In recent years, 23andMe—the renowned direct-to-consumer DNA testing company—found itself at the center of multiple lawsuits stemming from a massive data breach, bankruptcy, and controversial attempts to sell customer genetic information. This article explains how the legal battles began, major case developments, the current situation, and what the outcome could mean for consumers and the genetic testing industry.
23andMe Lawsuit: Background and Data Breach
What is 23andMe?
23andMe became famous for providing affordable at-home DNA kits, giving customers ancestry insights and health reports. By 2023, over 15 million people worldwide had used the company’s testing services, making it one of the largest private genetic databases in existence.
The 2023 Data Breach
In October 2023, 23andMe reported that hackers accessed genetic and personal data from nearly 7 million user accounts using a credential-stuffing attack—exploiting reused passwords from other compromised websites. Information exposed included names, birth years, ancestry origins, and even raw genetic data. Particular ethnic groups, such as Ashkenazi Jewish and Chinese users, were disproportionately targeted, and data later appeared on dark web forums for sale.
The Legal Fallout: Class Actions and Government Intervention
Main Allegations in the 23andMe Lawsuit
- Over 40 class action lawsuits in the U.S. accused 23andMe of failing to safeguard sensitive information and not warning those at highest risk about the breach.
- Plaintiffs stressed the lifelong consequences of losing control over genetic data, demanding substantial damages and stronger consumer protections.
23andMe’s Settlement and Bankruptcy
- In September 2024, 23andMe agreed to a $30 million class action settlement, offering monetary relief and up to three years of free identity and genetic fraud monitoring for those impacted.
- Claimants could receive up to $1,500 for direct losses and up to $500 for undocumented breach-related expenses, with higher compensation possible for “extraordinary claims.”
- Simultaneously, in March 2025, the company filed for Chapter 11 bankruptcy due to mounting legal and financial pressures, jeopardizing its long-term future.
Controversy Over Sale of DNA Data
- As part of its bankruptcy, 23andMe proposed selling its valuable DNA and health data assets to pharmaceutical company Regeneron and later to a nonprofit led by a founder, sparking outrage among privacy advocates.
- Twenty-seven U.S. states and D.C. filed suit in June 2025, seeking to block any data transfer without explicit, informed consent from each affected customer.
- Several states, including California, secured orders pausing any sale, arguing that individuals never authorized the use or sale of their most personal genetic blueprints.
Key Legal Developments and International Actions
- United Kingdom: The UK’s Information Commissioner fined 23andMe £2.31 million for failing to respond swiftly to the breach and not ensuring sufficient data protection.
- Canada: A pending Canadian class action seeks compensation for privacy violations among users in that country.
- Future Oversight: Regardless of bankruptcy, courts are likely to mandate strict oversight and user consent before any future sale, transfer, or new usage of the genetic data.
Implications of the 23andMe Lawsuit
For Consumers
- If you used 23andMe, check whether you were impacted by the 2023 breach. Many users are eligible for cash payments and free monitoring, though deadlines apply.
- Customers in several states and countries may have additional legal rights, including the option to have their data deleted.
For the DNA and Health Tech Industry
- The case stresses the immense responsibility that comes with collecting and storing permanent genetic information.
- It may prompt other companies to tighten security, clarify data consent standards, and expect stronger regulatory scrutiny.
Frequently Asked Questions
Why are U.S. states suing 23andMe?
They want to stop the sale of customer DNA data in bankruptcy unless every individual gives clear, informed consent.
What compensation is available from the class action settlement?
Up to $1,500 for documented losses, $500 for other expenses, and up to three years of free monitoring services for those whose data was exposed.
Is my data still safe with 23andMe?
If you were affected by the breach and notified by the company, your information could still be at risk. New court restrictions may help prevent its sale, but the case isn’t over.
Has 23andMe admitted wrongdoing?
No. The settlement doesn’t require an admission of fault, but the company’s bankruptcy underscores the seriousness of its legal troubles.
Conclusion
The 23andMe lawsuit is a major turning point in the era of personal genetics. As courts, governments, and the public grapple with questions of privacy, consent, and ownership of DNA data, this case will have lasting ripple effects on how companies manage the most personal information possible. Both consumers and businesses are now more aware than ever of what’s at stake when our genetic details are entrusted to third parties.
