United States of America: US states and DC filed lawsuit against 23andMe over its alleged failure to obtain consent for data sale

On 9 June 2025, twenty-seven US states and the District of Columbia filed a complaint in the United States Bankruptcy Court for the Eastern District of Missouri against 23andMe Holding Co. and 23andMe Inc. The complaint seeks a declaratory judgment regarding the validity and extent of 23andMe's interest in customers' genetic material and related data. It challenges whether the companies possess sufficient rights to sell and transfer customers' biological material, genotype data (DNA code and genome sequences), profile data (names, dates of birth, birth sex, gender, contact information), family tree data, and phenotype data (observable characteristics and health information) to third parties without obtaining express and informed consent from each customer. The states assert that customers maintain inherent common law rights of ownership or control in their biological material and genetic information, and that state criminal statutes and genetic data privacy statutes require express, informed, affirmative consent prior to sale or transfer. The complaint further contends that 23andMe must honour its privacy webpage representations assuring customers that genetic data will not be shared without explicit consent, particularly for customers who signed up prior to 8 June 2022 when the company's privacy policy explicitly stated it would not sell individual-level information without explicit consent.