E-Lending Challenges and Libraries’ Mission to Ensure Information Access for All

By: Anusha Seyed Nasrulai

Library services have transformed from being primarily administered in the physical library space to providing library card holders with access to a broad range of digital materials, including ebooks, audiobooks, research, music, film, and more. When digital materials first entered the market, they posed great opportunities to increase the availability and accessibility of library collections. Libraries have adjusted their acquisitions and curation efforts to accommodate an increased demand for digital materials. At the same time, publishers and vendors have repackaged their products to drive profits in response to the demand by raising ebook costs to exorbitant rates. Libraries are “typically required to pay 3–4 times the consumer price for an ebook or audiobook license of a popular title.” Also, many publishers have replaced perpetual licenses with time limited licenses. Publishers further control the market by restricting “how many copies libraries can have, who they can lend to, and how long they (and their patrons) can keep the books.” This has led to library budgets being consumed by licensing costs.

The e-lending marketplace presents multiple challenges to libraries’ longstanding commitment to ensure access to information for all. Digital materials are many patrons’ primary method of accessing information. For example, digital formats are essential resources to patrons with “vision impairment, dyslexia, and other physical or learning needs.”

Libraries are at the whim of the power wielded by vendors controlling access to vital digital materials. About five companies control publishing and dominate the industry for licensing digital materials to libraries. Some companies have business enterprises beyond academic information, including the use and sale of personal and financial information. Thomas Reuters and RELX Group (parent companies of Westlaw and LexisNexis) not only dominate the legal research market, but they also own some of the largest news and academic databases and are data brokers that sell to private entities and law enforcement agencies. Sarah Lamdan, former CUNY law librarian and professor, now ALA director, described the digital information market landscape as a monopoly of information markets, which raises significant ethical and privacy concerns.

Libraries’ Respond to Market Shifts 

The rest of this article examines the implications for the market shift to digital materials for libraries and their patrons, focusing on ownership rights, open source projects, and patron privacy. In response to vendors’ overwhelming control of the digital information marketplace, libraries and researchers are developing solutions to ensure information access for all.

Ownership Rights

Libraries hold ownership rights and control lending access over physical books by the right to first sale. The “first sale” doctrine (17 U.S.C. § 109(a)) “gives the owners of copyrighted works the rights to sell, lend, or share their copies without having to obtain permission or pay fees.” However, this ownership doctrine does not control digital transmissions— including ebook acquisitions. Publishers create license agreements in partnership with vendors, who then license them to libraries. Margaret Chon, Law Professor at Seattle University, argues that high prices and restrictive lending practices undermine the special position libraries have historically held in the copyright system as institutions protecting and facilitating public access to copyrighted works.

Without copyright reform, libraries are often at the behest of vendors’ licensing models. In response, libraries have developed comprehensive strategies to negotiate with vendor providers and select vendors that align with their mission. Still, “the contract-law focused world of copyright for digital content is much more heavily weighted to the benefit of publishers and to the greatest extent possible.” Therefore, libraries have sought legal reforms as one of the solutions to address the modern digital information marketplace. 

ReadersFirst is an organization of almost 300 libraries dedicated to libraries maintaining open and free access to ebooks as collections are increasingly digitized. ReadersFirst advocates for ebook legislation to prevent content restrictions, prohibitively high prices for licenses, and using licenses to excise important copyright law, such as Fair Use. This past summer, Connecticut passed an ebook bill and other states have introduced similar legislation. This bill will be carefully watched after similar legislation in Maryland and New York have been undone by copyright challenges. 

Open Source Projects

During the COVID-19 pandemic, Internet Archive launched the National Emergency Library (NEL). NEL was a continuation of a previous online project where scans of physical library books were “checked out” to people as though they were physical books. In Hachette v. Internet Archive, publishers successfully challenged NEL’s temporary lifting of the one-person-limit on lending. Though this case did not involve a traditional library, it does call into question whether controlled digital lending practices by libraries are vulnerable. 

