GRAND JUNCTION, Colo. (KJCT) — Colorado is among 29 states taking legal action against embattled DNA testing company 23andMe, after revelations emerged that the bankrupt firm intends to sell off sensitive genetic and health data from approximately 15 million users as part of its asset liquidation process.

Bankruptcy Fallout: Genetic Data Up for Grabs

Once a leader in the direct-to-consumer genetic testing boom, 23andMe filed for Chapter 11 bankruptcy earlier this year amid mounting legal, financial, and data security challenges. Now, in a controversial move, the company is planning to auction off user data—including detailed personal information about individuals’ ancestry, health predispositions, and familial connections.

Colorado Attorney General Phil Weiser called the move both unethical and unlawful.

“When you give that information, you’re not thinking it’s getting auctioned off to the highest bidder,” Weiser said. “But now that the company is in bankruptcy, that’s what they plan to do. That’s not okay. That’s illegal.”

Privacy in the Crosshairs

The lawsuit, spearheaded by attorneys general from multiple states, alleges that 23andMe is violating state consumer protection and data privacy laws by attempting to offload genetic profiles to external buyers. The concern is that deeply sensitive DNA and health data could fall into the hands of insurers, pharmaceutical companies, or marketing firms, potentially resulting in discrimination or unauthorized use.

Privacy experts say the case could set a precedent for how biometric and genetic data is handled in future bankruptcies.

“Your DNA is the most personal data you can give,” said a Colorado legal expert not involved in the case. “It doesn’t just identify you—it implicates your children, your siblings, your parents. Selling that kind of information shouldn’t even be on the table.”

23andMe Responds: “No Cause for Alarm”

In a statement provided to KJCT News 8, a spokesperson for 23andMe dismissed the states’ legal concerns, stating:

“Customers will continue to have the same rights and protections in the hands of the winning bidder. Both remaining bidders are U.S. companies, have committed to abide by 23andMe’s privacy policies, and will continue to operate 23andMe as it has always been operated.”

Despite this reassurance, critics argue that corporate privacy policies can be modified, and bankruptcy proceedings often give wide latitude to debtors to restructure or liquidate core assets—including, in this case, genetic databases.

What’s at Stake?

• 15 million users’ data: Including names, family connections, genetic markers, disease risk assessments, and wellness reports.

• Potential misuse: Data could be mined for targeted advertising, insurance risk profiling, or pharmaceutical development without consent.

• Legal precedent: The case could redefine how personal biological data is treated during financial collapse.

Users in the Dark

Many current and former 23andMe users say they weren’t aware their information could become a bargaining chip in a bankruptcy court.

“I trusted them with my DNA,” said a former customer in Boulder. “I would’ve never signed up if I thought that someday it might end up in the hands of a private equity firm.”

Social media platforms are already filled with users asking how to delete their data or revoke consent, but it’s unclear whether that’s still possible under bankruptcy law.

Looking Ahead

While the case unfolds, the sale of 23andMe’s assets—including its massive DNA database—has not yet been finalized. Two U.S.-based bidders are reportedly in the final stages of the auction, and both have promised to uphold existing privacy terms. Still, states like Colorado are pushing for stricter safeguards, user notification requirements, and even possible deletion of data upon request.

As AG Weiser puts it, “This is about more than one company. It’s about how we protect people’s most intimate information in the digital age.”