‘Deeply private’: Oregon AG challenges potential sale of 23andMe users’ personal data

PORTLAND, Ore. (KOIN) — Oregon is among several states taking legal action against a biotechnology company that could sell customer’s personal information amid financial woes.

Attorney General Dan Rayfield has revealed that Oregon, along with 27 other states, has sued 23andMe in an effort to challenge the potential sale of user data. The California-based genetic testing company filed for Chapter 11 bankruptcy in late March, around the same time that co-founder and CEO Anne Wojcicki announced her resignation after nearly 19 years in the role.

23andMe is now hoping a buyer will acquire the company — along with the “sensitive” health and genetic data in its possession.

“This isn’t just data — it’s your DNA,” Rayfield said in a release. “It’s personal, permanent, and deeply private. People did not submit their personal data to 23andMe thinking their genetic blueprint would later be sold off to the highest bidder. We’re standing up in court to make sure Oregonians — and millions of others — keep the right to control their own genetic information.”

Following the bankruptcy filing, the attorney general’s office issued a consumer alert informing Oregonians that they could withdraw their consent and delete their data from the platform. But the new lawsuit claims a potential could still impact around 15 million customers.

The Associated Press has reported 23andMe only recently reached a settlement involving a massive data breach. In 2023, the company revealed that hackers had stolen the personal information of nearly seven million users — including 5.5 million people who used the DNA Relatives feature and another 1.4 million people who had created family tree profiles.

But in a statement to KOIN 6 on Wednesday, 23andMe claimed arguments in the new lawsuit are “without merit.” A company spokesperson said the potential sale is permitted and the potential buyers are required to adopt its policies.

“Customers will continue to have the same rights and protections in the hands of the winning bidder,” the spokesperson added in an email. “Both remaining bidders are US companies, have committed to abide by 23andMe privacy policies, and will continue to operate 23andMe as it has always been operated.”

The U.S. Bankruptcy Court is slated to hear arguments for the objection of the sale on June 17.