Texas AG challenges 23andMe bankruptcy over genetic data

Texas Attorney General Ken Paxton has taken legal action in the ongoing 23andMe bankruptcy case. The lawsuit filed this week seeks a judgment affirming Texans' rights to genetic data privacy.

23andMe, a genetic testing company, filed for Chapter 11 bankruptcy in a Missouri court in March of this year. The struggling company's co-founder and CEO resigned around the same time as the voluntary filing.

Unlike a Chapter 7 bankruptcy, which is a liquidation process, a Chapter 11 bankruptcy allows the company to sell assets and reorganize while continuing to operate. As part of its bankruptcy case, 23andMe entered an agreement to sell itself and its assets, including the DNA data of its customers, in bankruptcy court.

Paxton claims this is against Texas' data privacy laws.

"Texas’s strong data privacy laws grant consumers property rights to their genetic information and require companies to obtain user consent before sharing any of this highly confidential data," Paxton said in the filing announcement. "Genetic testing companies have access to massive amounts of critically sensitive personal information, and I will fight to ensure that businesses follow the law and secure Texans’ personal data."

Texas is far from the only state taking action against 23andMe. Twenty-seven states and the District of Columbia filed a lawsuit earlier this week against the genetic testing company, arguing that 23andMe needed permission from every customer before their data is potentially sold.

23andMe, launched in 2007, became widely popular for its DNA kits, allowing customers to explore their ancestry and disease risks. Amid bankruptcy proceedings, the company has made assurances that consumers' data will remain protected under new ownership. It is set to be acquired by Regeneron Pharmaceuticals, a biotechnology firm focused on using genetic data to develop new drugs.

Over the past year, Paxton has made frequent use of the Texas Data Privacy and Security Act, taking action against several software companies, including DeepSeek, CapCut and Lemon8, as well as against insurance company Allstate.

The Texas Data Privacy and Security Act went into effect in July and creates transparency and disclosure obligations on the collection of consumer data. Included in this, Texans can request that their data be deleted from companies' databases, including 23andMe.

Texas also has protections directly related to genetic testing companies under the Texas Direct-to-Consumer Genetic Testing Act, which allows Texans to ask that their genetic testing sample or results be destroyed.

How to delete your 23andMe data

For consumers who wish to delete their data from 23andMe's database, here is a straightforward step-by-step guide:

1. Log into your 23andMe account on their website.
2. Go to the "Settings" section on your profile.
3. Select the section labeled "23andMe Data" at the bottom of the page.
4. Click "View"
5. Download your data.
6. Scroll to "Delete Data" section and click "Permanently Delete Data."
7. Confirm your request. Expect an email from 23andMe and follow the link to confirm your deletion request.

If a consumer previously opted to have their saliva sample and DNA stored by 23andMe, they can change that preference under account settings' "Preferences" page. If a consumer consented for their genetic data and sample to be used by 23andMe and third-party researchers, they can withdraw consent under account settings' "Research and Product Consents" page.