23andMe, a leading direct-to-consumer genetic testing company, has been embroiled in significant legal challenges primarily related to data breaches, privacy concerns, and the protection of sensitive genetic information. The lawsuits focus on allegations that 23andMe failed to adequately safeguard customer data and attempted to sell or transfer this highly personal information without explicit consent during bankruptcy proceedings in 2025. These cases highlight pressing issues about consumer privacy, corporate transparency, and regulatory compliance in the growing genetic testing industry.
Background of the 23andMe Lawsuit
In October 2023, 23andMe suffered a data breach compromising the personal information of nearly 7 million customers, including genetic data, health reports, and raw DNA data. Following the breach, affected consumers filed a class-action lawsuit accusing the company of failing to protect their sensitive information. In 2024, 23andMe agreed to a $30 million settlement to resolve these claims in states with rigorous genetic privacy laws.
In March 2025, facing financial difficulties, 23andMe filed for Chapter 11 bankruptcy and announced plans to sell its business assets, including the vast repository of customer genetic data. This triggered new lawsuits from a coalition of 27 states and the District of Columbia, aiming to block the sale or require explicit customer consent, arguing that DNA and health data are too sensitive to be sold as ordinary assets.
Parties Involved
Plaintiffs include individual consumers affected by the data breach and a bipartisan coalition of state attorneys general led by New York Attorney General Letitia James. Defendants comprise 23andMe, its affiliates, and potential buyers of its genetic data assets, such as pharmaceutical and biotechnology firms.
Details of Allegations and Claims
The lawsuits allege that 23andMe:
- Failed to implement sufficient cybersecurity measures, leading to a massive data breach.
- Unilaterally sought to sell customers’ genetic and health data without obtaining explicit informed consent.
- Violated state and federal consumer protection and genetic privacy laws protecting sensitive biological information.
- Misled customers regarding the use and ownership of their genetic data.
- Impaired customer rights to control, limit, or delete their personal genetic information.
Legal Claims and Relevant Laws Involved
Key legal frameworks implicated include:
- Genetic Privacy Laws: State statutes such as those in California, Oregon, and Illinois providing statutory damages for unauthorized use of genetic information.
- Consumer Protection Laws: Federal and state laws forbidding deceptive practices and protecting personal data privacy.
- Data Breach Notification Laws: Mandating timely disclosures and mitigation efforts for compromised data.
- Bankruptcy Law: Governing the sale and transfer of assets within the Chapter 11 restructuring process, including sensitive data.
Health, Financial, Social, and Industry Impacts
Managing genetic data breaches presents significant health and psychological impacts, including risks of identity theft, discrimination, and loss of privacy. Financial impacts encompass legal liabilities, settlement costs, and diminished consumer trust. The industry faces heightened scrutiny to enhance security, transparency, and ethical management of genetic information, particularly amid emerging government regulations.
Current Status and Developments
As of mid-2025, the data breach class action has reached settlement with compensation available to affected consumers until July 14, 2025. Meanwhile, multi-state lawsuits continue in bankruptcy court to prevent or regulate the sale of genetic data assets, with independent consumer privacy ombudsmen appointed to advise on data protection measures. 23andMe’s bankruptcy sale process is ongoing, with potential buyers required to adhere to strict privacy safeguards.
Consumer Advice and Recommendations
Consumers who have used 23andMe are encouraged to:
- Monitor credit reports and financial accounts for suspicious activities.
- File claims for damages if notified of eligibility.
- Contact 23andMe to request deletion of genetic data where possible.
- Stay informed about legal developments affecting privacy rights and data sales.
Conclusion: Significance and Future Outlook
The 23andMe lawsuit underscores critical challenges at the intersection of biotechnology, consumer privacy, and law. As genetic testing continues to expand, protecting individuals’ deeply personal data becomes paramount. The legal battles involving 23andMe will shape future industry standards, regulatory policies, and consumer protections for genetic and health information globally.
