ANALYSISApril 13, 2026
Should genetic information be protected as a constitutional right?
After 23andMe declared bankruptcy in March 2025, the genetic data of more than 15 million people was sold to TTAM Research Institute, a nonprofit created by the company's founder, exposing a critical gap in legal protections for genomic data. The event triggered congressional hearings, a wave of federal and state legislation, and lawsuits from 28 state attorneys general seeking to block the data transfer. The crisis has intensified a broader debate about whether genetic information should receive explicit constitutional protection.
Your DNA can reveal your ancestry, your diseases, your relatives — and right now the Constitution offers it almost no explicit protection. Should the government be able to access your genome without a warrant, or does the most intimate data in existence demand a new constitutional right?
Not familiar with this story? Get context →
Third-party doctrine covers voluntary DNA sharing
C
The third-party doctrine holds that voluntarily shared information loses Fourth Amendment protection — and on its face, handing your DNA to 23andMe looks exactly like that kind of consent. But the doctrine has never been stretched to cover people who shared nothing at all. When 23andMe sold its database, it sold partial biological profiles of every customer's relatives, people who never signed anything, never clicked through a consent screen, never made any disclosure whatsoever. You cannot waive rights on behalf of other people.
L
The relatives argument is compelling, but it actually cuts against resting this on existing Fourth Amendment doctrine rather than for it. If courts applying the third-party doctrine for decades haven't protected the people who did consent, it strains credibility to argue the doctrine will now spontaneously protect the people who didn't. The constitutional gap you're describing for relatives is real — it just points toward needing affirmative new protection, not toward trusting old doctrine to stretch far enough.
C
Pointing out that courts have been slow to update doctrine is an argument for better legislation, not for constitutional innovation. Congress can close this gap today through the bankruptcy code and targeted statute — we don't need to wait for a Supreme Court willing to revisit Smith v. Maryland to protect people whose data was sold last month.
L
Agreed that Congress can act faster — but 'faster' and 'permanent' are different things, and the same Congress that passes a genomic privacy statute can repeal it. The constitutional floor isn't an alternative to the statutory fix; it's what keeps the statutory fix from being undone the next time the political wind shifts.
Statutory gaps, not constitutional gaps, exposed
C
HIPAA was written in 1996, before consumer genomics existed as an industry. The 23andMe bankruptcy didn't reveal a constitutional failure — it revealed that a 29-year-old health data statute simply never contemplated direct-to-consumer genetic companies. That is a statutory vacuum, and statutory vacuums get closed by legislation, not by rewriting constitutional doctrine. The Don't Sell My DNA Act does exactly this: it requires affirmative consent before genetic data changes hands in bankruptcy, grounded in existing bankruptcy code rather than expansive new federal authority.
L
You're right that HIPAA is the proximate failure here, but calling this purely a 'statutory gap' understates the structural problem. The same logic that left HIPAA silent on consumer genomics will leave the next statute silent on the next technology. Constitutional protection means the government cannot — even with legislative majority — authorize warrantless aggregation of genomic profiles that identify not just you but your children and cousins who never consented to be tested. Statutes describe the floor; constitutions hold it in place.
C
The argument that constitutions 'hold the floor in place' assumes the judiciary will actually enforce that floor — and given how slowly courts have updated Fourth Amendment doctrine even under Carpenter, that assumption is doing a lot of work. A statute with real teeth and bipartisan support exists right now; a judicially enforceable constitutional right to genomic privacy does not.
L
That's exactly why the sequencing matters: the statute protects the 15 million people whose data was sold last month, and the constitutional architecture prevents the next Congress from repealing it — those aren't competing strategies, they're consecutive ones.
Informed consent fiction in click-through agreements
C
The terms-of-service agreement 23andMe customers signed was made under the assumption of a going concern. No reasonable person clicking 'I agree' on a genomics platform anticipates that their immutable biological data will later be auctioned in bankruptcy to an entity they've never heard of. That is not a new constitutional right — that is basic contract law. The original contractual understanding has been materially altered without the customer's knowledge, and enforcing that understanding is the free-market case for privacy.
L
If this is purely a contract problem, why did 28 state attorneys general from across the political spectrum have to sue in federal bankruptcy court to stop the transfer? Contract law didn't save these customers — it took a bipartisan coalition of government actors intervening to do what the market contract was supposed to do on its own. That's not evidence the contract framework is working; that's evidence it failed and required rescue.
C
The AGs suing is actually the system working — state law enforcement enforcing contractual and consumer protection obligations is exactly what limited government looks like. That's different from saying we need a new constitutional right; it's saying we need prosecutors to take the existing legal tools seriously.
L
Twenty-eight AGs had to intervene after the sale was already announced, in a race against a bankruptcy court timeline — that's not a system working, that's a near miss, and near misses don't become reliable protections.
