A group of 27 states along with the District of Columbia is taking legal action to halt the potential sale of consumer genetic data held by 23andMe, arguing that individuals never agreed to have their DNA treated like property in a bankruptcy proceeding.
The case, filed in US Bankruptcy Court in Missouri, targets what the states view as a dangerous precedent: auctioning off sensitive, deeply personal genetic material without the informed, ongoing consent of those who provided it.
We obtained a copy of the complaint for you here.
23andMe, once a dominant force in the consumer genetics industry, has gathered DNA samples from more than 15 million users. The company, previously valued at $6 billion, filed for bankruptcy earlier this year and began a court-supervised process to offload its assets.
At the center of the lawsuit is a belief that genetic data cannot be lumped in with other commercial holdings. States argue that this information is not only private but fundamentally irreplaceable.
“This isn’t just data — it’s your DNA,” said Oregon Attorney General Dan Rayfield. “It’s personal, permanent, and deeply private. People did not submit their personal data to 23andMe thinking their genetic blueprint would later be sold off to the highest bidder.”
Although 23andMe stated in May that Regeneron Pharmaceuticals would purchase the company and honor existing privacy terms, the sale was paused when TTAM Research Institute, led by 23andMe co-founder Anne Wojcicki, submitted a competing bid.
Wojcicki has been trying to reacquire the company for some time, and the judge overseeing the bankruptcy opted to reopen the bidding.
The company has responded by denying that the lawsuit has any legal foundation. A spokesperson maintained that privacy policies would continue to apply under new ownership.
“Customers will continue to have the same rights and protections in the hands of the winning bidder,” the spokesperson said.
Privacy advocates and legal experts have raised red flags, pointing out that while 23andMe claims to follow strict policies, those rules can change at any time.
Sara Geoghegan, a senior counsel at the Electronic Privacy Information Center, highlighted the risks in an earlier interview. “I would be very concerned if I had given a swab to 23andMe,” she said. “There is little we can do to control what happens to it.”
Testifying before lawmakers this week, interim CEO Joseph Selsavage revealed that since the bankruptcy was announced in March, 1.9 million people have requested that their genetic data be deleted. Under California and federal privacy laws, users are entitled to have their information removed.
