California Attorney General Rob Bonta has filed a lawsuit against genetic testing company 23andMe, seeking to block the sale of millions of customers’ genetic profiles and personal information as part of the company’s bankruptcy proceedings.
The lawsuit argues that genetic information collected from California residents cannot be treated like a traditional business asset and transferred to another company without obtaining fresh consent from customers. State officials contend that DNA data carries unique privacy risks because it contains deeply personal information that cannot be changed if exposed or misused.
23andMe filed for Chapter 11 bankruptcy protection earlier this year after struggling with declining demand for consumer DNA testing kits and mounting financial pressures. As part of the restructuring process, the company has sought buyers for portions of its business, including the extensive database of genetic information collected from millions of users over nearly two decades.
California officials argue that the proposed sale could violate state privacy laws, including the Genetic Information Privacy Act and the California Consumer Privacy Act. According to the complaint, customers provided their DNA samples for testing purposes and did not consent to having their genetic information transferred to unknown future owners through bankruptcy proceedings.
The legal action follows growing public concern over the future of one of the world’s largest consumer genetic databases. Privacy advocates have warned that genetic information differs from ordinary personal data because it can reveal family relationships, health risks, ancestry details, and biological characteristics that remain linked to individuals for life.
The dispute comes less than three years after 23andMe disclosed a major security incident that exposed information belonging to millions of users. In 2023, attackers gained access to customer accounts through credential-stuffing attacks and used account-sharing features to collect profile data from a much larger group of individuals. The breach ultimately affected nearly seven million users and triggered multiple lawsuits and regulatory investigations.
Attorney General Bonta urged Californians to review their accounts and consider deleting stored genetic information if they no longer wish to keep data on the platform. State officials have repeatedly emphasized that consumers retain rights to request deletion of both genetic records and biological samples stored by the company.
23andMe has maintained that any transaction involving customer information would remain subject to applicable privacy laws and court oversight. The company previously stated that protecting customer data remains a priority throughout the bankruptcy process.