A coalition of 27 states and the District of Columbia is suing a bankrupt genetic testing firm, 23andMe, to block the sale of individuals’ sensitive genetic information without permission from each of its roughly 15 million customers.

California-based 23andMe specializes in the collection of human genetic data through the sale of at-home tests that can be used to determine ancestry information, descent, and the presence of risk factors for certain diseases.

The company also asks users to input information about their relatives, who may or may not be 23andMe users, according to a lawsuit filed in the U.S. Bankruptcy Court in the Eastern District of Missouri.

The company is selling itself and its user data as part of the bankruptcy process. The suit calls the data “an unprecedented compilation of highly sensitive” information about customers’ permanent and everlasting genetic identity.

23andMe keeps records of its customers’ raw genetic information to provide insights about an individual’s ancestry, including the likely regions of origin of forebears.

“If stolen or misused, it cannot be changed or replaced,” the suit states. “Furthermore, this data is exclusively personal and unique, representing that customer’s identity and no other human being.”

The suit warns that the data can be used to identify and track those who are related to the 23andMe consumer — including future generations yet unborn.

“The magnitude of the data in this proposed sale stretches far beyond the 23andMe consumers, impacting those who have no awareness of the sale as well as humans who do not even exist yet,” the suit claims.

A big issue is that genetic data could remain in existence and subject to use — ranging from research to cloning — long after future generations of the customer have passed away.

23andMe says the suit is without merit and it will address the arguments made by the attorneys general at the sale hearing in bankruptcy court.

“The sale is permitted under 23andMe privacy policies and applicable law,” a company representative says in an email to the Sun. “We required any bidder to adopt our policies and comply with applicable law as a condition of participating in our sales process. Customers will continue to have the same rights and protections in the hands of the winning bidder.”

The company says the remaining bidders for its assets are American companies that will continue to operate 23andMe under the existing privacy policy.

Senator Grassley doesn’t buy that promise. The Senate Judiciary Committee, which Mr. Grassley leads, questioned the interim CEO of 23andMe, Joseph Selsavage, on Wednesday. Mr. Selsavage told the committee fears about the data are unfounded because customers already have the ability to delete their genetic information under its privacy policies.

“It’s a simple process. All they have to do is log into their account at 23andMe and go to their settings, and request that their account be deleted,” Mr. Selsavage said. But he admitted that there is nothing that prevents anyone who buys the company from changing the privacy policy at a later date.

Mr. Grassley has introduced legislation designed to safeguard consumers’ sensitive genetic data during corporate bankruptcy proceedings. The “Don’t Sell My DNA Act” would require written notice and consumer consent prior to the use, sale, or lease of genetic information as part of a bankruptcy sale.

A deputy dean of the Harvard Law School, Glenn Cohen, supports Mr. Grassley’s proposal. “While I think it would be nice for the creditors to get paid,” Mr. Cohen says, “this information is so sensitive and so important it’s really important to protect people’s information.”

A BYU Law School professor and bankruptcy expert, Brook Gotberg, warns that the proposed act doesn’t go far enough. She notes that the company could simply sell the information outside of the bankruptcy proceeding. Ms. Gotberg says Congress needs to pass a law to universally protect personal DNA data from being sold.

23andMe has previously had issues with data security. In 2023, an attacker gained access to the data of thousands of user accounts. The company said it did not suffer a data security incident and claimed the attacker used “credential stuffing” — a tactic in which attackers use the user names and passwords that customers had reused from other sites that had suffered data breaches.

The company faced a class action in January 2024 claiming it did not protect user data of 6.9 million customers or notify customers with Chinese or Ashkenazi Jewish ancestry that they had been targeted specifically by the attack, CNET reports.

The company settled the suit for $30 million and is now starting to allow customers to file claims for their shares of the settlement.