More than two dozen states have sued 23andMe to block the sale of genetic data without customers' permission.