Twenty-seven states and the District of Columbia have sued the genetic-testing company 23andMe to oppose the sale of DNA data from its customers without their direct consent.

The suit, filed on Monday in U.S. Bankruptcy Court in the Eastern District of Missouri, argues that 23andMe needs to have permission from each and every customer before their data is potentially sold. The company had entered an agreement to sell itself and its assets in bankruptcy court.

The information for sale “comprises an unprecedented compilation of highly sensitive and immutable personal data of consumers,” according to the lawsuit.

“This isn’t just data — it’s your DNA. It’s personal, permanent and deeply private,” Dan Rayfield, the Oregon attorney general, said in a statement. “People did not submit their personal data to 23andMe thinking their genetic blueprint would later be sold off to the highest bidder.”

The 23andMe company became well known as a genetic-testing service offering kits for customers to discover their ancestry, as well as to learn about their predisposition to certain diseases and traits, according to the company’s website. To submit their tests, customers spit into tubes and send them off by mail. They then receive an analysis of the DNA, which contains ancestry and health reports.

But the DNA company, which at one point in 2021 was valued at $6 billion, ran into financial trouble and filed for bankruptcy in March, with its chief executive officer, Anne Wojcicki, resigning shortly afterward. It is poised to be acquired by Regeneron Pharmaceuticals for $256 million, according to the lawsuit. Regeneron is a biotechnology company that uses genetic data to develop new drugs.