Utah, 26 other states file suit against 23andMe over sale of genetic data without consumer consent

SALT LAKE CITY — The state of Utah, in partnership with 26 other states and the District of Columbia, filed a lawsuit Monday against the genetic testing company 23andMe.

The suit argues that no company should have the agency to sell such “highly personal” genetic data, including biological samples and DNA, without the person’s express consent. The possibility of a data transfer came after the company filed for Chapter 11 bankruptcy in March, though it did not know yet what the future would look like.

In bankruptcy hearings that followed, the company began exploring the sale of its data, taken from millions of Americans, to the “highest bidder,” according to the Utah Attorney General’s Office.

“Genetic material is incredibly sensitive and personal – nobody should be allowed to auction this immutable and identifying information off to the highest bidder,” said Consumer Protection Deputy Douglas Crapo. “Utahns have the right to control this deeply private information and did not expect it to be sold. We are committed to protecting Utahns’ rights and personal data.”

The lawsuit called out that if the data in question were misused or stolen, it could not be changed or replaced. To further spell out the weight of the data the company possesses, it called out the threat it poses for those who were not even consumers of the company, but had family members who were.

“This data can be used to identify and track those who are related to the 23andMe consumer – including future generations yet unborn,” it states. “In other words, the magnitude of the data in this proposed sale stretches far beyond the 23andMe consumers, impacting those who have no awareness of the sale as well as humans who do not even exist yet.”

Katie Hass, director of the Utah Division of Consumer Protection, called the company’s move an “egregious betrayal” of the consumer’s trust.

“Every consumer should have the right to decide how this intimate, personal, and unique data is handled going forward,” she said.

Consumer protection officials previously warned Utahns about 23andMe

The division previously warned Utahns to act quickly and delete their data from the 23andMe database — the only other option the company offered its consumers.

Hass stated that Utahns in particular used the service heavily, and she advised them to save confirmation emails from the company after their DNA removal was complete, in case the company made a mistake.

The company’s Board Chair, Mark Jensen, stated at the time of bankruptcy in March that the transfer of data would be an “important consideration in any potential transaction.”

Other than Utah, the states listed as plaintiffs in the lawsuit included: Arizona, Colorado, Connecticut, the District of Columbia, Florida, Illinois, Kansas, Kentucky, Louisiana, Maine, Michigan, Minnesota, Missouri, New Hampshire, New Mexico, New York, North Carolina, Oklahoma, Oregon, Pennsylvania, South Carolina, South Dakota, Vermont, Virginia, Washington, West Virginia, and Wisconsin.