To protect library projects that expand access to digital materials, new industry standards are being proposed. Controlled digital lending (CDL) protections allow libraries to lend, preserve, and archive digital materials. Currently, a new NISO consensus framework is being developed to support CDL in libraries, with the goal of expanding “understanding of CDL as a natural extension of existing rights held and practices undertaken by libraries for content they legally hold.”

The ability to curate and share open source resources further libraries’ goal to ensure information access for all. An important example of library open source projects are research guides. Research guides are collections of high quality and relevant resources on a given topic from books. Resources included articles, books, media, databases, special collections, exhibits, and programs. Kara Phillips, director of the Seattle University Law Library, stated that research guides “respond to important issues so that patrons can find reliable, authoritative information… [to] support democracy, rule of law, and the legal system.” 

Patron Privacy

As vendors adapt to the competitive digital information marketplace, the change in business models has increased their appetite for patron data. As Roxanne Shirazi, a research librarian at CUNY, puts it, “[a]s lenders, library vendors do not end their relationships with libraries when they complete a sale. Instead, as streaming content providers, vendors become embedded in libraries. They are able to follow library patrons’ research activities, storing data about how people are using their services.”

There are only a handful of states that protect readers’ data outside of libraries. For example, the California’s Reader Privacy Act safeguards readers’ data when accessing physical books or ebooks. Therefore, ensuring patron privacy and holding vendors accountable to ALA privacy standards are central to libraries’ mission.

The Path Forward for Libraries

Librarians and other stakeholders are organizing to address the profound problems that have arisen from changes in the e-lending market. In providing guidance regarding digital access, the American Library Association states, “[i]n order to have a functional democracy, we must have informed citizens. Libraries are an essential part of the national information infrastructure, providing people with access and opportunities for participation in the digital environment, especially those who might otherwise be excluded.”

Has the law of products liability kept up with current military contractor practice?

Photo by Art Guzman on Pexels.com

By: Nicholas Skubisz-Gonzalez

From air transport to nuclear energy, military contractors in the United States have famously benefitted from the expansive government funding necessary to develop new technology and implement it at scale. However, when issues come up with these projects, who pays the human costs associated with failure by contractors?

The answer, since 1988, has largely been that liability should never rest with the contractors that created the equipment at issue, so long as they satisfy all three elements of the Government Contractor Defense set out in Boyle v. United Technologies Corp. This case involved the death of a Marine Corps pilot due to an escape hatch defect, which resulted in a products liability case brought by his family against the company that created said escape hatch. The District Court initially ruled in favor of Boyle under state tort law, which was reversed on appeal to the Fourth Circuit, leading to the Supreme Court ruling that the manufacturer was immune from liability for this incident since it had simply built the helicopter (including the escape hatch) according to government specifications. The test created in Boyle requires that a contractor need only show that (1) the United States agreed to reasonably precise specifications, (2) the equipment satisfied those specifications, and (3) the supplier warned the United States about any dangers in using the equipment that they knew of and which the United States did not. This defense gives manufacturers the benefit of resolving cases before they are forced to go through costly litigation or risk discovery.

Under the defense set out in Boyle, which has largely been expanded in its applicability in the decades since, and only rarely limited, an increasingly large portion of government contractors have gained immunity from products liability claims by third parties. This most importantly includes blocking suits by the military servicemembers they are meant to benefit.

How does the Government Contractor Defense apply in modern defense contracts?

One of the major military contracts that poses a risk of possibly requiring this defense is the Army’s Integrated Visual Augmentation System (IVAS), a helmet incorporating various elements of virtual and mixed reality to enhance soldier perception on the battlefield. This project was initially awarded to Microsoft in 2018 with the intent of creating prototypes for testing before full production began. That said, issues have arisen over the years due to a failure to ensure user acceptance among military personnel, i.e. how many soldiers actually approve of their future equipment. This issue puts the $21.88 billion contract at risk, according to a 2022 Department of Defense audit by the Inspector General. The report states that the product description lacks any measurement for user acceptance, despite the fact that the Army’s sole measurement for system acceptability is user acceptance.

