Case Study: The Genetic Wild West — When DNA Becomes a Corporate Asset

❓

Concept Check

When a bankruptcy judge rules that 15 million people's genetic data is a transferable corporate asset — and the same DNA technology that exonerates the innocent surveils entire communities through racial bias in databases — what analytical tools do you need to see what is happening?

▸

On March 28, 2025, a federal bankruptcy judge declared 23andMe's genetic database a transferable asset. This investigation uses seven analytical voices to reveal how architecture, manufactured trust, and institutional blindness govern your most intimate data. THE ASSET — The 23andMe bankruptcy, the equity toggle that bypasses consent, the BIOSECURE Act that creates zero individual rights. THREE PRECEDENTS — The Golden State Killer and the death of genetic opt-out. The Havasupai, Yanomami, and Nuu-chah-nulth: epistemicide in the laboratory. The Innocence Project paradox: DNA as liberator and DNA as surveillance infrastructure. Indigenous sovereignty responds. THE MANUFACTURE OF TRUST — Rampton and Stauber's third-party technique in DTC marketing. Bayesian trust erosion across the 23andMe timeline. Tabery's tyranny of the gene and Savage's campsite rule. THE ARCHITECTURE OF CONSENT — Lessig's four modalities applied to genetic data. Luhmann's diagnosis of why 28 attorneys general failed. Seven voices converge on a system that cannot self-correct. Connects to: Critical Thinking, Intro to Sociology, Systems Thinking, Financial Markets, Journalism, Philosophy of History.

There is a particular kind of violation that has no name in law. It is not theft, because nothing was taken from you — the data was copied, not removed. It is not fraud, because you consented — you clicked "I agree" on a Terms of Service that reserved the company's right to do exactly what it did. It is not a breach of contract, because the contract anticipated the company's bankruptcy and your data's transfer. It is not even a privacy violation in the legal sense, because the entity that now holds your data acquired it through a purchase of corporate equity, not a transfer of personal information. The violation is real. The harm is immeasurable. And the legal system has no code for processing it.

This is not a story about a bad company. It is a story about architecture — how a system was built, one design choice at a time, that made it possible for the most intimate data a human being possesses to become a line item in a bankruptcy estate. It is about why the institutions that should have prevented it — courts, regulators, legislators, the companies themselves — were structurally incapable of seeing it. And it is about three historical precedents that created the permissions, a PR apparatus that manufactured the trust, and a set of analytical frameworks that can finally make the architecture visible.

---

The Asset

March 23, 20252025. 23andMe, Inc. files for Chapter 11 bankruptcy. The company that once promised to "democratize DNA" — that told 15 million customers they were taking control of their genetic destiny — is insolvent. Five days later, Judge Brian Walsh rules that the company's database of over 15 million customers' genetic profiles constitutes a transferable corporate asset under Bankruptcy Code Section 363.

The response is immediate. Twenty-eight state attorneys general — more than half the states in the union — file formal objections to the transfer. Their argument: genetic data is categorically different from other corporate assets. It is immutable. It is biologically unique. It identifies not just the individual who submitted it but their parents, their children, their siblings, their cousins. The data cannot be changed if it is compromised, the way a credit card number or a password can be changed. A genetic data breach is permanent.

FTC Chairman Andrew Ferguson writes an extraordinary letter to the bankruptcy court warning that the transfer of genetic data to an unknown buyer poses "unprecedented privacy risks." The letter is notable for its source — a Republican-appointed FTC chairman invoking consumer protection authority — and for its content: a federal regulatory agency telling a federal court that the law as written is inadequate to the harm at stake.

The court appoints Neil Richards, a professor of law at Washington University in St. Louis and one of the country's leading privacy scholars, as a special privacy ombudsman. Richards's assessment is blunt: this is "one of the most sensitive collections of data ever sought to be discharged in bankruptcy." His role is advisory. His recommendations are non-binding. His analysis is devastating — and legally irrelevant.

None of it matters. The law is the law. The Bankruptcy Code does not distinguish between a database of financial records and a database of human genomes. An asset is an asset.

July 14, 20252025. Anne Wojcicki — who had stepped down as CEO to position herself as an "independent" buyer — reacquires the company through TTAM Research Institute, a nonprofit she founded, for $305 million.

The mechanism deserves careful attention, because it reveals how architecture overrides law. Privacy lawyers now call it the "equity toggle." Here is how it works:

23andMe held its genetic database inside a wholly-owned subsidiary — a separate legal entity controlled by the parent company. Several state privacy laws (including Illinois's Biometric Information Privacy Act and California's Consumer Privacy Act) require consumer consent before genetic data can be transferred to a third party. The key word is "transferred." If Wojcicki had purchased the database directly — bought the data files, moved them to her own servers — she would have triggered consent requirements in multiple jurisdictions. Millions of consumers would have had to affirmatively agree. Many would have refused. The sale would have been complicated, perhaps impossible.

