23andMe Defends Sale Against Bipartisan Challenge From State AGs

The biotechnology firm filed for bankruptcy at the end of March, leaving an uncertain future for its customers’ sensitive genetic data (see 2503240046).

“23andMe holds -- and is proposing to sell to a third-party -- an unprecedented compilation of highly sensitive and immutable personal data," the AGs' complaint said in a bankruptcy court filing.

It adds that since state law limits a "debtor’s right to sell its customer’s personal and genetic data," the states seek “a declaratory judgment to determine whether and to what extent 23andMe has the right to sell and transfer to a third-party such intimate customer data without first obtaining the express informed consent of its customers.”

Tennessee filed a separate objection to the sale Tuesday as well. "While Tennessee does not oppose a sale of assets in principle," it has "concerns about the transfer of consumers’ genetic data without their separate express consent," the state's court document said. Tennessee’s Genetic Information Privacy Act, the document continues, regulates the disclosure of such data and requires consumer consent. "The filing of a bankruptcy petition did not relieve the Debtors of their obligation to follow federal and state consumer protection laws ... As such, this Court should not permit the sale of genetic data in this case without the separate express consent of each consumer whose data is at issue."

A 23andMe spokesperson, in a statement to Privacy Daily, said, “We believe the arguments brought by the attorneys general are without merit, and we will address them at the sale hearing.” The statement continued, “The sale is permitted under 23andMe privacy policies and applicable law. We required any bidder to adopt our policies and comply with applicable law as a condition to participating in our sales process.”

“Customers will continue to have the same rights and protections in the hands of the winning bidder,” 23andMe said. “Both remaining bidders are US companies, have committed to abide by 23andMe privacy policies, and will continue to operate 23andMe as it has always been operated.”

Privacy was central to “every decision we made,” Wojcicki, who is pursuing a potential purchase as an independent bidder, told House Oversight members. Customers have always had a choice in consenting to how their anonymized data is used, she said: 23andMe never shared customer data with third parties without consumer consent. She testified the company’s scientific research has led to life-saving discoveries, and customers have been clear about using the data to help save lives.

Customers can consent to allow their data to be used for research purposes, and 80% have, said Selsavage. 23andMe removes all identifying information before genetic data is shared with third parties, he said: Users can opt out and are free to delete their accounts and data at any time.

House Oversight Committee Chairman James Comer, R-Ky., and ranking member Stephen Lynch, D-Mass., raised concerns about the security of customers’ sensitive data and the potential for Chinese groups to somehow gain access. Comer noted that some of 23andMe’s early investors were Chinese companies. The data can be used for nefarious purposes related to insurance premiums, employment, credit card decisions and targeted advertising, he added.

Lynch said China has a desire to dominate the AI race and a national strategy to acquire as much sensitive data from Americans as possible.

Regeneron Pharmaceuticals in May won a bid to purchase most of 23andMe’s assets for $256 million (see 2505190047), but questions remain about whether it must honor the company’s privacy policies (see 2505220055). In Nevada, a genetic privacy bill was drafted in response to the biotechnology company’s bankruptcy, sponsored by Assembly Speaker Steve Yeager (D) (see 2505220032).

“This isn’t just data -- it’s your DNA,” said Oregon Attorney General Dan Rayfield (D) in a press release following the lawsuit Monday. “It’s personal, permanent, and deeply private. People did not submit their personal data to 23andMe thinking their genetic blueprint would later be sold off to the highest bidder."

A 2023 Virginia genetic privacy law “requires a consumer’s explicit consent before a company like 23andMe can transfer their genetic data," Virginia Attorney General Jason Miyares (R) said in a press release Tuesday. “My Office will ensure that Virginians have a say in what happens to their most sensitive personal information.”

In a statement Tuesday, Colorado AG Phil Weiser (D) said, “We are committed to protecting consumers’ privacy and will take action to prevent companies from selling private personal data without consent.” He continued, "The company cannot be allowed, even in bankruptcy, to share that information against the will of consumers.”

In a letter to the DOJ at the end of March, FTC Chairman Andrew Ferguson said 23andMe may sell users’ genetic data, but the company must honor deletion requests (see 2503310057). In response, the DOJ said an ombudsman was needed in the bankruptcy case to protect consumer data (see 2504010060), which dozens of states supported (see 2504160031).