If relying on the elements in Boyle, this project could pose a significant risk to manufacturers. With this technology, the manufacturer has been provided with limited specifications and an inability to satisfy them due to a lack of adequate user satisfaction metrics. User satisfaction metrics are testing requirements for system effectiveness when used by the intended users, in this case soldier satisfaction with IVAS systems. Barring portions of the contract which may not be publicly available, the defense might not be applicable here, which could explain the recent history of the contract. Despite its value, the Army handed over control of the IVAS contract to Anduril Industries via a contract novation signed off on April 10, 2025. A contract novation is the legal process of replacing one party in a contract with another, shifting both the rights and responsibilities specified in the contract onto the new party with the consent of all involved.

A unique point to make on this contract changeover is how the scope of responsibilities have changed for each contractor given the modern landscape. The US military has in recent years reported a troublesome “substantial consolidation” of military contractors, resulting in their goal of diversifying reliable sources of supply to involve more businesses. When this contract was initially awarded to Microsoft, the goal was to create effective helmets with Mixed Reality capabilities that expanded the soldier’s awareness on the battlefield. While the hardware hasn’t resulted in any serious public concerns for the Army, this initial project did result in several software problems that warranted recompeting the contract, which Microsoft ultimately lost to Anduril. This has changed since the contract novation, since Microsoft now only provides the hardware they already developed, and Anduril is only responsible for working on the software and integration component of the contract, getting their EagleEye software to operate on the Microsoft hardware. Anduril has conducted several tests to ensure compatibility with the existing Microsoft created IVAS 1.2 design, but if this software-hardware connection should fail in any way in the field, a valid question remains on who would be responsible.

Who’s holding the liability hot potato?

Microsoft created the nausea-inducing headset under the original contract, Anduril focused on enhancing the software for user comfort and capabilities and was handed responsibility for the full contract, and in both instances the technology seems to be on the cutting edge of Mixed Reality capabilities. Was it even possible to articulate any reasonably precise specifications for either company?

Common practice might suggest that any tort cases involving this equipment might base liability off of the party responsible for the portion of the hardware or software at issue, yet the Government Contractor Defense presents potentially significant limits for litigants. One of the main limits at issue is the ability to limit the scope of discovery due to confidentiality concerns and the need for testimony by government personnel. This creates a trend of cases where plaintiffs lack meaningful information on the equipment that caused their injuries, preventing them from identifying the root cause, or the real defendant responsible. While the types of cases covered by the defense created in Boyle have grown over the decades since, the current doctrine creates a legal limbo for contracts on developing technologies that have, by their nature, extremely imprecise specifications and multiple contractors taking on full responsibility for different phases of development for the same equipment.Should the defense be expanded to accommodate current practices, as it historically has been post-Boyle? Should it be restricted to assume that liability exists unless the military specifically approved the conduct at issue, as Justice Kagan suggested in a case currently before the Supreme Court? The ideal solution going forward largely depends on an individual’s own balancing on the importance of innovation versus accountability.

#WJLTA #Military-Contractor #Products-Liability

One Big Beautiful Bottleneck: Immigration Processes and Lagging Technology

By: Claire Kenneally

Billions for Borders 

On July 1st, 2025, the U.S. Senate passed a budget reconciliation bill (“H.R.1” or “One Big Beautiful Bill”), allegedly aimed at fixing a broken immigration system. Over $170 billion was allocated for immigration and border-enforcement projects, with $46.5 billion for border wall construction, $45 billion for private prison corporations to expand detention centers, and $29.9 billion for hiring additional ICE agents and funding deportations. 

Critics of the bill denounce its punitive emphasis on incarceration and deportation instead of pathways to legal citizenship. American Immigration Council policy director Nayna Gupta observed that “[the bill] does nothing to address the real problems in our immigration system including court backlogs, a lack of legal pathways to citizenship, and a broken U.S. asylum system.”

The Paper Wall We Aren’t Talking About

Despite more money than ever pouring into the immigration system, pathways to legal citizenship, asylum, and work permits have only gotten more convoluted and backlogged in the last 20 years. 