Instead, Wojcicki purchased the equity of the subsidiary. She bought the company that holds the data, not the data itself. The genetic profiles never moved. They stayed on the same servers, in the same database, managed by the same subsidiary. What changed was who owned the subsidiary. From the data's perspective, nothing happened. From the law's perspective, no "transfer" occurred. From the consumers' perspective, their most intimate biological information now belongs to a different person, and they were never asked.

An ownership transfer, not a data transfer. Architecturally identical. Legally distinct. The equity toggle is not a loophole in the traditional sense — it is not an oversight in the drafting of privacy statutes. It is an architectural feature of corporate law that renders data privacy law structurally irrelevant in the one scenario where it matters most: when the company that promised to protect your data no longer exists.

The 2023 data breach had already exposed the stakes. In October 2023, credential-stuffing attacks compromised 6.9 million user profiles. The stolen data was sold on dark web forums in datasets specifically organized around Ashkenazi Jewish and Chinese heritage — deliberate ethnic targeting of genetic information. The breach settlement, reached in 2024, required improved security. It said nothing about what would happen to the data in bankruptcy.

December 18, 20252025. Congress responds — but not to the domestic privacy vacuum. The BIOSECURE Act, signed into law as Section 851 of the FY2026 National Defense Authorization Act, restricts federal procurement from designated Chinese biotech firms: BGI, WuXi AppTec, and others. It addresses a real concern — the systematic collection of genomic data by entities linked to the Chinese military. What it does not do is create a single enforceable individual genetic privacy right for any American citizen.

The structural mismatch is now visible. Legislation that protects against foreign access to genetic data while providing no domestic individual rights. A bankruptcy system that treats immutable biological data as a transferable asset. And a Terms of Service architecture that converts informed consent into a legal fiction — you consented to 23andMe, not to whoever buys 23andMe in bankruptcy, but the architecture makes no distinction.

Lawrence Lessig identified this pattern in 1999. He called it "code is law" — the observation that architecture regulates more powerfully than legislation, because architecture determines what is possible before law determines what is permissible. The 23andMe database was designed to be transferable. The subsidiary structure was designed to enable equity sales. The Terms of Service were designed to survive corporate death. By the time the bankruptcy court, the FTC, and twenty-eight attorneys general arrived, the architecture had already decided the outcome.

❝

"We can build, or architect, or code cyberspace to protect values that we believe are fundamental. Or we can build, or architect, or code cyberspace to allow those values to disappear. There is no middle ground. There is no option that does not include some kind of building. Code is never found. It is only ever made, and only ever made by us."

---

Three Precedents, Three Permissions

The 23andMe bankruptcy did not emerge from a vacuum. It was the product of a regulatory architecture built across three decades — an architecture that no one designed as a whole but that functions as if it were designed, because each component was built to solve a specific problem while ignoring the structural consequences of the solution.

Three landmark cases — spanning from 1990 to 2018 — created the permissions that made the 23andMe bankruptcy possible. The Golden State Killer case (2018) established that consumer DNA databases are accessible to law enforcement without legislative authorization. The Havasupai case (1990-2010) demonstrated that consent for one research purpose does not prevent exploitation for another. And the Innocence Project's four decades of work inadvertently established DNA as the God-voice of objective truth — cultural authority that enabled the uncritical expansion of DNA databases into a surveillance infrastructure disproportionately targeting communities of color.

Each case established a precedent. Each precedent removed a constraint. And the combination produced the regulatory vacuum into which 15 million genetic profiles fell. Understanding these precedents is essential, because they reveal that the 23andMe bankruptcy is not an aberration. It is the logical endpoint of permissions granted decades earlier.

The Golden State Killer — Death of Genetic Opt-Out

April 25, 20182018. Sacramento County investigators announce the arrest of Joseph James DeAngelo, the Golden State Killer, ending a 40-year manhunt. The breakthrough came not from CODIS — the FBI's own DNA database — but from GEDmatch, a free genealogy platform where hobbyists upload their genetic data to find relatives. Investigators uploaded crime-scene DNA to GEDmatch, found partial matches to distant relatives, built a family tree backward, and identified DeAngelo as the only male relative of the right age in the right location.

The celebration was immediate and nearly universal. A serial killer who had committed at least 13 murders and 50 rapes was finally caught. The technique worked. The public approved. But the technique's implications extended far beyond one case.

Familial DNA searching operates on a mathematical principle that destroys the notion of individual genetic privacy. You share approximately 12.5% of your DNA with a first cousin, 3.1% with a second cousin, and 0.78% with a third cousin. These overlaps are sufficient for identification. If a second cousin uploads their genetic data to any consumer genealogy platform, your biological anonymity is mathematically void. You did not consent. You were not informed. You may never have submitted a DNA sample to anyone. You may never have heard of GEDmatch. It does not matter. The architecture does not require your participation — only someone else's.

The consumer genealogy databases that enabled this technique were built from voluntary submissions that skew approximately 75% Northern European descent. This demographic composition is not incidental. It reflects who purchases recreational DNA tests: overwhelmingly white, middle-class Americans interested in tracing European ancestry. The Golden State Killer case was celebrated because it caught a white serial killer using a database that skewed white — the demographic alignment was invisible because it was unremarkable.

