Speaking from the perspective of someone who's worked in the tech industry for thirty years, the thing about personal data privacy policies for online services is that, nearly without exception, they contain provisos allowing your data to be shared with third parties to the extent that doing so is necessary to provide the service that's being offered – and, critically, unless they're literally forced to do so by law, who these third parties are and what constitutes "necessary" sharing will not be defined. This vagueness is routinely exploited by entering into sham partnerships with interested parties who, on paper, are providing the data holder with unspecified consulting services, thereby allowing the data in question to be shared with practically anyone while adhering to the letter of any relevant privacy policy.
All of which is to say that 23andMe has absolutely been selling your genetic data this whole time. The only reason they're asking a judge for official permission to do so now is because being in bankruptcy means they actually need to explain what it is that they're doing.