U.S. Citizenship and Immigration Services (USCIS) is the federal agency that processes visa and green card applications. USCIS is distinct from Immigration and Customs Enforcement (ICE) and Customs and Border Patrol (CPB). Money allocated to ICE and border enforcement does not trickle down to,  nor support USCIS. USCIS is primarily funded through user fees paid by those applying for immigration and naturalization benefits. 

Figure 1: The Complex Green Card Application System

In 2023, USCIS processed over 10 million applications. However, they are still taking longer than ever to review applications, and are currently grappling with an unprecedented 11.3 million pending applications. As backlogs grow, applicants are left waiting for months, years, and sometimes decades longer than they should. 

Part of this gridlock is the outdated use of paper applications and limited e-filing options. “Notorious for its reliance on antiquated paper files,” USCIS requires immigrants (and their lawyers) to embark upon a lengthy process of preparing and mailing printed application materials to one of only five national processing centers.

This summer, I had the privilege of working as a legal intern at the Northwest Immigrant Rights Project. There, I observed staff attorneys spend hours compiling application materials for clients—writing extensive cover letters listing every document in the application, triple-checking that even blank or non-applicable boxes were marked, photocopying birth certificates multiple times to ensure clarity, and assembling a FedEx or USPS package for delivery. Then they’d carefully attach the package’s tracking number to the client’s file, so that in the (not unlikely) chance USCIS claimed they never received it or it was delayed, they could verify the application had been delivered. Then they waited, sometimes for weeks, to receive a confirmation letter from USCIS. Weeks and months after that, they might receive another letter asking for a clarification, different information, or a copy of a different form. 

Technical issues also persist beyond the application stage, slowing progress and creating confusion throughout the process. Checking a case’s status on USCIS’s website is also often futile due to system outages, server issues, or glitches. In early 2025, a USCIS website glitch falsely showed that hundreds of cases had been advanced to final review, leading to widespread confusion and disappointment when the error was rectified. 

How can this be? How can we have systems in place for online tax filing, online banking, and countless other e-filing systems, yet USCIS can’t manage to move beyond manually reviewing millions of paper forms? And how can billions of taxpayer dollars be allocated to immigration reform, yet so focused on inhumane incarceration practices instead of obvious improvements that create legal pathways to citizenship? 

A History of Inefficiency

Interestingly, the inefficiency of USCIS technology has long been a thorn in the side of effective immigration processes. In a 2005 report by the Department of Homeland Security’s Office of the Inspector General, auditors noted that “USCIS’ IT environment for processing immigration benefits continues to be inefficient, hindering its ability to carry out its mission. USCIS’ processes are primarily manual, paper-based, and duplicative, resulting in an ineffective use of human and financial resources to ship, store, and track immigration files.” 

Similar sentiments repeated in 2014 and 2016, with auditors writing that “USCIS struggled to modernize its stove- piped, paper-based immigration benefits processing to a more centralized and automated environment”. In 2020, yet another audit found that despite “strategic planning activities to help prioritize legacy IT systems or infrastructure for modernization… [the Department of Homeland Security and USCIS] continues to rely on deficient and outdated IT systems to perform mission-critical operations.” 

The Human Cost 

There are multiple implications when a system designed to support some of our most vulnerable community members struggles to be efficient. It is costly. It creates backlogs, currently in the millions. It is frustrating for USCIS staff and immigration attorneys who must carefully wade through inch-thick application materials. But most importantly, it is cruel to the millions of immigrants a year attempting to enter the United States. Some will wait decades just to be denied. Others will wait for months with no updates, only to receive a cryptic notice warning that their case may be denied unless they locate and resend documents they thought were already submitted. 

Low-income applicants in particular face heightened barriers due to paper-only fee-waiver applications, while H.R.1 has simultaneously hiked filing fees by hundreds of percent. With billions of dollars allocated for immigration reform through H.R.1 and millions of dollars in profits lining the pockets of privatized prison corporations as a result, this process is a slap in the face to those attempting to immigrate through legally recognized channels

Now what? 

