Twenty-five states alleged last week that 23andMe’s privacy policies violated multiple states’ laws and that customers’ data is not secure, urging a bankruptcy court to appoint independent experts to recommend privacy and security measures before the company may sell genetic data as an asset. Alaska separately told the court that its state law requires 23andMe to seek new customer consent for the sale. This article, the second installment in a two-part series with insights from Withers and LK Law Firm, distills the legal questions about privacy that have emerged in the bankruptcy case and offers lessons from the proceedings for other companies, including takeaways about emerging risks and laws around sensitive data inferences. Part one discussed the growing potential for state privacy laws to play a disruptive role in bankruptcies and possible powers for an appointed privacy ombudsman in the 23andMe case. See “FTC and State Enforcers Reveal What’s Next and What to Do About It” (Oct. 2, 2024).