Whoever buys 23andMe should be required to keep customer data private, according to the US Federal Trade Commission. 

The FTC weighed in on 23andMe’s sale today, a week after the DNA testing company filed for bankruptcy. Like others, the commission is concerned about the privacy ramifications of a buyer using 23andMe data for purposes outside of personal genetic testing and discovery.

The FTC sent a letter to the US Trustee’s office, which oversees bankruptcy cases for the Justice Department, including 23andMe’s filing. It notes that 23andMe has promised that its privacy policy for customers’ DNA will remain intact even in the event of a bankruptcy or sale.

Recommended by Our Editors

1.9M Rush to Delete 23andMe Data After Bankruptcy: Should You Do the Same?

“These types of promises to consumers must be kept,” the FTC told US Trustee officials, later adding: “Moreover, as promised by 23andMe, any purchaser should expressly agree to be bound by and adhere to the terms of 23andMe’s privacy policies and applicable law, including as to any changes it subsequently makes to those policies."

23andMe has said it will only sell to buyers committed to complying with the company’s privacy policy and all “applicable laws with respect to the treatment of customer data.” The FTC also noted it is “pleased to see” 23andMe prioritizing customer privacy.

Still, many users have been deleting their DNA data from the company's databases. Several US attorneys general have also urged customers to do so. Last week, traffic to 23andMe.com skyrocketed by over 500%, according to Similarweb.