Connecticut Sues 23andMe Over Plans to Auction Off DNA Data of Millions of Residents

In a groundbreaking case with massive privacy implications, Connecticut Attorney General William Tong has announced that the state is joining 27 others in a legal battle to stop DNA-testing company 23andMe from auctioning off the personal genetic data of its customers in bankruptcy court. The legal complaint and objection, filed on June 9, 2025, aim to prevent the company—currently undergoing Chapter 11 proceedings—from treating people’s genetic profiles as saleable corporate assets.

What’s Happening?

23andMe, once a dominant player in the consumer DNA-testing market, filed for bankruptcy earlier this year. As part of its restructuring plan, the company is now trying to auction off its assets—including the DNA data of over 15 million people, possibly without those individuals’ knowledge or consent.

Connecticut, along with attorneys general from states including New York, California, Florida, and Minnesota, argues that genetic material is not just another commodity. The data in question includes raw DNA sequences, family tree data, health traits, and even sensitive medical records—deeply personal and largely immutable information that touches not only individuals but their families and future generations.

What’s at Stake?

According to the legal filings from Connecticut and the coalition, the concern is threefold:

1. Privacy Violations: Genetic information, once sold, is permanent. You can’t change your DNA. Selling it to unknown third parties—potentially without direct consent—creates a host of risks ranging from identity theft to discriminatory misuse.
2. Breach of Trust: 23andMe’s own privacy statements promised consumers that their data would not be sold without “explicit consent.” Changing those terms midstream, especially during bankruptcy, would constitute a betrayal of consumer expectations.
3. Legal Precedent: This case could set a dangerous precedent. If companies can auction off deeply sensitive health data during bankruptcy, other firms in financial distress might do the same.

What’s Connecticut’s Legal Argument?

Connecticut’s stance is grounded in both state law and federal bankruptcy principles. Under the Connecticut Data Privacy Act (CTDPA), consumers have explicit rights to access, correct, delete, and opt out of the sale of their personal data. More importantly, under federal bankruptcy law (11 U.S.C. §§ 363, 541), a debtor can only sell assets it lawfully owns—and in this case, Connecticut argues that 23andMe doesn’t “own” the right to sell your DNA data without your express, informed, affirmative consent.

The joint complaint, supported by court documents, emphasizes that:

• The human genome is immutable and inherently personal. If stolen or misused, it cannot be “reissued” like a credit card.
• Selling one person’s genome compromises others—relatives, even unborn descendants, could be identified and tracked through this data.
• State laws in places like Florida, Texas, Minnesota, and Arizona already require express consent before such data can be transferred. Thus, even in bankruptcy, 23andMe would be violating state privacy statutes by selling this data without explicit user approval.

Legal Analysis

From a bankruptcy law perspective, this case hinges on the tension between federal and state authority. While the Bankruptcy Code allows the liquidation of a debtor’s assets, it does not override state-level consumer protection laws. Courts have long held that the estate inherits assets with the same limitations that applied pre-bankruptcy. If 23andMe could not legally sell a customer’s genome before filing for Chapter 11, then they can’t suddenly sell it just because they’re insolvent.

The coalition of AGs is also seeking declaratory judgment—asking the bankruptcy court to formally state that 23andMe lacks legal ownership or sufficient rights to unilaterally transfer genetic data. This would halt the sale before it can proceed and clarify the broader issue of how consumer genetic data is treated in bankruptcy scenarios.

What Can Consumers Do Right Now?

AG Tong and others are urging consumers to take immediate steps to protect themselves:

How to Delete Your 23andMe Data

1. Log in at 23andMe.com
2. Navigate to Settings
3. Scroll to “23andMe Data”
4. Click “View,” then select “Download Data” (optional)
5. Scroll to “Delete Data” and click “Permanently Delete Data”
6. Confirm your deletion request via email

How to Revoke Consent or Destroy DNA Samples

• Go to Preferences in your account to request destruction of your DNA sample
• Under “Research and Product Consents,” withdraw any prior permissions given to 23andMe or third-party researchers

As of June 2025, more than 1.9 million users have already deleted their data since the bankruptcy was filed.

Final Thoughts

This legal action is not just about one company—it’s about setting boundaries in an era where personal data has become currency. If states like Connecticut succeed, it could reshape how genetic data is treated not just in bankruptcy court, but across the entire tech and health industry landscape.

The battle over your DNA is on. And for once, the law might be catching up with the science.

IF YOU NEED A LAWYER CONTACT US