Twenty-seven states and the District of Columbia filed a lawsuit Monday in federal bankruptcy court seeking to block the sale of personal genetic data held by 23andMe without explicit customer consent, escalating a legal battle over one of the largest repositories of human DNA information in private hands.
The coalition, led by Oregon Attorney General Dan Rayfield, argues that biological samples, DNA data, health traits and medical records are too sensitive to be sold without each person's express consent as the genetic testing company seeks court approval for its acquisition by Regeneron Pharmaceuticals.
"This isn't just data – it's your DNA. It's personal, permanent, and deeply private," Rayfield said in announcing the lawsuit1. The states contend that customers should retain control over such intimate information and that genetic data cannot be sold like ordinary property23.
The legal challenge comes as Regeneron, a major pharmaceutical company, seeks to acquire the struggling 23andMe for $256 million24. Regeneron has pledged to comply with 23andMe's existing privacy policies and implement security controls to protect customer data2.
A court-appointed independent consumer privacy ombudsman was scheduled to examine the proposed sale and report to the court by Tuesday on potential impacts to consumer privacy24.
23andMe filed for Chapter 11 bankruptcy protection in March after years of financial struggles following its 2021 public debut12. The company, founded in 2006, laid off 40% of its workforce before seeking bankruptcy protection in Missouri's Eastern District1.
The Sunnyvale, California-based company built its business around saliva-based DNA testing kits that allowed customers to explore ancestry and connect with relatives, eventually amassing genetic data from approximately 15 million users23.
The bankruptcy filing followed a damaging 2023 data breach that exposed personal information of 6.9 million customers through credential stuffing attacks12. Hackers accessed additional accounts through the company's DNA Relatives feature, with data profiles appearing on dark web marketplaces2.
23andMe agreed to a $30 million class-action settlement over the breach in September 202423. The incident severely damaged the company's reputation and contributed to its financial decline, with stock prices falling to around $0.30 per share3.
Federal Trade Commission Chairman Andrew Ferguson has warned that 23andMe must honor its privacy commitments in any sale, emphasizing that consumer promises must be kept under bankruptcy law4.
"People did not submit their personal data to 23andMe thinking their genetic blueprint would later be sold off to the highest bidder," Rayfield said5.
