• Twenty-seven states have filed a lawsuit against 23andMe concerning the sale of genetic data.
• The company is facing bankruptcy and intends to auction off sensitive customer information.
• Regeneron Pharmaceuticals has agreed to acquire 23andMe for $256 million amid these allegations.
• Privacy advocates stress the unique sensitivity of genetic data and the importance of customer consent.

A total of twenty-seven states and the District of Columbia have jointly sued 23andMe as part of a legal effort to block the genetic-testing company from selling customers’ DNA data without explicit consent. The lawsuit, filed in U.S. Bankruptcy Court in the Eastern District of Missouri, argues that consumers must provide permission before their highly sensitive genetic information can be sold, highlighting the personal and immutable nature of such data. Oregon Attorney General Dan Rayfield emphasized, “This isn’t just data — it’s your DNA... People did not submit their personal data to 23andMe thinking their genetic blueprint would later be sold off to the highest bidder,” according to The New York Times, The Hill, and Los Angeles Times.

The lawsuit emerges during a period when 23andMe is undergoing a court-supervised sale process following its bankruptcy filing in March. While the company was once valued at $6 billion and has collected genetic samples from over 15 million consumers, its financial challenges have raised alarm bells regarding consumer privacy. The lawsuit asserts that it is imperative for 23andMe to seek individual consent before any sale of personal genetic data, as outlined in privacy laws, according to The Hill and Los Angeles Times.

Regeneron Pharmaceuticals has made a proposal to purchase 23andMe for $256 million but has stated it will adhere to existing privacy policies if the acquisition is finalized. A statement from 23andMe argued that the company’s handling of customer data complies with all applicable regulations, asserting that the claims brought forth in the lawsuit are “without merit.” However, privacy experts remain concerned about the adequacy of these protections, reminding customers of their rights to delete their personal genetic information from the company’s database, as suggested by the Genetic Information Privacy Act and California Consumer Privacy Act, according to The New York Times and Los Angeles Times.