Twenty-seven attorneys general have united in a landmark lawsuit to prevent 23andMe from auctioning off customers’ genetic data without consent, as the bankrupt DNA testing company faces acquisition by pharmaceutical giant Regeneron.
At a Glance
- Twenty-seven states and DC filed a lawsuit to block 23andMe from selling customers’ genetic data without explicit consent
- The legal action comes as 23andMe faces bankruptcy proceedings with Regeneron Pharmaceuticals offering $256-315 million to acquire the company
- Oregon Attorney General Dan Rayfield emphasized that biological samples and DNA data are “too sensitive to be sold without each person’s express, informed consent”
- A court-appointed privacy ombudsman will review the proposed sale’s impact on consumer privacy
- The case highlights growing concerns about ownership and protection of highly personal genetic information
Multi-State Legal Challenge Against DNA Data Sale
Attorneys general from 26 states and the District of Columbia have filed a significant lawsuit in bankruptcy court to prevent 23andMe from selling customers’ genetic data without proper consent. The legal action targets a proposed acquisition by Regeneron Pharmaceuticals, which has offered at least $256 million for the company that has provided DNA testing kits to millions of Americans seeking information about their ancestry and health risks. The unprecedented legal challenge represents growing concerns about the security and ownership of deeply personal genetic information.
The lawsuit comes after 23andMe filed for Chapter 11 bankruptcy protection in March 2025, following financial struggles since going public in 2021. The states involved include Arizona, Colorado, Connecticut, Florida, Illinois, Kansas, Kentucky, Louisiana, Maine, Michigan, Minnesota, Missouri, New Hampshire, New Mexico, New York, North Carolina, Oklahoma, Pennsylvania, South Carolina, South Dakota, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, and the District of Columbia. This broad coalition demonstrates the nationwide significance of protecting sensitive genetic information.
Concerns Over Genetic Privacy Rights
At the heart of the legal battle is the question of whether a company can sell genetic data collected from consumers without obtaining new and specific consent for such transfers. Oregon Attorney General Dan Rayfield has taken a strong stance on the issue, emphasizing the unique sensitivity of genetic information compared to other types of consumer data. The lawsuit argues that 23andMe lacks the right to auction customers’ genetic identities regardless of existing privacy policies or terms of service agreements.
“Biological samples, DNA data, health-related traits and medical records are too sensitive to be sold without each person’s express, informed consent,” said Oregon Attorney General Dan Rayfield.
The attorneys general further assert that 23andMe has “no right to sell their customers’ genetic identities to the highest bidder, unless the Debtors first obtain express informed consent to the proposed transaction/transfer by each consumer impacted.” This position directly challenges the company’s ability to transfer ownership of genetic data through bankruptcy proceedings, regardless of previous agreements with customers. The lawsuit frames genetic data as fundamentally different from other business assets that might change hands during bankruptcy.
Bankruptcy Proceedings and Potential Buyers
Regeneron Pharmaceuticals has emerged as the leading bidder for 23andMe, with an initial offer of $256 million that could rise to at least $315 million according to court documents. The pharmaceutical company has publicly stated it will adhere to existing privacy policies and legal requirements regarding customer data. However, the attorneys general remain concerned that the bankruptcy process could override consumer protections that would normally apply to such sensitive information.
“Your genetic data isn’t just data – it’s your DNA. It’s personal, permanent, and deeply private,” stated Oregon Attorney General Dan Rayfield.
A court-appointed consumer privacy ombudsman is currently reviewing the proposed sale to evaluate its impact on consumer privacy. This review represents an additional layer of scrutiny before any transfer of genetic data can proceed. The bankruptcy court will need to consider the ombudsman’s findings alongside the claims raised by the state attorneys general before making a final determination on whether the sale can proceed as proposed or if additional consumer protections must be implemented.
Implications for Consumer Genetic Testing Industry
The outcome of this case could establish important precedents for the consumer genetic testing industry, which has grown rapidly over the past decade. 23andMe has historically assured customers that “your genetic data will not be shared with employers, insurance companies, or public databases without your explicit consent.” The current legal challenge tests whether those assurances extend to situations where the company itself changes ownership through bankruptcy proceedings.
For the millions of Americans who have submitted DNA samples to 23andMe and similar companies, the lawsuit raises important questions about long-term control over their genetic information. Unlike other forms of personal data, genetic information is immutable and contains highly sensitive details about health predispositions and ancestry. This case highlights the growing tension between technological innovation in genetic testing and the need for stronger legal frameworks to protect this uniquely personal information from exploitation.