“People trusted you with their most personal information. Show them you respect them. They do not need your apologies anymore, and they don’t need your sympathy. What they need is legal protection.”

Video (YouTube)

WASHINGTON – Today, in a House Committee on Oversight and Government Reform hearing, Congresswoman Ayanna Pressley (MA-07) slammed 23andMe for exploiting people’s DNA and private information following a severe data breach and bankruptcy – allowing more than 15 million people’s personal and genetic data to be sold off. The Congresswoman demanded 23andMe require the explicit, informed consent of each of their customers before including their data in any bankruptcy sale.

A transcript of the Congresswoman’s remarks, as delivered, is available below, and the full video is available here.

Transcript: Pressley Slams 23andMe for Exploitation of Customers’ DNA, Demands Protection of Sensitive Private Data

House Committee on Oversight and Government Reform

June 10, 2025

REP. PRESSLEY: Ms. Wojcicki, you claimed that 23andMe is all about consumer empowerment. But most people ended up actually exploited, not knowing that they signed up to have their genetic data auctioned off to the highest bidder.

And we’re not talking about email addresses. We’re talking about names, birthdates, genetic lineages – literal DNA. Data that implicates entire families, not just the person who gave the sample.

Ms. Wojcicki, can genetic data – even if de-identified – be linked back to individuals?

MS. WOJCICKI: I appreciate that question – could genetic data be linked back to individuals? You would – you can link back. Your DNA is your DNA. If I have a way of matching it to something that potentially connects to you, then you can potentially identify.

REP. PRESSLEY: So, the answer is yes. The answer is yes. The genetic data – even if de-identified – can be linked back to individuals, just the science.

MS. WOJCICKI: Well, no. If I had your sample – essentially, if I know what your picture looks like and I see another picture, I can connect those. But just having your DNA alone – if I just went to the subway and I swabbed it and I looked at samples, I would not be able to identify who’s there.

REP. PRESSLEY: Let me reclaim my time, because I don’t have much of it and there’s a lot of ground to cover here – and I want a more direction question here, so I’m going to go to Ms. Hu.

Is de-identified genetic data truly anonymous, or can it be traced back to individuals, Ms. Hu?

MS. HU: Thank you so much, Congresswoman. I’m not a scientific expert on that exactly, but there has been research on the limits of de-identification and also the risks of re-identification.

REP. PRESSLEY: Alright, fair enough. Yes – it absolutely can. With just a few pieces of additional information – like zip codes, gender, or 23andMe’s find your relative feature – it becomes easy to re-identify people and expose their personal health information.

23andMe’s privacy agreement talks about anonymous data, but DNA can never truly be anonymous. That is the point.

Now, Ms. Wojcicki – you said a limited number of customers were compromised by the data beach. But the truth of the matter is that out of the 15 million people who trusted this company, half of them – 7 million – had their data exposed.

So that’s not inconsequential. It’s deeply consequential.

And now, that same data could be sold off to a for-profit pharmaceutical company, so you can understand why people are rushing to delete their accounts.

But the thing is when people have tried to log in and delete their data, they received error messages and then the website crashed. That is not okay. Your company is preventing people from deleting their information.

Mr. Selsavage, it’s time to put people first. Will you contact each of your customers seeking consent for 23andMe to continue holding their data? Yes or no? It should be a simple opt-in communication that you send out before any bankruptcy sale – I want to really underscore that.

MR. SELSAVAGE: Congresswoman, we first have sent a notice out to all of our customers via email, notifying them of the sale and that we – a second email is currently going out this week, notifying –

REP. PRESSLEY: Reclaiming my time. Please just answer the question yes or no, okay? Will you commit to contacting each of your customers seeking consent for 23andMe to continue holding their data? This should be a simple opt-in communication that you send out before any bankruptcy sale. Yes or no?

MR. SELSAVAGE: Congresswoman, it’s not that simple. We believe we’ve already –

REP. PRESSLEY: Why not? People are deserving of this, these assurances and this insurance – they’ve been violated in so many ways.

Ms. Wojcicki, will you amend your bid to commit to a similar consent requirement then?

MS. WOJCICKI: I don’t believe I can talk extensively about my bankruptcy – about the bid – but I can say in the past, for example, when we did the GSK partnership, we proactively communicated with all customers.

REP. PRESSLEY: I know that, I know that, I know that, I know that. It’s not good enough, it’s not good enough. It is just not good enough.

People trusted you with their most personal information. Show them you respect them.

They do not need your apologies anymore, and they don’t need your sympathy. What they need is legal protection.

So if you are not able to protect the 15 million people and their families who trusted you, this company should not exist. The breach of data. The breach of civil liberties. The confusion this has caused for millions.

It might just be time to give it up.

I yield back.

###