Aunt Vovi

So this is an example of the CPO system kind of pushing back against the initial proposal to sell this huge swath of customer data. Exactly. Now, some critics have argued that the consumer protection the CPO really offers is mostly performative. CPOs are generally brought in at the tail end of the bankruptcy process after a prospective buyer has already been chosen.

And even though she is the most cautious person I know when it comes to putting personal info online, she more or less breezed through 23andMe's terms and conditions.

They're often given as little as seven days to do their research and submit a report to the court. And their recommendations to the bankruptcy judge are just recommendations. They are non-binding.

So in a lot of cases, a bankrupt company's creditors, the people who are owed money, they don't necessarily want the CPO because it might mean a smaller payout for them. And the bankrupt company itself often doesn't want a CPO because it could slow down the sale process and make their portfolio of assets less valuable to potential buyers.

In the case of 23andMe, the company's lawyers argued that they should be allowed to skip the CPO and just hire their own private privacy monitor. But the Texas attorney general and the federal watchdog over the bankruptcy process have pushed back, saying no. Given this highly sensitive data, the case should get its own official ombudsman. So now it is up to the bankruptcy court to decide.

Yeah, I just probably said agreed without really reading the fine print.

Well, that's daily life.

Okay, so we've learned about how private consumer data has been sold in bankruptcy in the past. To understand how the bankruptcy court will settle on a buyer for 23andMe, we called up Melissa Jacoby. She's a professor of bankruptcy law at the University of North Carolina.

And just keep in mind, you're talking to me as if we're at a bar.

Who has time for like a 250-page memo?

23andMe has already proposed a set of conditions for who will be eligible to bid here, several of which follow the ToySmart settlement.

Okay, let's dive into those commitments. I'm getting out my printed copy of 23andMe's privacy agreement. Bring it with me everywhere now. So this is the document where 23andMe reserved its right to sell Vovi and everybody else's data. But this agreement also gives customers some protections that will be relevant to the sale and what happens after.

It promises that the company will not share their data with law enforcement unless legally mandated. And it gives the customers the right to delete their information at any time and to have their saliva samples destroyed. A new buyer would have to honor all of that to qualify.

And when Aunt Vovey's test results arrived, she says they were pretty exciting. They said we had some Mongolian DNA and a little bit from Yakutsk all the way up in Siberia.

We asked Melissa about some of the more dystopian potential buyers. For example, could a Chinese tech company with ties to the Chinese Communist Party put in a bid for 23andMe and get access to its genetic database? Kentucky Congressman James Comer recently raised this concern and opened a house oversight investigation into the 23andMe bankruptcy.

Who am I? Oh, come on.

OK, next up, could a law enforcement agency like the FBI or the NSA buy the data from these 15 million genomes? There isn't anything in the bankruptcy code expressly forbidding this kind of sale. But this option seems like it would potentially violate 23andMe's privacy agreement, which promises, unless required by law, not to share genetic information with law enforcement.

And a few other companies have expressed interest. A genetic testing company called Nucleus Genomics, for one, along with a crypto nonprofit that posted on X that it wanted to return Americans' intellectual property back to them, including their DNA.

To hear about some of the best and worst case scenarios, we called up one last expert, Harvard law professor and bioethicist Glenn Cohen.

Other happy scenarios? Maybe some 23andMe competitor buys up this data, combines it with their own genetic database, and is able to offer even more comprehensive genealogy services. Or there's a world in which these databases eventually help lead to groundbreaking scientific discoveries, or where they help develop new medicines and treatments.

In other words, a new buyer could change the privacy policy. They could allow more open access to law enforcement or share the data with insurance companies or even revoke the right of consumers to delete their data.

Former 23andMe customers would likely get the opportunity to either opt-in or opt-out, but we all know what it's like to get an email from some company about their new terms of service. Delete!

A mysterious British interloper in the genome? This was the kind of hot ancestral goss Vovey had been hoping for. But then, not too long after, Vovey got an update from 23andMe. That's because the database was growing. As the company got more customers and more genetic data points, they were apparently updating their genetic results from time to time.

The same goes for health insurance. GINA prohibits health insurance companies from setting their premiums or denying coverage based on your genetic information. So if a 23andMe buyer were to share your genetic data with your health insurer, they couldn't just kick you off their plan based on the fact you have certain genes.