GEDmatch was acquired by Verogen, a forensic genomics company, in December 2019 — bringing the consumer database formally into law enforcement's orbit. The company changed its default privacy settings after the acquisition, opting all users into law enforcement searches unless they explicitly opted out. The architecture shifted from "hobbyist genealogy tool" to "forensic database" without a single law being passed, a single hearing being held, or a single user being asked.

The same familial searching technique, applied through CODIS rather than consumer genealogy databases, produces a radically different result: it disproportionately surveils communities of color through a database whose demographic composition is the inverse of the consumer platforms — not 75% Northern European, but an estimated 41-49% African American.

The Havasupai — Blueprint for Data Colonization

In 1990, researchers from Arizona State University collected DNA samples from approximately 400 members of the Havasupai Tribe, a community living at the bottom of the Grand Canyon. The stated purpose was diabetes research — a condition that afflicted the community at alarming rates. The Havasupai consented to diabetes research. They did not consent to what happened next.

The DNA samples were used for studies on schizophrenia, inbreeding, and — most devastatingly — human migration patterns. The migration studies used Havasupai genetic data to argue that their ancestors had crossed the Bering Strait land bridge from Asia, directly contradicting the Havasupai's own origin stories, which hold that their people emerged from the canyon itself. The researchers took biological material offered for healing and weaponized it against the community's self-understanding.

Boaventura de Sousa Santos would call this epistemicide — the systematic destruction of knowledge systems that do not conform to the dominant epistemological framework. The concept is precise: epistemicide is not the mere dismissal of another culture's beliefs. It is the active destruction of a knowledge system's capacity to function, using the tools and authority of the dominant system to delegitimize the subordinated one.

The Western genomic framework treats DNA as objective data that reveals biological truth. It operates through the scientific system's binary code: true/false. If the DNA says the Havasupai migrated from Asia, that is what happened — the genetic evidence is "true," and the oral tradition is "false," because the scientific code cannot process a claim that is "meaningful" or "sacred" or "constitutive of identity." These are not categories within the true/false binary.

Indigenous knowledge systems understand identity, belonging, and origin through oral traditions, spiritual practice, and relationship to land. The Havasupai's understanding that they emerged from the Grand Canyon is not a scientific hypothesis awaiting confirmation or refutation. It is a constitutive narrative — a story that defines who the Havasupai are, not a claim about where they came from. When the genomic framework overrides the indigenous framework — using the community's own biological material, collected under the promise of healing, as the instrument of destruction — the harm is not merely intellectual. It is existential. The community's self-understanding has been attacked from within its own body.

❝

"Epistemicide consists in the destruction of the knowledge and the cultures of these populations, of their memories and ancestral links, and of their modes of relating to others and to nature. Each form of domination has its own form of epistemicide."

The Havasupai sued. In April 2010, Arizona State University settled for $700,000 — less than $1,750 per tribal member whose DNA was misused — and returned the remaining DNA samples. But the settlement established no legal precedent. It was a negotiated agreement, not a court ruling. No judge declared that secondary use of DNA samples without informed consent was illegal. No statute was passed to prevent recurrence. No institutional review board was sanctioned. The researchers continued their careers. The pattern the case revealed — consent for one purpose, exploitation for another, settlement without structural remedy — has no fix in American law. The Common Rule, which governs federally funded research, was revised in 2017 (the "Common Rule Revision") and still does not require community consent for research involving indigenous populations.

The Havasupai case was not unique. The Yanomami of Brazil and Venezuela had 2,693 blood samples collected by researchers beginning in the 1960s. The samples traveled through laboratories across the United States and Europe for decades, used for hundreds of unauthorized studies. Repatriation began only in 2015, when samples were returned to the community for a funerary ceremony — the Yanomami believe that the blood of the dead must be destroyed for the spirit to rest. The Nuu-chah-nulth of British Columbia provided 883 blood vials for arthritis research. The samples were transferred to Oxford University and used for population genetics studies that had nothing to do with the original consent. Kim TallBear, a scholar of indigenous science and technology studies, puts it precisely: "Ideas about racial science from the 19th century are being revived in 21st-century laboratories."

The Innocence Project — The DNA Paradox

The Innocence Project has secured 375 exonerations through DNA evidence since 1992. Sixty percent of the exonerees are African American. Seventy percent of the wrongful convictions involved eyewitness misidentification — the most unreliable form of evidence treated as the most reliable. Kirk Bloodsworth, exonerated in 1993, became the first person freed from death row by DNA evidence. Each exoneration reinforced a cultural narrative: DNA is the God-voice of objective truth. DNA doesn't lie. DNA liberates.

The paradox is structural, not ironic. The Innocence Project's success in establishing DNA as the ultimate arbiter of truth — the "God-voice" of objective certainty in a legal system plagued by eyewitness error, false confessions, and forensic pseudoscience — created the cultural permission for the uncritical expansion of DNA databases. The logic is seductive and, within its own terms, internally valid: if DNA frees the innocent, then more DNA in the system means more justice. If DNA doesn't lie, then collecting it from everyone — at arrest, at the border, at birth — is simply good policy. The technology that revealed the legal system's failures became the justification for expanding the legal system's reach.

