A coalition of 27 US states and the District of Columbia filed a lawsuit on Monday aiming to block the potential sale of personal genetic data held by 23andMe, arguing that such sensitive information should not be transferred without the explicit consent of customers, NPR reports.
The legal challenge was filed in bankruptcy court as 23andMe, a once-prominent personal genomics company, seeks to restructure under Chapter 11 following financial struggles. The company filed for bankruptcy protection in March 2025, after years of declining revenue and a major workforce reduction. It is currently the subject of a proposed $256 million acquisition by Regeneron Pharmaceuticals.
Founded in 2006, 23andMe became known for its direct-to-consumer DNA testing kits, allowing customers to explore their ancestry, discover genetic health risks, and connect with distant relatives. Over time, the company expanded into health research and pharmaceutical development. However, despite going public in 2021, it struggled to build a sustainable business model.
The attorneys general argue that genetic information, along with associated medical records and biological samples, constitutes uniquely personal and sensitive data. Oregon Attorney General Dan Rayfield, who announced the multistate lawsuit, said in a statement that such information “cannot be sold like ordinary property” and must be handled with each individual’s informed consent.
The legal filing reflects growing public concern about the ownership and use of genetic data, particularly in light of bankruptcy proceedings that can involve the sale of a company’s assets, including customer databases.
Regeneron Pharmaceuticals, the potential buyer, has stated it would adhere to existing privacy policies and legal standards. The company said it would process personal data in line with the consents and terms previously agreed to by 23andMe customers, and emphasized that it has security controls in place to safeguard the information.
Still, state officials remain cautious. They argue that bankruptcy should not allow a company to circumvent privacy protections, especially when dealing with information that can reveal intimate health and family details.