So when Glenn talks to people like my Aunt Vovey about whether or not to delete their 23andMe data, he says they should keep in mind there is a very real tradeoff here.

As of now, multiple state attorneys general have issued public statements encouraging 23andMe customers to forego all of these risks by deleting their genetic data immediately. And huge numbers of customers seem to have taken them up on it. In the week following the bankruptcy announcement, 23andMe's website apparently crashed and many users found it difficult or impossible to delete their data.

Last week, I ran all the stuff we'd learned by my Aunt Vovey. The protections of the bankruptcy system, the promise of the Consumer Privacy Ombudsman, as well as where her data could end up. So knowing all of this, what do you want to do with your 23andMe data?

I'm your auntie. This is my Aunt Vovi. I called her up to talk about an experience she had a few years ago with the genetics testing company 23andMe. Vovey is a lifelong learner. She loves anthropology and the story of human migration. So back in 2017, when 23andMe was all the rage, she was interested.

Yeah, I just, I don't want the possibility that my data would get into the wrong hands. So let's delete it. I mean, make it all go away.

And with that, Vovi and I were off to 23andMe's website to tell them that it was time to let my genome go. We just go into your settings.

Settings.

And scroll all the way down to the bottom.

Okay. Memberships, preferences, get a reward.

No, don't be tricked.

No.

A reward?

It just popped at me. Okay, now I'm going to delete your data.

And the new update had come to a much less complicated conclusion about Vovey's origins.

After a couple hurdles, we found ourselves staring down a giant red delete button.

It's right here. Why are you requesting to delete your data?

What would you put in there?

I don't trust you anymore.

Sorry, 23andMe.

How are you feeling? Are you feeling nervous?

Yes, your virtual hand. Okay, count down.

In three, two, one.

Press. Okay, now I have a new screen. Your data is being deleted. Hey!

Hey! Now, it'll still take a little time for the company to actually destroy the physical saliva sample that Bobi sent in to start her genetic journey. In the meantime, she says she'll think twice before breezing through the next privacy agreement she encounters. Because these days, you never know what intimate personal data might end up on the bankruptcy auction block.

So it just said that I was 99.8% Afghan, basically.

For listeners out there who are new to Planet Money, first of all, welcome. Second, check out the rest of the feed for stories on Canadian tariffs, why many economists hate the idea of the president firing a federal reserve chair, or why everybody and their pet squirrel seem to have a meme coin these days.

Special thanks to Sarah Gerke and Elise Fraka. I'm Alexey Horowitz-Gazi.

This is NPR.

Vovie was a bit taken aback by this. After this string of intriguing genetic subplots, finding out her genome reflected the one place she'd known about all along felt a little bit like a letdown. And the British interloper had disappeared?

The British interloper, all the Mongolian markers, you know, all of those disappeared. And there was actually no indiscretions. Yeah. Yeah. I had been hoping for many indiscretions, maybe. I was hoping for a little more surprise.

And Vovey had been looking for the real housewives of the Silk Road in her genome. But at the end of her journey of genetic self-discovery, she basically learned, I am what I am. After that, Vovey stopped visiting the website. And for a few years, she basically forgot about 23andMe.

Until she found out that 23andMe had made her part of a different gene pool, a group of people whose genetic information is about to go on the market. When did you first hear that something might be financially awry at 23andMe?

I mean, just last week. I had no idea because, as I said, I haven't gone back to look at anything for a few years now.

Vovee found out, along with the rest of us, that 23andMe had filed for bankruptcy. And the data on Aunt Vovee's genome, along with the genomes of millions of other 23andMe customers, was potentially up for sale. And it's not like 23andMe is thinking of selling your shopping preferences for shoes or something. These are the blueprints our bodies use to build themselves.

And Fovey read that 23andMe's website was crashing because so many customers were rushing to delete their highly sensitive data. Yeah, it was like a run on the gene bank. All of which obviously raised some big questions for Aunt Fovey. Like, now that 23andMe was in bankruptcy, was it allowed to just sell her genetic information? Who would want to buy it?

Could that information affect things like insurance premiums? Could it end up in the hands of law enforcement or a foreign-owned company? And what about the data itself?

How is that going to be broken into valuable assets? Was that going to be sold to the highest bidder? And how much is my data even worth?

Hello and welcome to Planet Money.

Today on the show, what might happen to Vovey's genetic data as 23andMe works its way through the bankruptcy process, and what it all reveals about the data that all of us willingly hand over to companies every single day.

