By CaraLynn Caulfield
New York Attorney General Letitia James and a bipartisan coalition of 27 other attorneys general have filed a lawsuit against DNA testing company 23andMe, seeking to block the company from auctioning off the genetic data of more than 15 million Americans without their explicit consent.
The lawsuit, announced onJune 9, comes in response to 23andMe’s bankruptcy filing in March 2025 and its subsequent plans to sell off its assets — including highly sensitive genetic, medical, and biological data — as part of an agreement to be acquired by pharmaceutical company Regeneron. The attorneys general argue that selling such personal data without clear, informed consent from users violates state consumer protection and data privacy laws.
“23andMe cannot auction millions of people’s personal genetic information without their consent,” said Attorney General James. “New Yorkers and many others around the country trusted 23andMe with their private information, and they have a right to know what will be done with it. My office is joining 27 other attorneys general to protect people’s most private information and to make sure 23andMe abides by the law.”
According to James and the coalition, the genetic profiles held by 23andMe — which may include health traits, DNA sequencing, and medical histories — are too sensitive to be sold like ordinary corporate assets. In March, the New York Attorney General’s Office also issued a consumer alert urging 23andMe users to contact the company directly to request deletion of their personal data and destruction of any remaining biological samples.
The multistate lawsuit emphasizes that even during bankruptcy proceedings, 23andMe must comply with privacy laws and obtain explicit permission from consumers before transferring their personal genetic data to any third party.
In response to the lawsuit, a 23andMe spokesperson defended the company’s actions:
“We believe the arguments brought by the attorneys general are without merit and we will address them at the sale hearing. The sale is permitted under 23andMe’s privacy policies and applicable law. We required any bidder to adopt our policies and comply with applicable law as a condition to participating in our sales process. Customers will continue to have the same rights and protections in the hands of the winning bidder. Both remaining bidders are U.S. companies, have committed to abide by 23andMe’s privacy policies, and will continue to operate 23andMe as it has always been operated.”