Twenty-seven US states and the District of Columbia sue 23andMe to oppose the sale of DNA data from its customers without their direct consent
Rylee Kirk / New York Times :
Context & Ripple Effects
The multistate challenge puts 23andMe’s customer database at the center of its asset-sale process, rather than treating genetic information as an ordinary transferable business asset. It follows years of scrutiny over the company’s handling of sensitive customer information, including its $30M privacy settlement tied to the 2023 breach.
Related coverage also showed 23andMe revising its terms after that breach to constrain customer litigation, a terms-of-service change that sharpened the consent question. The states’ action makes direct permission—not merely past account terms—a live issue in any transfer of the data.
First-order effects
- 23andMe and any prospective buyer face a coordinated legal challenge to a sale of customer DNA data without direct customer consent, adding uncertainty to the transaction process.
- The 27 states and DC seek to establish that customers’ genetic data cannot be transferred through the sale on the terms 23andMe has contemplated.
Second-order effects
- Potential buyers must account for consent-related legal risk and the operational burden of separating, retaining, or transferring genetic records, potentially affecting what the database is worth to them.
- Other consumer-genomics providers face a clearer warning that longstanding concerns about changing terms around DNA data can become acute when ownership changes or a company is distressed.
Third-order effects
- If courts and regulators favor direct consent for ownership transfers, genetic-data businesses may need consent systems designed for a specific successor entity rather than relying on broad, durable terms of service.
- The dispute could help define whether bankruptcy and asset-sale processes can move highly sensitive data as a business asset, or whether data rights remain attached to the individual customer across corporate transitions.
The trend: Consumer genetic data is increasingly being treated as a rights-bound asset whose transfer may require renewed, explicit consent when corporate ownership changes.