Ironically, the very inefficiency of immigration technology has proven to be an effective tool for limiting access to the United States. As of October 2025, just seventeen of the 103 forms on USCIS’s website were available to be completed online. Discussing USCIS’s all-time high backlog of applications, immigration attorney Greg Siskind told Newsweek: “USCIS is still moving along with e-filing…and [their] long-term goal is to totally move away from paper filings…[even] more worrisome is the expectation by many in the immigration bar that USCIS will increasingly use AI—often poorly designed AI—that will speed up decision-making but in a way that lacks transparency and with serious quality control concerns.”

USCIS’ paper-heavy infrastructure continues to frustrate applicants and attorneys alike, with digital access limited to a fraction of its forms. Whispers of utilizing AI introduces a worrisome paradox: how can we trust advanced technology to improve outcomes when the fundamentals of digital access and e-filing are still missing? 

I believe immigration reform is possible—but only if we stop funneling billions of dollars into cages, and start prioritizing accessibility.

#WJLTA #ImmigrationTechCrisis 

The Freedom to Inquire: Data Privacy Lessons from Libraries

By: Anusha Seyed Nasrulai

“All people, regardless of origin, age, background, or views, possess a right to privacy and confidentiality in their library use. Libraries should advocate for, educate about, and protect people’s privacy, safeguarding all library use data, including personally identifiable information.”

These are the words enshrined in the last article of the American Library Association’s (ALA) Library Bill of Rights. The ALA first adopted principles protecting the freedom of inquiry in 1939 in response to concerns of government censorship and surveillance amid a moral panic against anarchists. In subsequent decades, the Library Bill of Rights was amended and interpreted to champion intellectual freedom during eras like McCarthyism, the Civil Rights Movement, and post-9/11. 

The Legal Right to Data Privacy 

Recognition of the freedom of inquiry in libraries also developed at the same time as a legal right to privacy was being conceptualized. In 1890, lawyers Samuel Warren and future Supreme Court Justice Louis Brandeis first defined a legal right to privacy in a famous law review article. Still, a legal right to privacy was not widely recognized till 1965 in Griswold v. Connecticut. There is currently no comprehensive federal data privacy law, resulting in a patchwork of sectoral and state data privacy laws. However, the libraries’ privacy principles obligate libraries to expand the privacy rights afforded to patrons beyond what the law requires. Examining libraries’ data privacy principles offers important lessons for envisioning new legal data privacy frameworks.

Libraries’ responsibility to protect patron privacy and confidentiality is, in fact, recognized by the law. Forty-eight states protect the confidentiality of patron records, and the attorney generals in the other two states have recognized the privacy of patrons’ library records. 

Libraries’ Approach to Data Privacy 

Precise definitions are required to understand these principles. For libraries, the right to “privacy is the right to open inquiry without having the subject of one’s interest examined or scrutinized by others.” Confidentiality is the libraries’ duty to keep personally identifiable information private on patrons’ behalf. Personally Identifiable Information (PII) is information that can be used to identify a specific person.

Data Privacy Policies 

Only 19 states have passed comprehensive privacy laws. Rights recognized under state laws may include the right to request data for correction or deletion, the right to opt out of certain processing and sales, the prohibition on discrimination for exercising rights under the law, notice and transparency requirements, and data purpose and processing limitations. The state laws typically only apply to for-profit businesses that meet high thresholds for gross revenue and amount of business activity in the state. Whereas library policies protect patron data from private and government requests. State laws are also limited by their enforcement mechanisms. Many state privacy laws rely on the enforcement of attorney generals rather than create a private right of action.

In addition to complying with privacy laws, library privacy policies are developed with guidance from the ALA’s Privacy Interpretation of the Library Bill of Rights and NISO Consensus Principles on Users’ Digital Privacy in Library, Publisher, and Software-Provider Systems. Libraries have a duty to create and maintain clear, easily accessible, and understandable privacy policies for all patrons. Privacy policies include information on what data is collected, who the data is shared with, and how long the data is retained for. PII should only be collected and stored when required for specific, clearly disclosed purposes and only with the patron’s consent. Users should have the right to access their own personal information or activity data for review, export, and request correction or deletion. Libraries should process these requests wherever operationally feasible.