In 2013, the Supreme Court formalized this logic in one of its most consequential privacy decisions. Maryland v. King held, 5-4, that DNA collection at the time of arrest — not conviction, arrest — is constitutional. The majority opinion, written by Justice Kennedy, called it a "legitimate booking procedure" comparable to fingerprinting. The comparison is revealing: fingerprints identify you. DNA identifies you, your parents, your children, your siblings, your cousins, and your ethnic heritage. The two technologies differ not in degree but in kind.

Justice Scalia, dissenting from the bench — a rare and dramatic act reserved for cases the dissenter considers fundamentally wrongheaded — called it what it was: "Make no mistake about it: as an entirely predictable consequence of today's decision, your DNA can be taken and entered into a national DNA database if you are ever arrested, rightly or wrongly, and for whatever reason." Scalia recognized that the decision was not about one arrestee in Maryland. It was about the architecture of a surveillance system that would expand to fill whatever constitutional space the Court created. He was right.

CODIS now holds over 26.9 million profiles as of November 2025. An estimated 41-49% are from African Americans — a population that constitutes 13.6% of the country. Familial DNA searching extends this surveillance to relatives who have never been arrested, never been charged, never been convicted. The result: approximately 17% of the total African American population is under genetic surveillance, compared to approximately 4% of the Caucasian population.

The reinforcing feedback loop is precise and self-sustaining. Over-policing in communities of color produces more arrests. More arrests produce more DNA profiles in CODIS (because 34 states now mandate DNA collection at arrest, not conviction). More profiles produce more matches when new crime-scene DNA is searched against the database. More matches are cited as evidence of higher criminality in those communities. And the perceived higher criminality justifies more policing — completing the cycle. The loop does not create racial bias. It encodes the racial bias that already exists in policing patterns into a database that appears to be a neutral scientific instrument. Each iteration makes the bias harder to see, because it has been laundered through the objectivity of DNA matching.

The Department of Homeland Security has added another dimension. Between 2020 and 2025, DHS collected DNA from an estimated 2.6 million immigration detainees — including DNA from over 2,000 United States citizens detained at the border. These profiles enter CODIS alongside those collected at arrest, expanding the database's reach into immigrant communities without any specific legislative authorization for the expansion. The database grows. The architecture accepts the growth. No institutional code asks whether it should.

Indigenous Sovereignty Responds

Not every community waited for the Western legal system to protect them. In September 2025, the Assembly of First Nations passed Resolution #11, establishing genomic data sovereignty principles within the Canadian Precision Health Initiative. The resolution builds on two decades of indigenous data governance frameworks.

The OCAP Principles — Ownership, Control, Access, Possession — were established by the First Nations Information Governance Centre (FNIGC) beginning in 1998 and formalized in 2009. The principles are not aspirational. They are operational: First Nations own their collective data. First Nations control how data about their communities is collected, used, and disclosed. First Nations have access to all data about their communities, regardless of where the data is physically held. And First Nations physically possess the data on their own infrastructure — not on university servers, not in corporate databases, not in government archives.

The CARE Principles for Indigenous Data Governance, published by Carroll et al. in 2020, complement the FAIR data principles (Findable, Accessible, Interoperable, Reusable) — the international standard for scientific data management — with indigenous priorities that FAIR was not designed to address. CARE stands for Collective Benefit, Authority to Control, Responsibility, and Ethics. Where FAIR asks "Can the data be found and reused?", CARE asks "Who benefits? Who controls? Who is responsible? What are the ethical obligations?" The two frameworks are complementary, not competing — but the scientific community has spent decades implementing FAIR without implementing CARE, which tells you everything about whose interests the "neutral" framework was designed to serve.

The Native BioData Consortium, established in 2018 on Cheyenne River Sioux sovereign land in South Dakota, operates the first indigenous-governed genomic biorepository in the United States. The architecture is deliberate: genetic data stored under tribal sovereignty, governed by tribal law, on tribal land, accessible only with tribal consent. The data cannot be subpoenaed by federal courts without navigating tribal sovereign immunity. It cannot be sold in bankruptcy because it is not a corporate asset. It cannot be transferred via equity toggle because it is not held by a subsidiary. The consortium does not merely protect data. It embeds protection into the architecture — Lessig's framework applied by people who understand from three centuries of experience what happens when the architecture serves someone else's interests.

The Navajo Nation has maintained a moratorium on genetic research since 2002 — a sovereign exercise of the right to refuse that the Havasupai did not have the institutional power to exercise in 1990. The moratorium is not anti-science. It is a structural response to a structural problem: when the architecture of consent is broken, the only effective remedy is to refuse participation until the architecture is rebuilt.

The contrast with American federal law is not subtle. Canada's TCPS2 Chapter 9 — the Tri-Council Policy Statement on Research Involving First Nations, Inuit, and Métis Peoples — requires community engagement before research begins, dual consent (both individual participants and the community as a collective), restrictions on secondary use of biological samples, and provisions for community review of publications before they are released. The United States Common Rule, which governs federally funded human subjects research, contains no equivalent provision. No community consent. No dual consent. No secondary use restrictions for indigenous samples specifically. No community review of publications.

