More than two dozen states are suing 23andMe, trying to stop the sale of customers’ genetic data.
Pennsylvania, Florida and North Carolina, along with 24 other states, filed the lawsuit as part of the company’s bankruptcy proceedings in Missouri, CNN reported.
More than 15 million DNA profiles were collected using the California-based company’s saliva testing kits.
“23andMe cannot auction millions of people’s personal genetic information without their consent,” New York Attorney General Letitia James said in a statement, according to CNN. “New Yorkers and many others around the country trusted 23andMe with their private information and they have a right to know what will be done with their information.”
The states said 23andMe needs to have permission from every customer before the data is sold, The New York Times reported.
The lawsuit said the sale “comprises an unprecedented compilation of highly sensitive and immutable personal data of consumers,” the newspaper reported.
The company said the lawsuits are without merit and that the information’s sale is permissible under its privacy policy and law.
“Customers will continue to have the same rights and protections in the hands of the winning bidder,” 23andMe said.
“This isn’t just data — it’s your DNA. It’s personal, permanent and deeply private,” Oregon Attorney General Dan Rayfield said in a statement, according to the Times. “People did not submit their personal data to 23andMe thinking their genetic blueprint would later be sold off to the highest bidder.”
Read the lawsuit filing below or click here.
At one point, 23andMe was valued at $6 billion but filed for bankruptcy in March. Biotech company Regeneron Pharmaceuticals is expected to buy the company for $256 million. The pharmaceutical company uses genetic data to develop drugs.
The Associated Press said that the federal government has no privacy law and only around 20 states do.
23andMe currently does not share the DNA information with health insurance, employers or public databases without consent. It only works with law enforcement if there is a valid legal process like a subpoena.
“There’s still other things that they are allowed to do with that data, including, as they mentioned, provide cross context, behavioral or targeted advertising,” computer science professor David Choffnes told the AP. “So, you know, in a sense, even if they aren’t sending your personal data to an advertiser, there’s a long line of research that identifies how third parties can re-identify you from de-identified data by looking for patterns in it. And so if they’re targeting you with advertisements, for example, based on some information that they have about your genetic data, there’s probably a way that other parties could piece together other information they have access to.”
In addition to being a professor at Northeastern University, he is also the executive director of the school’s Cybersecurity and Privacy Institute.
California Attorney General Rob Bonta said before 23and Me filed for bankruptcy earlier this year that customers can request that their data be deleted, the AP reported.
To do so, go to your 23andMe account, select settings, then go to “23andMe Data.” You then need to click view, download the data if you want a copy, then go to “Delete Data” and click “Permanently Delete Data,” the AP reported. The company will send you a confirmation email that you will need to click the link to finish the process.
You can also ask the company to destroy your saliva sample and DNA by going to preferences.
Finally, you can remove the consent to share the data with third parties under “Research and Product Consents.”
23andMe lawsuit by National Content Desk on Scribd
23andMe lawsuit Exhibit by National Content Desk on Scribd
© 2025 Cox Media Group
Sign Up
