consent allowing individual genetic information to be included in research published in scientific journals. However, even without this consent, de-identified genetic and self-reported data may be shared with the company's third-party service providers.

Parkinson's disease

In 2010, 23andMe reported using its database to validate NIH-published work identifying mutations in the glucocerebrosidase gene as a risk factor for Parkinson's disease. In 2015, the company began pursuing in-house drug discovery under former Genentech executive Richard Scheller, with Parkinson's disease as a primary focus.

Inflammatory bowel disease

23andMe established research agreements with Pfizer to investigate the genetic basis of inflammatory bowel disease, including ulcerative colitis and Crohn's disease.

Depression and psychiatric disorders

In 2016, 23andMe used self-reported customer data to identify 17 genetic loci associated with depression. In 2017, the company began collaborations with Lundbeck and the Milken Institute focusing on the genetics of bipolar disorder and major depression, with aims of advancing drug discovery.

COVID-19

In June 2020, 23andMe published preliminary results suggesting that people with type O blood may be at lower risk of COVID-19 infection. Among more than 750,000 participants, those with type O blood were 9–18% less likely to contract the virus, and those who had been exposed were 13–26% less likely to test positive. The study was published in April 2021 in Nature Genetics. Subsequent research examined genetic associations with COVID-19 symptoms such as loss of taste or smell, vaccine reactions across different ethnicities, and risk factors for long COVID. Findings on long COVID were presented at the 2023 ASHG conference.

Pharmacogenomics

In 2026, the 23andMe Research Institute published a genome-wide association study in Nature identifying genetic variants associated with variation in weight loss and side effects among users of GLP-1 receptor agonist medications.

Other research

In 2016, a project to offer customers next-generation sequencing was ended; Wojcicki cited concerns that results would be too complex for direct-to-consumer presentation.

FDA approvals (2015–2018)

In 2014, 23andMe submitted a 510(k) application to market a carrier test for Bloom syndrome, providing data on analytical consistency, usability, and clinical validity. The FDA cleared the test in February 2015, stating it would not require similar applications for other 23andMe carrier tests. Further clarification was sent on October 1, 2015, and on October 21, 2015, 23andMe resumed marketing carrier tests in the US. Wojcicki acknowledged that "there was part of us that didn't understand how the regulatory environment works" regarding the distributed roles of the FDA and CMS.

23andMe then submitted "de novo" applications for genetic health risk tests. In April 2017, the FDA approved ten such tests, covering conditions including late-onset Alzheimer's disease, Parkinson's disease, celiac disease, hereditary thrombophilia, alpha-1 antitrypsin deficiency, glucose-6-phosphate dehydrogenase deficiency, early-onset dystonia, factor XI deficiency, and Gaucher's disease. The FDA stated it intended to exempt further 23andMe risk tests from 510(k) requirements and clarified that these were risk assessments, not diagnostic tests.

In March 2018, the FDA approved a direct-to-consumer test for three specific BRCA mutations most common among people of Ashkenazi descent; these are not the most common BRCA mutations in the general population, and the test covers only three of approximately 1,000 known mutations. These mutations are associated with increased risk of breast and ovarian cancer in women, and breast and prostate cancer in men.

Legal protections

United States

Since 23andMe is not classified as a medical provider, it is not subject to the Health Insurance Portability and Accountability Act (HIPAA). Research has found that very few consumers read terms and conditions (9% according to Deloitte; 1% according to ProPrivacy), suggesting many customers may have consented to research participation without fully understanding the permissions granted. 23andMe's privacy policy has been described as confusing for consumers. Despite these concerns, 23andMe's informed consent practices have been approved by an institutional review board. Several sections of the privacy policy have permitted data disclosure to third parties regardless of individual consent status, including provisions for third-party advertising networks to collect web behaviour data, inclusion of customer data in aggregate datasets shared with research partners even without consent, and sharing of personal information with affiliated companies.

The Genetic Information Nondiscrimination Act (GINA) protects individuals against discrimination based on genetic information by employers and health insurers in most situations. However, GINA does not extend to life insurance, long-term care, or disability insurance providers.

European Union

Effective May 25, 2018, 23andMe became subject to the General Data Protection Regulation (GDPR), which governs the collection, use, and storage of personal data and applies to companies offering services to individuals in the European Union, regardless of where the company is based.