US states sue 23andMe to protect customers’ private data

New York and more than two dozen other US states sued 23andMe to challenge the sale of its customers’ private information after the genetic testing company filed for bankruptcy in March.

Twenty seven states, including Pennsylvania, Michigan and Florida, and the District of Columbia filed the lawsuit on Monday in 23andMe’s US bankruptcy proceedings in Missouri, seeking a declaration that it cannot sell customers’ genetic data without their consent.

California-based 23andMe in a March bankruptcy filing said it was seeking to sell its business at auction after a dip in consumer demand and a data breach in 2023 that exposed genetic and other information of millions of customers.

The sale will include more than 15 million DNA profiles that were collected through the company’s direct-to-consumer saliva-testing kits.

“23andMe cannot auction millions of people’s personal genetic information without their consent,” New York Attorney General Letitia James, a Democrat, said in a statement on Tuesday. “New Yorkers and many others around the country trusted 23andMe with their private information and they have a right to know what will be done with their information.”

23andMe in a statement said the states’ arguments were without merit, and that the sale is permitted under 23andMe privacy policies and applicable law. “Customers will continue to have the same rights and protections in the hands of the winning bidder,” the company said.

In a separate filing, Democratic California Attorney General Rob Bonta’s office on Monday said the state was objecting to the proposed asset sale because it would violate California’s restrictions on the transfer of sensitive genetic material.

23andMe last week told a US bankruptcy judge that it wants to re-open bidding on its assets after receiving a $305 million offer from its co-founder Anne Wojcicki.

The company had previously selected a $256 million bid from Regeneron Pharmaceuticals as the lead offer. A representative from Regeneron did not immediately respond to a request for comment.