Genetics & heredity

States Sue to Block 23andMe DNA Data Sale Without Consent

JUN 10 2025·Updated JUN 11 2025

Story

Above: 23andMe headquarters in Sunnyvale, California. Image credit: Justin Sullivan/Staff/Getty Images News via Getty Images

The Facts

Twenty-seven states and the District of Columbia on Monday filed a lawsuit in bankruptcy court seeking to block 23andMe from selling personal genetic data without customer consent as the company undergoes Chapter 11 bankruptcy proceedings.
ConsumerAffairs
NPR
Regeneron Pharmaceuticals in May announced plans to acquire 23andMe for $256 million, with the deal requiring court approval and facing scrutiny from a court-appointed consumer privacy ombudsman, who must report findings by Tuesday.
NTD
NPR
The lawsuit argues that biological samples, DNA data, health-related traits, and medical records are too sensitive to be sold without each person's express, informed consent, with Oregon Attorney General Dan Rayfield saying in a statement that the data "cannot be sold like ordinary property."
Oregon Department of Justice
23andMe filed for Chapter 11 bankruptcy protection in March after struggling financially since going public in 2021, laying off 40% of its staff and raising concerns about the safety of customer data from more than 15 million users.
Ibtimes
NPR
The company previously suffered a data breach in 2023 that affected nearly 7 million customers. Hackers leaked personal data, including origin estimation, phenotype, health information, photos, and identification data on online forums.
Quartz
NTD

Sources Split

LEFT

CENTER

RIGHT

ESTAB
CRIT

CENTER

PRO
ESTAB

The Spin

Narrative A

These states are taking a crucial stand for consumer privacy rights in the digital age. DNA data is fundamentally different from ordinary commercial information — it's permanent, immutable, and affects current customers and their relatives for future generations. It's right to demand explicit consent before any transfer.

NTD

ConsumerAffairs

Narrative B

Regeneron has committed to honoring all existing privacy agreements and maintaining robust security protections for customer data. This acquisition could actually strengthen data security by placing genetic information under the control of an established pharmaceutical company with proven compliance capabilities.