Twenty-seven states and the District of Columbia have sued the genetic-testing company 23andMe to oppose the sale of DNA data from its customers without their direct consent.
The suit, filed on Monday in U.S. Bankruptcy Court in the Eastern District of Missouri, argues that 23andMe needs to have permission from each and every customer before their data is potentially sold. The company had entered an agreement to sell itself and its assets in bankruptcy court.
The information for sale “comprises an unprecedented compilation of highly sensitive and immutable personal data of consumers,” according to the lawsuit.
“This isn’t just data — it’s your DNA. It’s personal, permanent and deeply private,” Dan Rayfield, the Oregon attorney general, said in a statement. “People did not submit their personal data to 23andMe thinking their genetic blueprint would later be sold off to the highest bidder.”
The 23andMe company became well known as a genetic-testing service offering kits for customers to discover their ancestry, as well as to learn about their predisposition to certain diseases and traits, according to the company’s website. To submit their tests, customers spit into tubes and send them off by mail. They then receive an analysis of the DNA, which contains ancestry and health reports.
But the DNA company, which at one point in 2021 was valued at $6 billion, ran into financial trouble and filed for bankruptcy in March, with its chief executive officer, Anne Wojcicki, resigning shortly afterward. It is poised to be acquired by Regeneron Pharmaceuticals for $256 million, according to the lawsuit. Regeneron is a biotechnology company that uses genetic data to develop new drugs.
A backup bidder for the auction is TTAM Research Institute, a California nonprofit, the lawsuit says. The company was founded by Ms. Wojcicki.
Concerning the personal data, the plaintiffs asked the court to decide “whether the debtors have the right to sell and transfer it to any buyer without first obtaining express and informed consent from each customer,” according to the legal complaint.
In a statement on Tuesday afternoon, a 23andMe spokesperson said that the lawsuit brought by the states was “without merit” and that the sale was permitted under its privacy policies and applicable law.
“Customers will continue to have the same rights and protections in the hands of the winning bidder,” the statement said.
Regeneron declined to comment on Tuesday. TTAM did not immediately respond to an email seeking comment on Tuesday afternoon.
23andMe has previously faced lawsuits related to the safekeeping of the data it possesses. A class-action lawsuit against the company was filed in federal court in the Northern District of California in January 2024, after a data breach was discovered to have targeted customers of Chinese and Ashkenazi Jewish heritage. That suit claimed that the company had failed to protect customers’ privacy and to notify them that they appeared to have been specifically targeted.
The data breach in that case, which put the information of almost 7 million customers at risk, was the result of a hack against the company from April 2023 through September 2023, according to reporting from TechCrunch.
After the hack, the company required all users to activate two-step verification, according to a 2023 filing with the Securities and Exchange Commission.
Less than a year later, the company filed for bankruptcy and was put up for auction. Regeneron submitted the winning bid last month in bankruptcy court, for $256 million, according to a 23andMe news release. Among the bidders was Ms. Wojcicki, the former chief executive.
In a statement about the expected sale, 23andMe said in March that it would continue operating normally and there would be “no changes to the way the company stores, manages or protects customer data.”
The crux of the new lawsuit is the buying and selling of customers’ personal and genetic information.
The company has the phenotype data, representing the observable characteristics of more than 15 million people, according to the lawsuit, with each customer having a file with details of their raw genetic code linked to their profile.
The genetic data at stake is especially sensitive and should be protected, the plaintiffs in Monday’s lawsuit argue, because if it is stolen or compromised, it cannot be replaced. The data can be used to track not only the individuals who sent the kits, but also people related to customers, including yet unborn generations, according to the lawsuit.
Shelly Simana, a law professor at Boston College who focuses on bioethics, said that the lawsuit could be significant in helping to establish not just whether a customer needs to give consent to sell the information, but also on who owns that data.
“If the court agrees with the state, then it could set a precedent the company cannot treat your DNA as just another asset,” Ms. Simana said.
