PORTLAND, Ore. — Twenty-seven states and the District of Columbia on Monday filed a lawsuit in bankruptcy court seeking to block the sale of personal genetic data by 23andMe without customer consent. The lawsuit comes as a biotechnology company seeks the court’s approval to buy the struggling firm.

Biological samples, DNA data, health-related traits and medical records are too sensitive to be sold without each person’s express, informed consent, Oregon Attorney General Dan Rayfield said in a news release about the lawsuit. Customers should have the right to control such deeply personal information and it cannot be sold like ordinary property, it said.

23andMe customers use saliva-based DNA testing kits to learn about their ancestry and find long-lost relatives. Founded in 2006, the company also conducted health research and drug development. But it struggled to find a profitable business model since going public in 2021. In March it laid off 40% of its staff and filed for Chapter 11 bankruptcy protection in the Eastern District of Missouri, raising concerns about the safety of customer data.

Regeneron Pharmaceuticals said last month it aimed to buy the company for $256 million. Regeneron said it would comply with 23andMe’s privacy policies and applicable law. It said it would process all customer personal data in accordance with the consents, privacy policies and statements, terms of service, and notices currently in effect and have security controls in place designed to protect such data.

A court-appointed, independent consumer privacy ombudsman was due to examine the proposed sale and how it might affect consumer privacy and report to the court by Tuesday.