The Supremacy Clause: Is It Supreme?

On June 27^th, 2025, the U.S. Bankruptcy Court for the Eastern District of Missouri approved the sale of 23andMe Holding Co.’s assets under Section 363 of the Bankruptcy code, allowing the transfer of sensitive genetic data from roughly 13 million customers. This ruling came over the objection of five states: California, Kentucky, Tennessee, Texas, and Utah, that argued the sale violated their state genetic privacy laws. Although the Court permitted the sale, it did not do so on the basis that bankruptcy law preempts state privacy statutes. Rather, the Court found the sale complied with 23andMe’s privacy policies, which allowed for data transfer in the context of a sale.

Procedural Posture and Core Issue

The key facts and legal question are set out as follows:

1. 1. 23andMe, the Debtor, moved to sell its assets to TTAM Research Institute through a Section 363 sale under the Bankruptcy Code.
   2. Several states objected, arguing that the sale violated their genetic privacy laws, which require explicit consumer consent before transferring sensitive personal data.
   3. 23andMe responded by stating that the Bankruptcy Code preempts state privacy laws, thereby allowing the sale to proceed regardless of states consent requirements.
   4. The Court rejected the preemption argument, holding that the Bankruptcy Code does not override generally applicable state privacy protections. However, the Court approved the sale, finding that 23andMe’s privacy policy expressly permitted the transfer of data in connection with a sale, including a sale in bankruptcy.

Preemption and Privacy Law

The central legal question was whether Section 363 of the Bankruptcy Code preempts state laws governing the transfer of personally identifiable information (PII). The Court held that it does not.[i]

Under the Supremacy Clause of the U.S. Constitution (Article VI, Clause 2), federal law is “the supreme Law of the Land,” and it preempts state law.[ii]  However, there is no broad, bright-line rule that federal bankruptcy law always overrides state law; each case depends on the specific statutory language and factual circumstances.

Although bankruptcy law is fundamentally federal and has the power to supersede state law in many respects, including displacing state-imposed restrictions through provisions like §541(c), which preempts anti-transfer clauses, and §363(l), which limits the enforceability of laws triggered by insolvency. The Bankruptcy Code also incorporates state law principles in various areas, such as fraudulent conveyances.

Here, the Court rejected 23andMe’s preemption argument. The Court found no indication that Congress intended to override generally applicable state consumer protection laws because a transfer occurs in bankruptcy. The Court emphasized that the Bankruptcy Code lacks any sweeping authorization to disregard state privacy statutes.[iii]

The Court noted that the absence of the phrase “non-bankruptcy law” in §363(b)(1)(A) does not imply congressional intent to broadly preempt state law. Rather, §363(b)(1) establishes a procedural safeguard for the sale of PII in bankruptcy, requiring either alignment with the debtor’s stated privacy policy or judicial approval after the appointment of a Consumer Privacy Ombudsman.[iv]

How the Court Approved the Sale

Although the Court sided with the states on the preemption issue, it ultimately allowed the sale because 23andMe’s privacy policy, especially after a 2022 amendment, expressly permitted data transfer in the event of a sale, including bankruptcy. The Court held that because customers agreed to these terms prior to the Chapter 11 filing in 2025, the sale did not violate the privacy policy and therefore complied with §363(b)(1).[v]

TTAM, the buyer, also agreed to uphold the existing privacy policy post-sale and committed to implementing additional safeguards, including an independent privacy board and identity theft monitoring.

Alternative Structuring and Practicality in Bankruptcy

A notable element of the decision was the Court’s emphasis on practicality. The Court acknowledged that TTAM could alternatively obtain the business through a Chapter 11 plan of reorganization, which might avoid technical “transfers” altogether and therefore not trigger state consent statutes. The states agreed that such a plan would likely pass legal scrutiny. However, the Court acknowledge that reorganization would incur an estimated $20 million in additional costs to reorganize the deal in a different procedural form. The Courts reasoning emphasizes how practicality and economic efficiency often drive decisions in bankruptcy, especially when the result would be functionally identical.[vi]

The California Appeal

After the court approved the sale, California Attorney General Rob Bonta appealed, arguing that the transfer of genetic data without “separate and express consent” violated the Genetic Information Privacy Act (GIPA). He sought emergency stays in both the District Court and the Eighth Circuit, however both courts denied the requests.[vii]

California’s appeal remains pending. At issue is whether a user agreement can effectively override state law consent requirements, a question that may shape how consumer data is handled in future bankruptcies.[viii]

Key Takeaways

This decision offers critical guidance for bankruptcy practitioners navigating asset sales involving sensitive consumer data:

1. Bankruptcy does not override state privacy laws. Section 363 sales must account for state consent requirements.
2. User agreements are critical. Bankruptcy courts will look closely at whether privacy policies authorize data transfers.
3. Structure matters. Asset sales via reorganization plans may offer practical alternatives to direct transfers.
4. Appeals may influence future cases. California’s challenge could clarify the limits of private contracts in overriding state privacy statutes.

The 23andMe decision holds that while bankruptcy can facilitate asset sales, it does not override state privacy protections. This makes careful structuring and alignment with privacy policies essential in transactions involving sensitive consumer data.

If you have questions about this legal alert, please contact Partner Michael H. Traison (MTraison@cullenllp.com) or summer associate Kayla Zorn (KZorn@cullenllp.com).

Please note that this is a general overview of the law and no content within this excerpt constitutes legal advice. Nothing herein creates an attorney-client relationship between the authors and the reader. 

Footnotes

[i] In re 23andMe Holding Co., Case No. 25-40976-357 (Bankr. E.D. Mo. June 27, 2025).

[ii] U.S. Const. art. VI § 2.

[iii] Id.

[iv] Id.

[v] Id.

[vi] Id.

[vii] People of the State of California v. 23andMe Holding Co., No. 25-2361 (8th Cir.).

[viii] Id.