Multi-State Lawsuit Aims to Block Sale of 23andMe Personal Genetic Data

The states contended that 23andMe should obtain expressed consent from its customers before transferring or selling the data to another company.

23andMe headquarters in Sunnyvale, California, on Feb. 1, 2024. Justin Sullivan/Getty Images

A coalition of 27 states and the District of Columbia has taken legal action to prevent 23andMe from selling personal genetic data in its possession without customer consent.

The California-based biotechnology company filed for Chapter 11 bankruptcy on March 23 to facilitate the sale of its assets, sparking concerns over the handling of the sensitive genetic data it holds.

In a June 9 statement, the states said that customers should have the right to control the personal information they provided to the company and that 23andMe cannot sell the data like “ordinary property.”

“This isn’t just data – it’s your DNA. It’s personal, permanent, and deeply private,” Oregon Attorney General Dan Rayfield said in the statement. “People did not submit their personal data to 23andMe thinking their genetic blueprint would later be sold off to the highest bidder.”

The lawsuit states that 23andMe holds biological samples and genetic data from more than 15 million customers, which were collected through the sale of at-home genetic tests, and uses this data to determine customers’ ancestry information, lineal descent, and potential risk factors for certain diseases.

Last month, 23andMe announced that it has entered into a definitive agreement with Regeneron Pharmaceuticals for the sale of the company and its assets. The deal still requires court approval. The company later requested the court to reopen bidding on its assets after receiving a $305 million offer from its co-founder Anne Wojcicki.

In their lawsuit, the states contended that 23andMe should obtain expressed consent from its customers before transferring or selling their data to another company.

“Virtually all of this ‘customer data’ is immutable. If stolen or misused, it cannot be changed or replaced,” they stated in the suit. “In other words, the magnitude of the data in this proposed sale stretches far beyond the 23andMe consumers, impacting those who have no awareness of the sale as well as human beings who do not even exist yet.”

Customers have also been advised to delete their accounts and personal information from the company’s website to prevent their data from being sold.

Joining Rayfield in the suit are attorneys general from Arizona, Colorado, Connecticut, the District of Columbia, Florida, Illinois, Kansas, Kentucky, Louisiana, Maine, Michigan, Minnesota, Missouri, New Hampshire, New Mexico, New York, North Carolina, Oklahoma, Pennsylvania, South Carolina, South Dakota, Utah, Vermont, Virginia, Washington, West Virginia, and Wisconsin.

Responding to a media inquiry, 23AndMe pointed to interim CEO Joseph Selsavage’s remarks during Tuesday’s House Oversight Committee hearing, in which he affirmed the company’s commitment to customer data privacy.

“We are requiring that any buyer agree to comply with existing 23AndMe privacy policies and applicable law with respect to the treatment of customer data,” Selsavage said.

He added that the company will not accept any bids from entities “based in or with controlling investments from countries of concern,” or those that would raise national security concerns.

According to the company’s privacy policy page, if 23andMe goes bankrupt and changes ownership, its user data “may be accessed, sold, or transferred as part of that transaction” but the privacy provisions will still apply under the new entity.

In 2023, hackers leaked the personal data of nearly 7 million 23andMe customers on an online forum.

These data encompassed users’ origin estimation, phenotype, health information, photos, and identification data. The company said at the time that it believed “threat actors” gained access to accounts where users recycled login credentials.