Libraries practice data minimization, meaning libraries only collect personal data necessary for an operational purpose. Libraries default to practices such as purpose limitation and opting users out of nonessential data collections. Patrons should have an opportunity to give explicit consent so they can make an informed decision whether to agree with the collection of their data for nonessential purposes. Patrons should also be able to opt out at any time. For instance, some libraries offer patrons to opt in to a saved history of their checked-out books, otherwise, this data is deleted by default.

Libraries’ privacy policies often reflect a deep commitment to patron trust. As Mustafa Hassoun, a privacy attorney at Hillis Clark Martin & Peterson, noted, “Libraries always strive to do right by their patrons.” He works with libraries across Washington state and emphasized that “this commitment to patron trust and data stewardship continues even in the absence of broader legislation like the People’s Privacy Act, which would significantly expand data protection requirements in Washington.”

Vendor Partners 

Libraries aim to hold vendor partners, such as publishers and software providers, accountable to their data privacy principles where possible. Vendors are obligated to make their data use policies accessible to patrons. Libraries also carefully consider patrons’ privacy before entering data sharing agreements with vendors. The ALA’s Privacy Interpretation guides libraries to never share patron’s PII with vendors unless they have explicit patron permission or are required to under law or existing contract. When such information is shared, “any data collected for analysis should be anonymous or aggregated, it should never be linked to personal information.” Finally, when procuring new technologies, “[b]iometric technologies, like facial recognition, do not align with the library’s mission of facilitating access without unjust surveillance.”

The library community has developed processes and resources to negotiate contracts that align with their privacy principles. This is significant given that readers often lack clarity into how vendors use their data. Also, vendor partners may have great incentives to collect and aggregate as much user data as possible.

Complying with Law Enforcement 

The ALA guides library workers to consult with their library administration and legal counsel before complying with law enforcement. Records are to be shared only in response to a properly executed court order or legal process. “If a library worker is compelled to release information by a valid subpoena or court order,” they are instructed to personally retrieve the requested information rather than “allowing the law enforcement agency to perform its own retrieval [which] may compromise confidential information that is not subject to the current request.” 

Libraries have chosen to strictly comply with the boundaries of the law to balance the strong interest of protecting patron privacy while complying with legal orders. As Jonathan Franklin, a Digital Innovation Law Librarian at the University of Washington, puts it, “In a world where all data is seen as having value, it might be that the easiest path is to delete nothing and sell/use everything, so protecting privacy over profits takes extra-effort.” Companies or other entities may have different incentives for more broadly collaborating with law enforcement. Companies like Ring, Flock, and many others are directly partnering with law enforcement to share data that facilitates surveillance of customers and the broader public.

Looking Forward: Lessons and Challenges

Libraries provide important insights regarding how to enact data privacy principles and policies that champion people’s freedom of intellectual exploration and expression. As data privacy law continues to develop and transform, these lessons from libraries exemplify how data privacy principles can be enacted to uphold people’s privacy and civil liberties.

The privacy ideals of libraries are constrained by the realities of limited resources and funding. One study found that libraries face significant challenges when upholding patron privacy due to lack of technical knowledge and training among staff, as well as inadequate funding for training or privacy protection tools. Many of the data privacy studies and resources developed by and for librarians are funded by the Institute of Museum and Library Services (IMLS) grants. The current administration is attempting to dismantle IMLS, though that is being challenged in court. Amid these pressures, libraries have an almost century-long tradition of protecting patron data from censorship and surveillance.

As C. Allison Sills, an instructional librarian in North Carolina, aptly stated, the “Invasion of privacy by retaining patron checkout history is tantamount to book banning. If you surveil the populace, the populace will start to self-censor to prevent ‘potential’ discrimination, which starts the fear cycle.”

