The genetic testing company thought they could get away with selling customers down the river.
But 27 states just delivered a crushing blow that has 23andMe scrambling.
And 23andMe got slapped with a lawsuit that could expose dark secrets about your DNA.
States band together to protect Americans from genetic data grab
Millions of Americans trusted 23andMe with their most personal information when they spit into those little tubes.
They wanted to learn about their ancestry and health risks.
What they didn’t expect was for the company to treat their genetic data like a commodity to be sold to the highest bidder.
But that’s exactly what’s happening now that 23andMe filed for bankruptcy in March.
Twenty-seven states, including New York, Pennsylvania, Michigan, and Florida, along with Washington, D.C., filed a bombshell lawsuit on Monday to stop the California-based company from auctioning off customer DNA profiles without consent.
The lawsuit was filed in 23andMe’s bankruptcy proceedings in the U.S. Bankruptcy Court in the Eastern District of Missouri.
"23andMe cannot auction millions of people’s personal genetic information without their consent," New York Attorney General Letitia James said.
"New Yorkers and many others around the country trusted 23andMe with their private information and they have a right to know what will be done with their information."
Oregon Attorney General Dan Rayfield, who helped lead the legal effort, explained that genetic information represents a fundamentally different type of personal data.
"Biological samples, DNA data, health-related traits and medical records are too sensitive to be sold without each person’s express, informed consent," Rayfield argued.
Company’s troubles started with massive data breach
23andMe’s financial collapse didn’t happen overnight.
The genetic testing company has been struggling after consumer demand dropped and a devastating data breach in 2023 exposed the genetic and personal information of millions of customers.
That breach should have been a wake-up call about the dangers of trusting companies with sensitive genetic information.
Instead, 23andMe is now trying to profit from that same vulnerable data by selling it as part of their bankruptcy auction.
The sale includes more than 15 million DNA profiles that were collected through the company’s direct-to-consumer saliva-testing kits.
Think about that for a moment.
Fifteen million Americans provided their most intimate biological information to a company they trusted.
Now that company wants to hand over all that data to whoever writes the biggest check.
23andMe fights back against state challenge
23andMe pushed back against the legal challenge, calling the states’ arguments baseless.
The company maintained that selling customer data during bankruptcy proceedings is allowed under their current privacy policies and follows all applicable laws.
"Customers will continue to have the same rights and protections in the hands of the winning bidder," a company spokesperson said.
But the search results show that the bankruptcy judge has already appointed a court-appointed consumer protection ombudsman in April 2025 to oversee customer data protection during the bankruptcy process. This shows the courts are taking genetic privacy seriously.
California raises additional concerns about the sale
California is taking an even tougher stance against the proposed sale.
Democrat California Attorney General Rob Bonta’s office filed a separate objection on Monday.
California argues the asset sale would violate the state’s restrictions on the transfer of sensitive genetic material.
This shows that even 23andMe’s home state recognizes the serious privacy concerns at stake.
Recent reports show that 15% of 23andMe’s customer base – about 1.9 million people – have already requested their genetic data be deleted since the bankruptcy filing. This shows how seriously customers are taking the privacy concerns.
The bankruptcy auction has created a bidding war over Americans’ most personal information.
Anne Wojcicki, the company’s co-founder, has made a $305 million offer through her nonprofit TTAM Research Institute to buy back the company she helped create.
This new bid is competing against a $256 million offer from Regeneron Pharmaceuticals, a New York-based drugmaker that wants to use the genetic data to develop new medicines.
The fact that pharmaceutical companies are bidding on this data raises serious questions about how it might be used for drug development and research without explicit customer consent for those purposes.
The bigger picture about genetic privacy
This lawsuit represents a much larger battle over genetic privacy rights in America.
As genetic testing becomes more popular, companies are collecting massive databases of the most intimate information possible about millions of Americans.
When these companies face financial troubles, that data becomes an asset they can sell.
The 27 states filing this lawsuit recognize that genetic information is fundamentally different from other types of personal data.
Your DNA reveals information not just about you, but about your family members and future generations.
Once that information is out there, it can never truly be private again.
The states are drawing a line in the sand to protect Americans from companies that would exploit their trust for profit.
This case could set an important precedent about whether genetic information can be treated like any other business asset or whether it deserves special protection.
Americans who trusted 23andMe with their DNA deserve to know that their genetic privacy will be protected, even when the company they trusted fails.
The outcome of this lawsuit will determine whether that trust was misplaced.
