New York and over two dozen other states have filed a lawsuit against 23andMe, seeking to block the sale of its customers’ private genetic information as part of the company’s bankruptcy proceedings.
On Monday, 27 states—including Pennsylvania, Michigan, and Florida—as well as the District of Columbia filed the complaint in a Missouri bankruptcy court. The suit seeks a declaration that 23andMe cannot sell customers’ genetic data without their consent.
The California-based genetic testing company filed for bankruptcy in March following a sharp decline in consumer demand and a 2023 data breach that exposed sensitive genetic and personal information from millions of users. As part of its bankruptcy plan, 23andMe is seeking to auction its business, which includes over 15 million DNA profiles obtained through its at-home saliva testing kits.
“23andMe cannot auction millions of people’s personal genetic information without their consent,” New York Attorney General Letitia James said in a statement Tuesday. “New Yorkers and many others around the country trusted 23andMe with their private information and they have a right to know what will be done with their information.”
23andMe responded by stating the lawsuit lacks merit, asserting that the proposed sale complies with its privacy policy and relevant laws. “Customers will continue to have the same rights and protections in the hands of the winning bidder,” the company said.
Separately, California Attorney General Rob Bonta’s office filed an objection to the asset sale, arguing it violates the state’s laws governing the transfer of sensitive genetic data.
Last week, 23andMe asked a bankruptcy judge to reopen bidding after receiving a $305 million offer from co-founder Anne Wojcicki, surpassing an earlier $256 million lead bid from Regeneron Pharmaceuticals. A representative for Regeneron, which has yet to comment publicly, won the court-approved auction in May. The company has said it plans to use the genetic data to develop new medications and has pledged to uphold 23andMe’s privacy policies.
During a House Oversight Committee hearing on Tuesday, 23andMe interim CEO Joseph Selsavage told lawmakers that since the March bankruptcy filing, 1.9 million users—around 15% of the company’s customer base—have requested deletion of their genetic data.
The bankruptcy and planned sale of genetic data have sparked public backlash and raised concerns that millions of Americans’ sensitive health information could fall into the wrong hands. A federal bankruptcy court is set to review Regeneron’s offer later this month.
The controversy comes after a prolonged data breach in 2023, during which 6.9 million customers’ personal and genetic data were compromised. The company blamed its customers for not using multi-factor authentication, rather than acknowledging lapses in its own security practices or the delay in detecting the breach.
Also on Tuesday, the coalition of more than two dozen states—including Florida, New York, and Pennsylvania—filed suit to stop the sale of 23andMe’s genetic database, arguing that the company cannot transfer this sensitive information without explicit customer consent.
Pump Radar
Stock Alerts