In a landmark legal move, more than two dozen US states have joined forces to sue 23andMe, the well-known genetic testing company, over its plans to sell millions of customers’ private data without explicit consent. The lawsuit, spearheaded by New York Attorney General Letitia James and a bipartisan coalition of 27 other state attorneys general, was filed in the U.S. Bankruptcy Court for the Eastern District of Missouri. This action comes after 23andMe filed for bankruptcy in March 2025, revealing intentions to auction off its vast collection of genetic and health information collected from over 15 million Americans.
The coalition argues that biological samples, DNA data, health-related traits, and medical records are among the most sensitive types of personal information. They insist that these assets should not be sold or transferred without each customer’s express, informed permission. The lawsuit seeks to block any sale of this data and ensure that 23andMe complies with state laws regarding the privacy and security of genetic information.
The Core of the Lawsuit: Protecting Genetic Privacy
The legal battle centers on the question of who owns genetic data—the company that collects it or the individuals who provide it. The states are demanding a court ruling that would prevent 23andMe from auctioning off its customers’ personal genetic information as part of its bankruptcy proceedings. According to Oregon Attorney General Dan Rayfield, “Biological samples, DNA data, health-related characteristics, and medical histories are too private to be traded without the clear and informed agreement of each individual.” This sentiment is echoed across the coalition, which includes states such as Pennsylvania, Michigan, Florida, and the District of Columbia.
At the heart of the controversy is the sheer scale of the data involved. 23andMe has accumulated genetic information from more than 15 million consumers through its direct-to-consumer saliva testing kits. Customers submitted these samples with the expectation that their data would be used for ancestry and health insights, not for sale to the highest bidder. The lawsuit highlights that customers did not anticipate their DNA would be auctioned off, especially without their knowledge or consent.
The Fallout and Public Response
The lawsuit is not the first time 23andMe has faced scrutiny over its handling of customer data. In 2023, the company suffered a major data breach that compromised the genetic and personal details of millions of users, leading to a $30 million settlement and three years of security monitoring. This latest controversy has reignited concerns about the security and privacy of genetic information in the digital age.
Following the bankruptcy announcement, lawmakers in the House initiated an investigation into the company’s data practices, citing difficulties some users faced in deleting their information from the platform. Attorney General Letitia James issued a consumer alert in March 2025, urging New Yorkers to contact 23andMe to delete their personal data and destroy any retained genetic samples.
Despite the legal challenges, 23andMe maintains that any sale of customer data would be conducted in accordance with its privacy policies and applicable laws. The company has stated, “Customers will continue to enjoy the same rights and protections under the winning bidder.” Meanwhile, Regeneron Pharmaceuticals, which recently announced its intention to acquire 23andMe for $256 million, has pledged to uphold existing privacy protocols and legal standards.
What This Means for Consumers
The lawsuit has sparked a broader conversation about the ownership and control of genetic data. Many consumers are now questioning whether they truly understand the fine print when they sign up for genetic testing services. The case highlights the need for stronger protections and clearer communication about how personal information is used, stored, and potentially sold.
For now, customers retain the ability to delete their data from the 23andMe platform, though some have reported difficulties in doing so. The lawsuit aims to reinforce the principle that individuals should have the final say over what happens to their most sensitive information.
Key takeaways from the current situation:
- Consent Matters: The states argue that selling genetic data without explicit consent violates trust and privacy.
- Scale of Data: Over 15 million DNA profiles are at risk of being auctioned off.
- Legal Precedent: The outcome could set a significant precedent for how genetic data is handled in corporate transactions.
Looking Ahead: Genetic Data in the Digital Age
The 23andMe case is a wake-up call for both consumers and companies. As genetic testing becomes more popular, the potential for misuse of sensitive data grows. The lawsuit underscores the importance of robust privacy laws and transparent business practices in the biotech industry.
Consumers are encouraged to review the privacy policies of any genetic testing service before submitting their samples. They should also consider whether they are comfortable with the possibility of their data being sold or transferred in the future. The outcome of this legal battle will likely influence how genetic data is treated in future corporate bankruptcies and acquisitions.
If you have used 23andMe or any similar service, now is the time to review your account settings and consider your options for data deletion. Stay informed about ongoing legal developments and advocate for stronger protections for your genetic privacy.