States Unite in Lawsuit to Prevent Sale of 23andMe Genetic Data Without Customer Approval

PORTLAND, Ore. — A coalition of twenty-seven states and the District of Columbia has filed a lawsuit in bankruptcy court aimed at preventing the sale of personal genetic data by 23andMe without obtaining customer consent. This legal action coincides with a biotechnology company seeking court approval to acquire the financially troubled firm.

Oregon Attorney General Dan Rayfield emphasized the sensitivity of biological samples, DNA data, health traits, and medical records, stating that these should not be sold without explicit, informed consent from individuals. Customers possess the right to control their deeply personal information, which should not be treated as ordinary property.

Founded in 2006, 23andMe offers saliva-based DNA testing kits that allow customers to explore their ancestry and reconnect with long-lost relatives. While the company has also been involved in health research and drug development, it has struggled to establish a sustainable business model following its public offering in 2021.

The situation worsened, culminating in a significant staff reduction of 40% in March, when the company filed for Chapter 11 bankruptcy protection in the Eastern District of Missouri. This filing raised concerns about the potential risks to customer data.

In response to these challenges, Regeneron Pharmaceuticals announced last month its intention to acquire 23andMe for $256 million. The company affirmed its commitment to adhering to 23andMe’s privacy policies and relevant legal requirements.

Regeneron pledged to process customer personal data in accordance with existing consents and privacy regulations while implementing security measures to protect such information. An independent consumer privacy ombudsman appointed by the court is expected to review the proposed sale, assess its implications for consumer privacy, and report findings to the court by Tuesday.