PORTLAND, Ore. — A coalition of twenty-seven states and the District of Columbia filed a lawsuit on Monday in bankruptcy court, aiming to block 23andMe from selling personal genetic data without obtaining explicit consent from customers. This legal action arises as the biotechnology company seeks court approval for a sale to a struggling firm.
Oregon Attorney General Dan Rayfield emphasized the importance of consent, stating in a news release, “Biological samples, DNA data, health-related traits and medical records are too sensitive to be sold without each person’s express, informed consent.” He added that individuals should maintain control over their deeply personal information, which should not be treated as ordinary property.
23andMe, founded in 2006, offers saliva-based DNA testing kits that allow users to explore their ancestry and reconnect with distant relatives. The company has also engaged in health research and drug development. However, it has struggled to establish a profitable business model since going public in 2021. In March, 23andMe made significant layoffs, reducing its workforce by 40%, and shortly thereafter filed for Chapter 11 bankruptcy protection in the Eastern District of Missouri, raising alarms about the security of customer data.
Regeneron Pharmaceuticals announced last month its intention to acquire 23andMe for $256 million. The company has pledged to adhere to 23andMe’s privacy policies and applicable laws, ensuring that customer personal data will be processed in accordance with existing consents and privacy policies, as well as maintaining robust security measures to safeguard this information.
An independent consumer privacy ombudsman appointed by the court was set to review the proposed sale’s implications for consumer privacy and present findings to the court by Tuesday.