Millions took the opportunity to learn about their shared ancestry through 23andMe. Now they're concerned about that ancestry and more being shared without their permission.
Attorneys general from 27 states and the District of Columbia filed a lawsuit on June 9, 2025, in Missouri, attempting to block the bankruptcy auction of 23andMe until all users give consent to have their DNA samples sold to another company. Won in auction for $256 million by a biotechnology company that uses data from human genetic material to develop new drugs, 23andMe claims the sale is legal and that the protections agreed to by their customers still apply.
Any decision stemming from the suit may set a new precedent on a person's rights concerning their DNA and whether it can be sold without further consent. For over 15 million people who wanted to find out where their ancestors hailed from, losing control of their DNA was more than they signed up for.
It Seemed Like a Good Idea at the Time
The business of determining a person's ancestry launched around 2012 in the United States. Companies like 23andMe and Ancestry offered to tell a person where their ancestors were from through a sample of their spit — and a fee, of course.
The samples contained each person's unique deoxyribonucleic acid, or DNA. Consisting of adenine, guanine, cytosine, and thymine, DNA is a genetic blueprint. It is passed down from generation to generation, making it easy to determine a person's biological family. It's also used to make an identification or rule someone out in civil and criminal cases.
The Fourth Amendment protects the collection of a person's DNA by the government. While a useful tool for law enforcement, which keeps a database of collected samples, DNA must be given with consent, compelled through a warrant or other court order, or obtained from a public location (like a discarded coffee cup).
Legal protections extend to companies like 23andMe, which must safeguard their customers' samples. This resulted in a pending lawsuit filed in 2024 after it was revealed that hackers had accessed 23andMe's files to steal the DNA information of over seven million users, which was later sold online.
Breaking Down the Terms of Service
Those wishing to become customers of 23andMe must agree to the Terms of Service (TOS), which includes giving consent through a click-through agreement. The privacy agreement states that 23andMe does not sell, lease, or rent the DNA of its customers without receiving their explicit consent.
The TOS also states that the DNA data can be transferred in case of a bankruptcy, merger, acquisition, sale of assets, or a reorganization. 23andMe claims that it gives the company the right to be auctioned off as part of a bankruptcy settlement, since users gave their consent.
Therein lies the bone of contention behind the lawsuit. The bankruptcy provision was added to the clause in the TOS on June 8, 2022. Millions of customers had agreed to the TOS before its inclusion. The lawsuit claims that since they didn't sign off on the bankruptcy provision, the auction can't become a finished deal until every customer from before that date gives an updated consent for the sharing of their DNA with a third party.
Regeneron Pharmaceuticals, a biotech company likely to use the data for research, won the auction. This intended use was not addressed under the TOS before June 8, 2022. The lawsuit seeks to hold 23andMe to the letter of their original agreement. Excluding those who refuse to give updated consent would greatly reduce the value to Regeneron, setting the stage for an epic court battle.
Related Resources
- U.S. National DNA Database System (FindLaw's Criminal Law)
- How DNA Evidence Works (FindLaw's Criminal Procedure)
- Business Debt and Bankruptcy (FindLaw's Bankruptcy Law)
