FTC Says 23andMe Purchaser Must Uphold Existing Privacy Policy For Data Handling (therecord.media) 28
The FTC has warned that any buyer of 23andMe must honor the company's current privacy policy, which ensures consumers retain control over their genetic data and can delete it at will. FTC Chair Andrew Ferguson emphasized that such promises must be upheld, given the uniquely sensitive and immutable nature of genetic information. The Record reports: The letter, sent to the DOJ's United States Trustee Program, highlights several assurances 23andMe makes in its privacy policy, including that users are in control of their data and can determine how and for what purposes it is used. The company also gives users the ability to delete their data at will, the letter says, arguing that 23andMe has made "direct representations" to consumers about how it uses, shares and safeguards their personal information, including in the case of bankruptcy.
Pointing to statements that the company's leadership has made asserting that user data should be considered an asset, Ferguson highlighted that 23andMe's privacy statement tells users it does not share their data with insurers, employers, public databases or law enforcement without a court order, search warrant or subpoena. It also promises consumers that it only shares their personal data in cases where it is needed to provide services, Ferguson added. The genetic testing and ancestry company is explicit that its data protection guidelines apply to new entities it may be sold or transferred to, Ferguson said.
Pointing to statements that the company's leadership has made asserting that user data should be considered an asset, Ferguson highlighted that 23andMe's privacy statement tells users it does not share their data with insurers, employers, public databases or law enforcement without a court order, search warrant or subpoena. It also promises consumers that it only shares their personal data in cases where it is needed to provide services, Ferguson added. The genetic testing and ancestry company is explicit that its data protection guidelines apply to new entities it may be sold or transferred to, Ferguson said.
enforcement (Score:5, Insightful)
How much longer will there even be an FTC? Not holding my breath for enforcement in the current environment.
Re: (Score:1, Offtopic)
Not long, wasn't Elon Musk being investigated by the FTC? He's been going through the agencies that have been investigating him or his companies, so I'm surprised there is an FTC to speak of right now.
Re: (Score:2)
https://apnews.com/article/tru... [apnews.com]
Who will buy it? (Score:3, Interesting)
Who will buy all that sweet, sweet private info without the ability to sell it?
Re: Who will buy it? (Score:2)
Too bad, so sad. A contract is a contract, even if the other part cries poor.
Re: (Score:2)
Too bad, so sad. A contract is a contract, even if the other part cries poor.
That's simply not true. When this goes to the bankruptcy court, the court can (and will) remove contractual obligations from the estate.
Re: (Score:2)
Re: (Score:2)
23andMe already had the ability to sell it, and did so since the beginning.
Everybody's worried about what a new company can do with the data — and that is a concern — but frankly some of the things that people are worried about, 23andMe already can do or already does.
https://www.npr.org/2025/03/24... [npr.org]
Re: (Score:2)
Re: (Score:3)
The FTC is saying that the terms and conditions of those contracts must be upheld by anyone who buys 23andMe's half of the contract.
Nothing new is being invented. No new rules are being imposed. 23andMe will be sold WITH ALL THEIR EXISTING OBLIGATIONS INTACT.
Sorry - I can't keep a straight face. Obviously the pre-emptive Executive Order has been prepared, and when the auction is over and the chequ
Re: (Score:2)
Darth Cheeto doesn't have to do anything here. The normal operations of a bankruptcy court are already enough to make drastic changes to the obligations of the estate.
I, for one (Score:2)
Re: (Score:2)
One of me is more than enough for any world.
What privacy? (Score:2)
https://www.wired.com/story/23... [wired.com]
Re: (Score:2)
This seems like one of those areas in which true consent isn't possible, and so it should probably just be prohibited outright.
Re: (Score:2)
How many individuals already gave prior consent? And of course you don't think they really follow their own rules, do you?
Re: What privacy? (Score:2)
I'm sure that'll work (Score:4, Funny)
*Sells data for $100M*
"Oh sorry, you said to NOT do that?"
*Pays FTC fine of $1M*
=Smidge=
/If it's punishable by a fine, it's legal for a price
Re: (Score:3)
*Sells data for $100M*
"Oh sorry, you said to NOT do that?"
*Pays FTC fine of $1M*
=Smidge=
/If it's punishable by a fine, it's legal for a price
And remember, it's only a fine if you get caught.
Updated service agreement (Score:1)
How can they not respect the privacy policy (Score:2)
The policy that says they may change it at any point in time, for any reason, without prior notice, as long as they tell you after the fact, or post a notice on their website.
Bet (Score:2)
I am willing to bet that the new owner will break that rule. Just like the AI companies are hovering up data and crying ... but they need it. If you or I did it ==Jail time. Company does it and they just pay a small fine.