Consumers Affected
15,000,000
Connecticut joined a coalition of 28 attorneys general to object to 23andMe's proposed sale of genetic data in bankruptcy without customer consent. The states argue such sensitive information requires express consent and cannot be sold like ordinary property. Attorney General Tong also advised consumers to delete their data and genetic samples.
The states seek to block the auction and ensure genetic data isn't sold without each person's express, informed consent. They also urge consumers to delete their data.
In-house legal teams should review contracts for clauses related to the sale of personal data in bankruptcy proceedings, especially regarding sensitive biometric and genetic information. Ensure contracts require explicit consent for data sharing and include robust data deletion and security provisions. Check compliance with state privacy laws like CTDPA regarding opt-out rights and consent revocation.
Entity
23andMe
Industry
HealthcareOfficial Press Release
https://portal.ct.gov/ag/press-releases/2025-press-releases/connecticut-enters-multistate-legal-fight-to-protect-genetic-information
dkt 1 complaint.pdf?rev=bd0e772efb5c4483ad99f2103f412118&has
https://portal.ct.gov/-/media/ag/press_releases/2025/dkt-1-complaint.pdf?rev=bd0e772efb5c4483ad99f2103f412118&hash=ACDEE0B38AECC98AE7EDA0BABF160004
dkt 687 multistate objection.pdf?rev=b95142cc8f8a4f0f809d4a4
https://portal.ct.gov/-/media/ag/press_releases/2025/dkt-687-multistate-objection.pdf?rev=b95142cc8f8a4f0f809d4a440142d9a2&hash=ACDE4C57BE1F477B7850074CF3E92CE1
Connecticut Attorney General Enforcement Page
https://portal.ct.gov/AG/Privacy/Privacy-Resources
"23andMe, a popular direct-to-consumer DNA testing company"
"auctioning off the private genetic data of roughly 15 million customers to the highest bidder without customers’ knowledge or consent"
"Under the CTDPA, Connecticut consumers have the right to access, obtain, correct, and delete personal data collected about them under certain circumstances."
"roughly 15 million customers"
"23andMe collected the most sensitive genetic data imaginable from millions of Americans. They failed to safeguard that data, and now they propose to auction it to the highest bidder, with no security or privacy assurances."
$663K
Attorney General Jay Jones joined 42 attorneys general in a multistate settlement with 23andMe's bankruptcy trustee over a 2023 data breach that compromised genetic data of nearly 7 million customers. The settlement includes $150 million in allowed claims, with immediate recovery of $18 million from bankruptcy funds, of which Virginia receives $662,649. The settlement also requires enhanced data security measures and consumer protections for the new entity, 23andMe Research Institute.
$150.0M
Texas Attorney General Ken Paxton secured a $150 million multistate settlement against 23andMe following a 2023 data breach that exposed genetic and personal data of 6.9 million consumers. The settlement resolves bankruptcy claims and requires enhanced data security, risk assessments, and an independent advisory board, with immediate recovery of $18 million from bankruptcy funds.
$18.0M
New York Attorney General Letitia James and a bipartisan coalition of 42 other attorneys general secured an $18 million settlement from genetic testing company 23andMe for failing to protect customers' private genetic data. The October 2023 data breach exposed sensitive genetic information of 6.9 million consumers, including 305,245 in New York, with some data published for sale on the dark web. The settlement includes monetary penalties and new data protection requirements for the company and its successor, 23andMe Research Institute.
$18.0M
Attorney General William Tong led a coalition of 42 attorneys general in a settlement with the bankruptcy trustee for 23andMe, resolving allegations from a 2023 data breach that compromised the genetic data of 6.9 million customers. The settlement includes $150 million in allowed claims, with $18 million paid from bankruptcy funds, and requires enhanced data security measures for the new entity holding the data.
$18.0M
A coalition of 42 state attorneys general settled bankruptcy claims against 23andMe following a 2023 data breach that compromised genetic data of 6.9 million customers. The settlement includes $150 million in allowed claims, with $18 million paid from bankruptcy funds, and requires enhanced data security measures for the successor entity, 23andMe Research Institute.
Connecticut Attorney General William Tong submitted testimony in support of genetic privacy legislation that would grant residents exclusive control over their DNA and genetic data. The legislation is inspired by his office's investigation into 23andMe's data breach affecting over six million customers and the company's subsequent bankruptcy. The bill requires express consent for DNA use, imposes security measures, and prohibits marketing use of DNA.