The regulatory gap is not a failure of imagination. It is a structural feature of a legal system that processes genetic data through individual consent (a concept from liberal political theory) rather than collective sovereignty (a concept from indigenous governance). The architecture embeds the values of the system that built it.

---

The Manufacture of Trust

The three precedents created the structural conditions. The Golden State Killer case destroyed the concept of genetic opt-out. The Havasupai case demonstrated that consent for one purpose does not prevent exploitation for another. The Innocence Project's success established DNA as the God-voice of objective truth, creating cultural permission for database expansion that disproportionately surveils communities of color. But structural conditions alone do not produce 15 million voluntary DNA submissions. For that, you need something else: a narrative architecture that transforms commercial extraction into personal empowerment, corporate databases into democratic tools, and irrevocable biological data transfers into acts of self-discovery.

"Empower Yourself" — The Third-Party Technique

Sheldon Rampton and John Stauber spent two decades documenting how the public relations industry manufactures consent. Their core finding: the most effective persuasion does not come from the entity that benefits from the persuasion. It comes from ostensibly independent third parties — scientists, patient advocates, community organizations, satisfied customers — who deliver the message with apparent objectivity. Rampton and Stauber called it the "third-party technique": camouflage the source, establish apparent independence, displace the emotional locus from the product to the person.

Direct-to-consumer genetic testing marketing is a textbook application. "Democratize your DNA." "Take control of your health." "Unlock your genetic potential." Every phrase positions the consumer as the agent of their own empowerment. The company is merely the vehicle. You are not being marketed to — you are being liberated. The emotional displacement is precise: the feeling of empowerment masks the structural reality that you are building a proprietary database whose value accrues to shareholders, not to you.

A 2018 study in BMC Medical Ethics identified three persuasive strategies in DTC genetic testing marketing: medical legitimacy signals (lab coats, clinical language, FDA references), empowerment narratives ("take charge," "know yourself"), and responsibility framing ("you owe it to your family"). Each strategy positions the purchase of a genetic test as an act of self-care rather than a commercial transaction that transfers irrevocable biological data to a private corporation.

The gap between perception and reality was measurable. A survey found that only approximately 50% of 23andMe consumers knew the company reserved the right to use their DNA data to develop pharmaceutical products and apply for patents. The 2018 deal with GlaxoSmithKline — $300 million for access to 23andMe's database for drug discovery — was disclosed in press releases. It was not the information consumers were thinking about when they spat into a tube to learn about their ancestry.

The 23andMe brand trajectory is a case study in Rampton and Stauber's framework compressed into eighteen years. In 2007, the brand promise was discovery: "unlock secrets." In 2013, the FDA slap revealed that the secrets had been oversold — but the brand pivoted to ancestry, which required no clinical validation and was even more emotionally resonant. In 2018, the GSK deal revealed that the database was the real product — but the deal was framed as "advancing drug discovery," which sounded like a public benefit. In 2023, the breach revealed that the company could not protect its core asset — but the settlement framed improved security as an adequate remedy. In 2025, the bankruptcy revealed that every prior promise was architecturally contingent on the company's solvency.

At each stage, the gap between what Rampton and Stauber call "institutional promise" and "institutional behavior" widened. At each stage, the institutional response narrowed the frame to exclude the structural question. And at each stage, the consumer's ability to act on the gap narrowed further — because genetic data, once submitted, cannot be unsubmitted.

❝

"The most effective public relations campaigns are those that are never recognized as such. The third party technique works precisely because the audience does not know that the 'independent' expert, the 'grassroots' organization, or the 'concerned citizen' has been recruited, funded, or scripted by the entity that benefits from the message. The camouflage is the message."

Bayesian Trust Erosion

Bayesian reasoning provides a mathematical framework for what most people process intuitively: each new piece of evidence should update your confidence in a belief. Applied to the 23andMe timeline, the evidence accumulates relentlessly:

2007: 23andMe launches with $3.9 million in funding from Google. "Unlock the secrets of your DNA." Time magazine names the home DNA test "Invention of the Year." Initial trust: moderate to high — novel technology, Silicon Valley pedigree, co-founded by the wife of a Google founder. A rational Bayesian sets a moderately positive prior: this is a reputable company offering a real product.

2013: The FDA orders 23andMe to cease marketing its health-related genetic reports, finding that the company had been making health claims without clinical validation. The company had told consumers it could assess their risk for 254 diseases and conditions. The FDA found this was, in many cases, not supported by evidence. Update: the company overclaimed on its core product. The prior should decrease — not catastrophically, but meaningfully. A company willing to overstate the reliability of its health reports may also overstate the reliability of its privacy promises.

2018: 23andMe signs a $300 million deal with GlaxoSmithKline, giving the pharmaceutical giant access to the genetic database for drug discovery. The deal reveals the company's actual business model: the $99 test kit is not the product. The database is the product. You are not the customer. You are the raw material. Update: the prior should decrease significantly. The company monetized the data in ways most consumers did not anticipate when they submitted their saliva.