The Fall of 23andMe

By: Jacqueline Purmort-Labue

Following its reputation-damaging data breach in 2023 and subsequent reduced demand for testing kits, 23andMe filed for bankruptcy in late March of this year. The genetic testing company has consumers submit a saliva sample of their DNA to be analyzed for ancestry purposes, family traits, or potential health risks. The company initiated the voluntary Chapter 11 proceeding to maximize the business’s value for stakeholders through a court-supervised sale process. 

Is Your Genetic Data Being Auctioned to the Highest Bidder? 

23andMe Board Chair, Mark Jensen, stated that “data privacy will be an important consideration in any potential transaction.” In response to customer concern following the Chapter 22 filing, 23andMe released an open letter to customers, assuring users that “[a]ny buyer of 23andMe will be required to comply with our privacy policies and applicable law concerning the treatment of customer data.” Despite this, many consumers are understandably upset about their genetic information being sold to the highest bidder. In the best case scenario, users could be targeted with ads based on results from their genetic tests. However, in the worst case scenario, an employer or insurance company might find a user has a predisposition to develop early-onset Alzheimer’s, cancer, mental illness, or substance use disorder, and discriminate against the user based on that information. 

Legal Remedies For the Sale of Sensitive Data 

Those worried about their sensitive DNA information may not realize how few federal protections exist. The Health Insurance Portability and Accountability Act (HIPAA) seems like it would apply, but HIPAA’s definition of covered entities and business associates only includes healthcare providers, health insurance, and any business associate working with those companies, meaning data that’s held by direct-to-consumer companies like 23andMe is not protected. Under the law, users are treated as consumers, not patients

The Genetic Information Nondiscrimination Act (GINA) prevents health insurers, but also employers, from using genetic information in a discriminatory way. This federal law, passed in 2008, does not apply to life insurance companies, mortgage lenders, and other non-health entities. Additionally, GINA does not explicitly protect epigenetic information, which is information about the way a person’s genes are affected by external factors such as smoking, disease, or stress. 

Some states have passed a genetic information privacy law, including Alabama, Arizona, California, Florida, Kentucky, Maryland, Montana, Nebraska, South Dakota, Tennessee, Texas, Utah, Virginia, and Wyoming. Some states, like California and Texas, have taken consumer protection a step further. California Attorney General Rob Bonta issued a consumer alert to customers of 23andMe. He urged  Californians to consider invoking their rights under the Genetic Information Privacy Act (GIPA) and California Consumer Privacy Act (CCPA), and directing 23andMe to delete their data and destroy any remaining samples of genetic material. Similarly, Texas Attorney General Ken Paxton issued a statement, encouraging any Texan concerned about their data to exercise the right to have their data securely deleted. 

Bankruptcy law may provide some protections. Bankruptcy proceedings are an inherently public process and often draw scrutiny from the public. In some cases, regulators such as the Federal Trade Commission or state attorneys general may intervene and seek to participate in the proceedings. Bankruptcy cases are adjudicated in federal court and may require the appointment of a consumer privacy ombudsperson to review the proposed sale of assets. This ombudsperson assesses whether the proposed sale of assets aligns with the company’s existing privacy policies and applicable laws.

Looking to the Future

In response to pressure from many state attorneys general, 23andMe agreed in late April 2025 to allow a court-appointed overseer to safeguard customers’ genetic data during the bankruptcy proceeding. The ombudsman will also review any sale of 23andMe’s business or data during the company’s bankruptcy and report to the court any implications for customer data privacy. 

Experts believe existing law is insufficient or relies too heavily on consumers to self-manage their data privacy. Consumers are expected to read and understand companies’ privacy policies. However, studies have shown that the vast majority of consumers don’t read privacy notices or understand how companies use their data. 

The 23andMe bankruptcy case underscores the urgent need for stronger, comprehensive federal privacy protections for genetic data. While state-level efforts and the appointment of a privacy ombudsman offer some reassurance, they highlight the fragmented and reactive nature of current legal safeguards. As genetic testing becomes more widespread, policymakers must confront the gaps in federal law that leave consumers vulnerable, especially in high-stakes situations like asset sales. Until then, consumers are left to navigate a complex and opaque system on their own.

#GeneticData #Privacy #ConsumerProtection #WJLTA