Genomic data's permanence creates distinct harm category
C
The national security dimension of this debate gets treated as a side issue when it is actually central. Fifteen million genomic profiles — including, statistically, thousands of military and government personnel — is a strategic intelligence asset. Adversarial states have demonstrated both the will and the capability to exploit aggregated biological data for targeting, blackmail, and identification of covert operatives. Texas HB 130's focus on foreign adversary access isn't alarmist; it reflects a threat that intelligence professionals take seriously.
L
The national security framing is correct but incomplete, because it implies the harm is mainly about adversarial foreign access rather than about the structural vulnerability of treating immutable biological data as a transferable corporate asset at all. You can change your email, your phone number, your credit card — you cannot change your genome. A breach or sale doesn't just violate one person; it violates every biological relative, including people who made a deliberate choice never to submit their DNA to anyone. That's not a contract problem or a national security problem — it's a category of harm that no existing legal framework was designed to address.
C
You're describing the stakes accurately, but 'no existing legal framework was designed for this' is an argument for new legislation, which is exactly what I'm proposing — not for constitutional amendment or judicial invention, which would take years and face enormous doctrinal resistance.
L
New legislation that can be repealed by the next Congress isn't a solution to a harm that lasts forever — the permanence of genomic data is precisely the argument that the protection of it needs to be permanent too.
Constitutional versus statutory protection durability
C
The reflexive conservative move here would be to oppose federal legislation as government overreach and let the market sort it out. The market already sorted it out — it produced a bankruptcy sale of 15 million people's biological code to a nonprofit controlled by the executive who drove the company into insolvency. Limited government does not mean absent government. It means government acting within its proper sphere, and protecting citizens' most intimate biological information from being treated as a corporate asset is squarely within that sphere.
L
This is the most important concession in the conservative argument, and it deserves to be named: the market failed, and government intervention is the correct response. Where we actually disagree is on durability — you want targeted statute, I want constitutional floor plus targeted statute. But note that your own position requires you to trust that future Congresses will maintain protections that current market incentives have already proven unable to generate. That's a lot of faith in legislative continuity for data that will outlast every legislature now sitting.
C
The durability argument cuts both ways: a constitutional right that courts refuse to enforce, or define narrowly under the third-party doctrine, offers less real protection than a statute with enforcement mechanisms and bipartisan political support. Constitutional text without judicial will is not a floor — it's a ceiling nobody can reach.
L
Carpenter shows that judicial will can shift when the technology forces the question clearly enough — and a 15-million-person bankruptcy sale of immutable biological data is about as clear as questions get.
Conservative's hardest question
The strongest challenge to this argument is that if the Constitution's existing text — properly interpreted — already protects genetic information, one must explain why decades of courts applying the third-party doctrine have not produced that protection automatically. The gap between what the Fourth Amendment arguably should cover and what courts have actually held it covers is large enough that relying on existing constitutional tools, without new legislation or judicial clarification, leaves millions of people unprotected in the meantime.
Liberal's hardest question
The strongest challenge to constitutional protection is the third-party doctrine argument: if 15 million people voluntarily submitted their DNA to a private company, it is genuinely difficult to argue they retained a Fourth Amendment reasonable expectation of privacy in that data, and courts have historically applied this doctrine broadly. This is not easy to dismiss because constitutional protection of voluntarily shared data would require either overturning or significantly limiting a foundational strand of Fourth Amendment jurisprudence that the current Supreme Court has shown little appetite for revisiting.
Both sides agree: Both sides agree that HIPAA's 1996 vintage leaves consumer genomics companies entirely outside federal health data protection, and that this statutory vacuum — not any disputed constitutional question — is the proximate cause of the 23andMe crisis.
The real conflict: The genuine factual-legal conflict is whether the Fourth Amendment's existing text, properly interpreted through Carpenter's mosaic theory and Justice Sotomayor's Jones concurrence, already reaches consumer genomic data — or whether that gap is so large that characterizing it as 'existing protection awaiting proper application' is advocacy rather than doctrine.
What nobody has answered: If biological relatives who never submitted their DNA have their genomic privacy violated by a database sale they never consented to, what legal theory — statutory, constitutional, or tortious — actually gives them a remedy, and neither side has named one that currently exists?
Sources
- Search: 23andMe bankruptcy 2025 genetic data sale TTAM Research Institute
- Search: Genomic Data Protection Act 2025 Cassidy Peters Senate
- Search: Don't Sell My DNA Act 2025 federal bankruptcy code genetic data
- Search: Texas Genomic Act 2025 HB 130 foreign adversaries
- Search: Maryland v. King 2013 Supreme Court Fourth Amendment DNA
- Search: HIPAA GINA genetic data consumer companies legal gaps
- Search: state attorneys general 23andMe bankruptcy lawsuit genetic privacy
- Search: Fourth Amendment genetic information reasonable expectation of privacy case law
- Search: House Oversight hearing 23andMe bankruptcy genetic data national security 2025
- Search: Montana SB 163 genetic information privacy act 2025