2023: Credential-stuffing attacks compromise 6.9 million user profiles. The stolen data is sold on dark web forums in datasets organized by Ashkenazi Jewish and Chinese heritage. Update: the company could not protect the data it collected, and the breach was ethnically targeted — a unique danger of genetic data that does not apply to credit card numbers or email addresses. The prior should decrease sharply.

2024: Breach settlement requires improved security practices. It says nothing about what happens to the data in bankruptcy — a scenario that, at the time of the settlement, was already foreseeable to anyone watching the company's declining stock price and shrinking revenue. Update: legal remedies are cosmetic. They address symptoms, not architecture.

2025: Bankruptcy filing, equity toggle, asset transfer to TTAM for $305 million. Update: every prior reassurance about data safety was, at minimum, conditional on the company's solvency — a condition the company itself did not disclose as a risk in its Terms of Service or marketing materials. The prior should now approach zero.

The rational Bayesian posterior after this sequence should approach zero confidence in the claim "your genetic data is safe with us." But the recursive dimension is more important than the specific case. If every DTC genetic testing company uses the same business model (collect DNA, build database, monetize through pharma partnerships), the same Terms of Service architecture (consent that survives corporate death), and the same reassurance language ("your privacy is our priority"), then the likelihood of a similar outcome is not independent across companies. The base rate for "genetic testing company protects your data indefinitely" is not derived from 23andMe alone — it is derived from the structural features that all such companies share. Onora O'Neill, the philosopher of trust, identified the paradox: the more transparency we demand, the more evidence of untrustworthiness we receive — a Bayesian spiral that rational agents cannot escape by demanding more information.

The Campsite Rule and the Tyranny of the Gene

Dan Savage's campsite rule — formulated for relationships with inherent power asymmetry — offers an unexpectedly precise framework for evaluating the 23andMe collapse. The rule: the more powerful party bears a disproportionate obligation to leave the less powerful party in at least as good a state as they found them. The genetic testing company had vastly more knowledge about how the data would be used, vastly more legal resources to structure the Terms of Service, and vastly more sophistication about the regulatory landscape. The consumer had a tube, a credit card, and a vague desire to learn about their ancestry.

Savage's broader method is equally applicable, and deserves attention because it is a practical heuristic for navigating exactly the kind of institutional power asymmetry that the DTC genetic testing industry exploits. The method: never accept the first institutional answer — the first answer is almost always the answer the institution has prepared for people who ask the question. Consult actual experts rather than claimed authorities — a doctor who studies genomic privacy is not the same as a geneticist employed by 23andMe's marketing department, even though both carry the word "doctor." Print the letters that challenge your own position — seek out the harshest criticism of the thing you are about to do, and evaluate it honestly before proceeding.

Applied to DTC genetic testing, the method would have demanded that consumers ask not "What can I learn about my DNA?" but "What happens to my DNA after I learn about it?" And then: "What happens if this company goes bankrupt?" And then: "What happens if someone buys the database?" And then: "Can I get my data back?" The marketing architecture was specifically designed to prevent this chain of questioning — each reassurance narrowing the consumer's frame to the immediate gratification of ancestry percentages and health reports, never the structural reality of what they had just done.

James Tabery provides the structural complement. In Tyranny of the Gene (2023), Tabery argues that personalized medicine is "essentially a marketing idea dreamed up by pharmaceutical executives" — a rhetorical framework that diverts resources from public health interventions that would benefit entire populations toward individual genetic profiles that benefit proprietary databases. The promise of genetic empowerment is not incidentally commercial. It is structurally commercial: the empowerment narrative builds the database, the database becomes the asset, the asset generates shareholder value, and the consumer is left with a PDF of ancestry percentages and a Terms of Service that anticipated the company's death.

❝

"The very idea of 'personalized medicine' was essentially a marketing idea dreamed up by pharmaceutical executives looking for a way to rescue drug development from declining pipelines and rising costs. The promise was seductive: your unique genetic profile would guide treatments tailored specifically to you. The reality was different. The genetic data flowed one way — from consumers to corporations — and the value accrued in the same direction."

The convergence is precise. Rampton and Stauber explain the PR technique (the third-party method). Tabery explains the political economy (personalized medicine as marketing ideology). Savage's campsite rule names the moral obligation (the more powerful party's duty). Bayesian reasoning provides the method for seeing through manufactured trust (recursive updating on evidence). All four point to the same structural reality: the rhetoric of empowerment served commercial extraction, and the architecture was designed so that by the time the extraction became visible, the consent had already been rendered irreversible.

---

The Architecture of Consent

Lessig's Four Modalities Applied

Lessig identifies four modalities of regulation — four forces that constrain human behavior: law, norms, markets, and architecture (code). Each operates independently. Each can reinforce or undermine the others. And the central insight of Lessig's framework is that architecture — the design of technical systems — is the most powerful modality, because it determines what is possible before the other three modalities determine what is permissible, acceptable, or affordable.

