Colorado joined 26 states and the District of Columbia in a lawsuit against 23andMe to stop the DNA data company from selling personal genetic information. The company announced bankruptcy in March and said they would sell the data they collected via their popular at-home DNA testing kits, where users would send in their DNA via spit and have it analyzed to learn about their ethnicity and ancestry.
The sale would include genetic and health information of more than 15 million people. The states argue the suit is about protecting personal data.
“Customers should have the right to control such deeply personal information and that it cannot be sold like ordinary property,” Colorado Attorney General Phil Weiser said in a statement.
“In Colorado, we are committed to protecting consumers’ privacy and will take action to prevent companies from selling private personal data without consent,” said Weiser. “That’s why what 23andMe is doing in this case is so appalling. Consumers shared sensitive information on the belief that only the company would have access to it, and it would not be shared without consent. The company cannot be allowed, even in bankruptcy, to share that information against the will of consumers.”
The bipartisan lawsuit was filed on Monday in St. Louis alongside a separate objection to the bankruptcy sale and is being led by Republic Missouri Attorney General Andrew Bailey. Weiser, a Democrat, said any information collected by 23andMe is too sensitive to be sold without each person’s expressed and informed consent.
In May, the biotechnology company Regeneron Pharmaceuticals announced its plan to buy 23andMe for $256 million. Regeneron said it will comply with privacy policies and applicable laws from 23andMe and will process customers' personal data in accordance with the consent customers agreed to previously.
An independent court-appointed consumer privacy ombudsman was to examine the sale and how it would affect consumers' privacy. They were due to report to the court by Tuesday.
Regeneron has not yet responded to CPR’s request for comment.
Additionally, the states are hoping to “ensure that people’s genetic data isn’t misused, exposed in future data breaches, or used in ways customers never contemplated when they signed up to have their DNA analyzed.”
Nearly 7 million people who took 23andMe’s test have already had their data exposed. In 2023 a major data breach forced the company to sign a $30 million settlement and three years worth of security monitoring.
The bankruptcy court will hold a hearing next week on the 17th to consider 23andMe’s motion to sell its assets, including genetic data. It’s unclear when the court will rule.