She thought that taking one of their tests might reveal how she fit into the evolutionary sweep of human history. So was part of the interest about using 23andMe about... Belonging.

So 23andMe was founded in part on the idea that if they could build a massive database of consumer data, they'd be able to figure out how to monetize it down the road. And the company was successful at building this data set. Over the past couple decades, some 15 million customers have sent their DNA to 23andMe.

All of which brings us to our next question. What's going to happen to my Aunt Phoebe's data now? See, bankruptcy is a very specific process with some very specific goals. And how that process plays out here could have a real impact on what ends up happening to Aunt Phoebe's genetic data.

Last month, 23andMe filed for Chapter 11 bankruptcy. Chapter 11, Laura says, is all about finding ways for a struggling company to stay in business. It allows the company to hit the pause button on all of its debts and lawsuits and come up with a new plan. either to restructure or to sell itself to someone else.

Maybe belonging to a much larger collective.

You get the caboose. You get the caboose. You get the caboose. Anyway, the bankruptcy system is aimed at maximizing the value of the bankrupt company. And in doing so, it's supposed to produce a sort of win-win-win.

Aunt Vovee knew our family had been in Afghanistan for the last few hundred years. But she also wondered if this test might reveal the migration route our ancestors had taken out of Africa. She wondered if it might uncover some long-forgotten tale of star-crossed travelers on the Silk Road.

And you can think of the bankruptcy process as this giant trade-off machine. It's about taking what could be a messy fight between the various parties the company owes money to and forcing everyone to come to an agreement, to compromise.

In the case of 23andMe, the potentially really valuable asset isn't railroad lines. It's genetic data from customers like Ant Vovi. Now, the United States doesn't really have strong federal laws protecting privacy. Europe and some states like California and Illinois do.

A few weeks ago, I hopped onto a video call with a very special friend of the show. Just introduce yourself. Who are you?

Is this the first time that bankruptcy law met consumer data privacy? No, not at all.

Toy smarter, not harder. Yeah. ToySmart was an online toy retailer that crashed when the dot-com bubble burst. As part of their bankruptcy filings, the company announced its intention to sell off the names and contact information of its customers. Those lists could be valuable to other companies trying to find their own new customers.

In light of those red flags, the Federal Trade Commission, which is one of the main consumer protection agencies, they sued to block the proposed sale of that data. They said that ToySmart was breaking their privacy policy and engaging in a deceptive business practice.

The FTC did want bankrupt companies to be able to maximize their value, but they also didn't want customers to suffer too much harm by letting ToySmart break their data privacy promise.

Condition number two was that ToySmart was only allowed to sell the data to a company in a related industry that agreed to uphold the terms of the original privacy policy. This is what the FTC called a qualified buyer.

The thinking was customers had given up their data in order to improve their toy buying experience, so they shouldn't have to worry about how it might be used by some other kind of company.

You were patient zero. Yeah. Vovey and I actually talked about this at the time. By handing over her genome, she was automatically giving this company part of my DNA. After all, we share 25% of the same genome. And for me, it just wasn't clear what the consequences of all this might be. But Vovey's gonna Vovey, and she spent about $100, spit into a test tube, and sent it off to the company.

So in the case of 23andMe, the question of whether or not the company is allowed to sell my Aunt Vovey's genome is much clearer. In the years after ToySmart, it became a pretty standard practice for companies to reserve the right to sell customer data in case of bankruptcy. And that language was right in the privacy policy that Vovey kind of ignored when she signed up.

Now, consumers are not generally invited to the bankruptcy negotiating table, so Aunt Vovey won't be getting a seat here. But Laura says often there is a dedicated person tasked by the bankruptcy court with advocating on behalf of consumers' privacy rights.

Same at Planet Money, or PM, as we sometimes call it.

The ToySmart case had established some rough guidelines for these situations. But in subsequent cases, it became clear that no one in the bankruptcy system really had the expertise or incentives to dedicate themselves to, you know, scrutinizing the privacy implications of selling any particular kind of customer data.

Since the position was created, CPOs have been brought into dozens of bankruptcies involving the sale of customer data, from the Circuit City bankruptcy to General Motors to Borders Books.

It was in fact about a third of the U.S. population whose personal data RadioShack was proposing to sell. An ombudsman named Elise Fraka was brought in to evaluate privacy concerns, and the plan she came up with did end up making a big difference.