State AGs sue 23andMe over auction, say don’t sell customer DNA

More than two dozen states are suing the genetic testing company 23andMe over its proposed bankruptcy sale, stating customers did not sign up to have their DNA sold to the highest bidder. The bipartisan attorneys general argue that customers should have control over their personal information and that it cannot be sold like ordinary property.

“This isn’t just data – it’s your DNA. It’s personal, permanent, and deeply private,” Oregon Attorney General Dan Rayfield stated. 

The company holds biological samples, DNA data, health-related traits and medical records for approximately 15 million customers worldwide.

What will happen to the private information?

There are two bidders – Regeneron, a biotech company, and the nonprofit medical research organization TTAM Research Institute. They are both American enterprises, and both agreed to keep the current privacy and consent policies in place. 

“Not only did they say they’re not going to change anything. They also agreed to that in their contract, which is an asset purchase agreement, in writing,” 23andMe Interim CEO Joseph Selsavage told Congress Tuesday. 

The company says it has the following principles: 

• Never share individual-level data without the user’s consent.
• Clearly communicate how data is used and give customers control over their data-sharing preferences. 
• Use industry-standard encryption, access controls and monitoring systems to protect data.
• Personal information and genetic data are stored separately to protect identity. 

“All of your personal information, meaning your name, your address, your email, was in a separate database, that was stored separately, that very few people could connect it then with the genetic information,” Founder and Board Member Anne Wojcicki stated. “Few people in the company could put that key together.”   

Selsavage said genetic data storage is both digital and physical, all of which can be deleted or destroyed at a customer’s request. 

System is not perfect

In 2019, the Pentagon instructed all service members not to use consumer DNA kits, as sharing personal, sensitive genetic information with outside parties poses both personal and operational risks. It also warned that some results could be inaccurate, which could create problems for military members who are required to report medical issues. 

In October 2023, it was revealed that 23andMe experienced a cyber attack that affected approximately 7 million customers. An investigation revealed that it was a credential stuffing campaign in which scammers obtained usernames and passwords on the dark web and attempted to use them on multiple sites, hoping that people use the same email and password across various accounts.

Concerns raised

Now, there are concerns that the data could fall into the hands of a foreign adversary, particularly China.

“I do not believe that anyone in this bankruptcy process should have a Chinese tie,” Wojcicki said. 

WuXi Healthcare Ventures, a Chinese company, invested $10 million in 23andMe in 2015. Regeneron has close ties with multiple Chinese companies with which it has exclusive licensing deals for medical products. 

“I am concerned about China and how China is leading in biotechnology. And I am concerned that China has been super clear that they would like to have the most genetic information, they would like to lead,” Wojcicki said. 

What happens next?

There will be another round of bidding in the coming days, and a sale hearing is set in bankruptcy court for June 17.