Applied to genetic data governance after the 23andMe bankruptcy:

Law: Fragmented and incomplete. HIPAA does not cover DTC genetic testing companies — they are not "covered entities" under the statute, which was designed for healthcare providers and insurers, not Silicon Valley startups. GINA prohibits genetic discrimination in employment and health insurance but does not regulate data transfers, secondary use, or bankruptcy sales. The BIOSECURE Act addresses foreign threats but creates zero domestic individual rights. The Common Rule governs federally funded research but not commercial databases — and even within its scope, it does not require community or tribal consent. State genetic privacy laws vary wildly and are bypassed by the equity toggle. Bankruptcy Code Section 363 explicitly enables asset transfer, treating genetic databases identically to inventory, real estate, or intellectual property. The Regulatory Gap chart in Section 1 maps the full scope of the failure: no single column — not consent, not secondary use, not bankruptcy, not community consent, not deletion — is fully protected by any combination of existing law.

Norms: Consent as theater. The Terms of Service click-through is a ritual performance of agreement — a norm that communicates "you have been informed and you agree" while the architecture ensures that the consent is irrevocable, non-negotiable, and survives corporate death. No one reads the ToS. The companies know no one reads the ToS. The legal system treats the ToS as if it were a negotiated contract between equals. The norm of consent legitimizes the architecture of extraction — it provides the appearance of autonomy that Rampton and Stauber's framework identifies as essential to the third-party technique. You chose this. You consented. The architecture made the choice meaningless, but the norm says you made it.

Markets: The database is priced at $305 million. Fifteen million genetic profiles — $20.33 per person. The market sees human genomes and assigns a dollar value with the same mechanical precision it assigns to soybeans or server racks. The market modality does not ask whether genetic data should be a commodity. It asks what the commodity is worth. Moral hazard is embedded in the structure: the company that collects the data captures the upside (the GSK deal, the shareholder value, the $305 million sale price), and the consumers bear the downside (the breach, the bankruptcy transfer, the permanent loss of biological privacy). The asymmetry is not a bug. It is the business model.

Architecture: The equity toggle. The subsidiary structure. The database design that makes bulk transfer trivially easy and individual deletion practically meaningless. The inherent re-identifiability of genetic data — you cannot anonymize a genome, because a genome is, by definition, a unique identifier. The inability to withdraw consent after submission, because deletion from a primary database does not delete copies, backups, derivative analyses, or data already shared with partners like GSK. Architecture is the modality that actually governed the 23andMe bankruptcy — and by the time the other three modalities tried to intervene (law through the 28 AGs, norms through public outrage, markets through consumer backlash), the architecture had already determined the outcome. The database was designed to be transferable. The corporate structure was designed to enable equity sales. The Terms of Service were designed to survive corporate death. The architecture decided before the court convened.

Luhmann's Diagnosis — Why 28 Attorneys General Failed

The failure of twenty-eight state attorneys general to prevent the transfer of genetic data is not a story of insufficient effort or inadequate law. It is a story of functional differentiation — Luhmann's term for the structural feature of modern society that makes each institutional system operate on its own code, blind to what other systems can see.

The legal system processed the 23andMe bankruptcy through its own binary code: legal/illegal. Is the transfer of assets in bankruptcy permitted under Section 363? Yes. Is the equity toggle a "transfer" under state privacy statutes? The legal system found persuasive arguments that it was not. The legal code produced a legal answer: the transfer is permissible.

The scientific system processes genetic data through true/false. Is the data accurate? Is it useful for research? Can it advance drug discovery? These are the questions the scientific code can answer. Whether the data should be transferred is not a question the scientific system addresses — it has no code for "should."

The economic system processes the database through payment/non-payment. What is it worth? Who will pay? Can the obligation be serviced? $305 million. The economic code produces an economic answer: the asset is valued, the transaction clears.

The ethical question — "Should immutable biological data be treated as a transferable corporate asset when the humans whose bodies produced it cannot meaningfully consent to the transfer?" — has no home in any functional system. The legal system cannot process it (the law permits the transfer). The scientific system cannot process it (the data's accuracy is unaffected by ownership). The economic system cannot process it (the database has a market price). The ethical question falls between systems, visible to none of them, answered by none of them.

This is not a failure of effort. The 28 attorneys general tried. The FTC chairman tried. The privacy ombudsman tried. The failure is structural. Each actor operated within a system whose code could not process the question that mattered most. The attorneys general operated within legal code: "Is this transfer lawful?" The FTC operated within regulatory code: "Does this violate existing consumer protection statutes?" The privacy ombudsman operated within advisory code: "What should the court consider?" Each asked a valid question. None asked the question: "What does it mean for human dignity when a genome becomes a commodity?" — because no institutional code generates that question. It falls in the space between systems, the space Luhmann calls the environment of each system, the space no system observes because each system observes only through its own distinction.

This structural blindness is not unique to the 23andMe case. It is the same blindness that produced the 2008 financial crisis (the financial system could not see the housing market's risk because it processed everything through payment/non-payment), the same blindness that produces pharmaceutical pricing scandals (the economic system cannot see the health system's value of a life), and the same blindness that allows CODIS to encode racial disparity (the scientific system cannot see what the true/false code makes invisible). Luhmann's framework does not explain why specific people made specific decisions. It explains why the system as a whole cannot self-correct — why adding more lawyers, more regulators, more oversight cannot solve a problem that is structural rather than individual.

❝

"Each function system observes through its own distinction and thereby produces its own form of blindness. The legal system sees the legal and the illegal; it cannot see the beautiful, the profitable, or the true except insofar as these become legal questions. The system cannot observe what it cannot observe. It cannot observe that it cannot observe this."

Convergence — Seven Voices, One Wild West

The Question That Remains

❓

Concept Check

Apply Lessig's four modalities of regulation to the CODIS DNA database. Which modality — law, norms, markets, or architecture — most powerfully governs who is in the database and how the data is used? What would it take for a different modality to override the one currently in control?

▸

Architecture governs CODIS most powerfully. The database design determines who is included (people arrested in the 34 states that mandate collection at arrest, disproportionately communities of color). The familial search algorithm extends surveillance to relatives without their knowledge or consent. Law (Maryland v. King) ratified what architecture made possible. Norms (DNA as objective truth) legitimize the system. Markets are largely absent. For law to override architecture, legislation would need to restrict not just collection but the database design itself — prohibiting familial searching, requiring automatic expungement after acquittal, mandating demographic audits. This is what Lessig means when he says architecture is the most powerful modality: changing the law is necessary but insufficient if the code continues to operate on its own logic.

The seven frameworks converge on one structural insight: the gap between intent and consequence at every level of the genetic data ecosystem is not a failure of any single institution. It is a feature of functional differentiation itself. The legal system intended to protect property rights and enable orderly bankruptcy. The scientific system intended to advance knowledge. The economic system intended to price assets efficiently. The marketing system intended to sell products. Each system operated on its own code. Each produced the result its code was designed to produce. And the combined result — the commodification of immutable biological data, the surveillance of entire communities through their DNA, the systematic destruction of indigenous knowledge systems — is a consequence that no system intended, no system can see in full, and no system can correct alone.

The genetic Wild West is not a metaphor. It is a regulatory vacuum that was built, one equity toggle at a time, one precedent at a time, one manufactured consent at a time. The architecture of that vacuum is not accidental. It was designed by people who understood exactly how regulatory capture works, exactly how consent theater functions, and exactly how functional differentiation prevents institutional self-correction.

The question is not whether the system will correct itself. Luhmann's diagnosis is clear: it cannot. Each functional system will continue to process genetic data through its own code — legal/illegal, true/false, payment/non-payment — and each will continue to produce answers that are internally valid and collectively catastrophic. The question is what it would take to build an architecture that embeds the values the current architecture was designed to circumvent — and whether the indigenous data sovereignty frameworks that communities like the Navajo Nation, the Cheyenne River Sioux, and the Assembly of First Nations are building offer not just an alternative, but the template for what informed consent actually requires in a world where your DNA is someone else's asset.

---

Sources and Further Reading

Theoretical Frameworks: Lessig, Code and Other Laws of Cyberspace (1999/2006). Luhmann, Social Systems (1984/1995). Santos, Epistemologies of the South (2014). Rampton & Stauber, Trust Us, We're Experts! (2001). Tabery, Tyranny of the Gene (2023). O'Neil, Weapons of Math Destruction (2016). TallBear, Native American DNA (2013).

Legal Documents: In re 23andMe, Case No. 25-41308 (Bankr. E.D. Mo. 2025). Maryland v. King, 569 U.S. 435 (2013). BIOSECURE Act, Pub. L. No. 118-159, §851 (2025). Havasupai Tribe v. Arizona Board of Regents, Settlement (April 2010).

News Coverage & Analysis: FTC Chairman Ferguson, letter to bankruptcy court (March 2025). Richards, N., Privacy Ombudsman Report, In re 23andMe (2025). FBI CODIS statistics, CODIS-NDIS Statistics (November 2025). DHS DNA collection: GAO Report GAO-25-107123.

Indigenous Scholarship: Assembly of First Nations Resolution #11 (September 2025). Carroll et al., "The CARE Principles for Indigenous Data Governance," Data Science Journal 19(1):43 (2020). FNIGC, OCAP Principles (1998/2009). Native BioData Consortium, Cheyenne River Sioux Reservation (est. 2018).

Criminal Justice & DNA: Innocence Project, DNA Exonerations in the United States (ongoing). NCSL, "DNA Arrestee Laws" (2024). Scalia, J., dissenting, Maryland v. King, 569 U.S. 435, 481 (2013). Forensic genetics and racial disparity: Guerrini et al., Science 378:6624 (2022).

DTC Genetic Testing: Niemiec & Howard, "Ethical Issues in Consumer Genome Sequencing," BMC Medical Ethics 21:82 (2020). 23andMe-GSK partnership announcement (July 2018). 23andMe data breach disclosure (October 2023). TTAM Research Institute acquisition filing (July 2025).