Barone v. Tempus AI Alleges Genetic Data Was Monetized Without Consent After the $600 Million Ambry Deal
Plaintiffs Lauren Barone, Eugenia Rukhin, and Stephanie Bianco have filed a class action complaint against Tempus AI, Inc. and AstraZeneca PLC in the United States District Court for the Northern District of Illinois. The lawsuit, captioned Barone et al. v. Tempus AI, Inc. et al., Case No 1:26-cv-03516. 1:26-cv-03516, was filed on March 30, 2026. The plaintiffs allege that Tempus AI and AstraZeneca unlawfully disclosed genetic information without proper authorization, in violation of state privacy laws.
The complaint against Tempus AI centers on accusations that the company utilized genetic data obtained from Ambry Genetics, a subsidiary it acquired, without notifying or obtaining consent from the individuals whose data it gathered. The plaintiffs claim that Tempus AI built a substantial data library by acquiring sensitive genetic and health information from millions of patients. The agreement with AstraZeneca specifically is a major part of the complaint, containing allegations of a $200 million deal that provided AstraZeneca with access to a significant volume of sensitive genetic data (¶93).
The plaintiffs assert that AstraZeneca played a significant role in these alleged violations by entering into a $200 million data licensing agreement with Tempus AI, effectively aiding and abetting the unauthorized data disclosures (¶52). The lawsuit highlights the inherently sensitive nature of genetic information, emphasizing that even de-identified data can often be re-identified, posing risks to individual privacy. The complaint charges that the defendants prioritized commercial gain over the legal obligation to protect patient privacy, and seeks statutory damages along with injunctive relief and class certification on behalf of those affected.
These
Alleged Unauthorized Disclosure Mechanism
The complaint filed in Barone v. Tempus AI, Inc. alleges that Tempus AI systematically acquired and monetized sensitive genetic and health data without obtaining patient consent. According to the filing, Tempus AI utilized its acquisition of Ambry Genetics, completed in February 2025 for $600 million, as a strategic pivot point. This acquisition provided Tempus AI with expansive access to Ambry's repository of genetic testing data, including identifiable patient information critical to Tempus AI’s operations (¶6).
Among the allegations, the plaintiffs assert that Tempus AI and Ambry Genetics did not notify patients about the transfer of their genetic data to Tempus AI. This alleged failure to communicate is significant given the sensitive nature of the data involved. The filing claims that affected individuals were not provided with the opportunity to opt out of this data transfer, further underscoring the complaint’s allegations of privacy violations (¶26, ¶33).
The legal implications center on claims under state genetic privacy laws, including the Illinois Genetic Information Privacy Act. Plaintiffs argue that Tempus AI's monetization efforts, without adequate patient notification and consent, fall afoul of these statutory mandates designed to protect genetic privacy (¶66).
The allegations highlight the critical intersection of technology, patient privacy, and the law, questioning the balance of commercial interests with statutory privacy protections. This class action seeks to address what the plaintiffs describe as a systemic breach of privacy obligations by Tempus AI and its strategic partner Ambry Genetics.
As the case progresses, these allegations remain unproven, with the defendants yet to file formal responses to these claims.
Monetization through Pharmaceutical Licensing
The complaint alleges that Tempus AI, Inc. engaged in monetizing its extensive genetic data repository through strategic licensing agreements with pharmaceutical companies. A significant transaction occurred in April 2025 when Tempus AI entered into a $200 million data licensing agreement with AstraZeneca. According to the filing, this agreement provided AstraZeneca with access to 300 petabytes of data, which included sensitive genetic information from patients tested by Ambry Genetics (¶93).
Tempus AI's business model, as described in the complaint, involves the licensing of 'de-identified' clinical and genetic data to pharmaceutical companies. This data is reportedly used to develop new drugs and therapies, leveraging Tempus AI's AI and multimodal data capabilities. The plaintiffs argue, however, that despite claims of de-identification, the genetic data remains identifiable and its significance could be exploited without appropriate privacy protections (¶13, ¶67).
The plaintiffs further assert that Tempus AI prioritized generating revenue over maintaining the confidentiality and privacy of patients' genetic information. This was reportedly achieved by disclosing data to third-party companies for commercial gain without obtaining the necessary patient consent or providing individuals with the opportunity to opt out of such disclosures. The complaint emphasizes the financial incentives underlying these agreements, pointing to the $200 million payment and additional financial means provided by AstraZeneca that, according to plaintiffs, encouraged Tempus AI’s continuation of these alleged practices (¶241).
The plaintiffs seek to hold Tempus AI and AstraZeneca accountable for these alleged breaches, contending that the agreements violated state privacy laws, including the Illinois Genetic Information Privacy Act and the California Confidentiality of Medical Information Act. The complaint requests statutory damages, which under GIPA can range from $2,500 to $15,000 per violation (¶66), injunctive relief, and other remedies for the alleged unauthorized use and disclosure of genetic information (¶198). These allegations remain unproven, with no official response from the defendants at this stage.
Parties and Their Roles
The class action complaint filed in the United States District Court for the Northern District of Illinois involves several key parties. The plaintiffs in the case, Barone et al. v. Tempus AI, Inc., are Lauren Barone, Eugenia Rukhin, Stephanie Bianco, and Bianco's minor child, H.B. The complaint alleges that these individuals suffered violations of their privacy rights through the unauthorized use and disclosure of their genetic data.
The defendants in this lawsuit comprise two primary entities: Tempus AI, Inc. and various AstraZeneca entities. Tempus AI is a healthcare technology company headquartered in Chicago, Illinois, specializing in artificial intelligence-driven precision medicine. According to the complaint, Tempus AI built its business model on collecting large sets of sensitive genetic and health data without obtaining proper consent from the individuals involved. The company is accused of using this data to enhance its multimodal data library, which it licenses to pharmaceutical companies for drug development purposes.
AstraZeneca is described in the complaint as a multinational pharmaceutical conglomerate, whose involvement with Tempus AI stems from strategic data agreements, including the notable $200 million deal finalized in April 2025 (¶93). Reportedly, this agreement provided AstraZeneca with access to extensive genetic data resources, which the company allegedly used to advance its drug development efforts. The complaint contends that AstraZeneca aided and abetted the wrongful conduct attributed to Tempus AI by financially investing in Tempus AI’s data infrastructure and entering into lucrative agreements to leverage the acquired data (¶68).
The plaintiffs claim they did not receive appropriate notifications or opportunities to opt out of the data sharing practices pursued by Tempus AI, leading to significant breaches of privacy. Thus, they seek relief under various state privacy laws, including the Illinois Genetic Information Privacy Act and the California Confidentiality of Medical Information Act.
These
Claims Against Tempus AI (Counts I-IV)
The complaint in Barone v. Tempus AI, Inc. includes several serious allegations against Tempus AI, centered on privacy violations related to genetic information. Count I focuses on alleged breaches of the Illinois Genetic Information Privacy Act (GIPA), which specifically prohibits the unlawful disclosure of identifiable genetic information without written authorization (¶66). According to the complaint, Tempus AI failed to maintain the confidentiality of such information, which they disclosed without obtaining the requisite written consent from those tested (¶166, ¶170).
Count II claims Tempus AI unlawfully violated the California Confidentiality of Medical Information Act (CMIA) by disclosing private health information without proper authorization (¶146(b)). The plaintiffs argue this breach occurred systematically as Tempus AI transmitted private health data to third parties, again without securing the necessary written permissions (¶176).
In Count III, Tempus AI is accused of violating the California Unfair Competition Law (UCL) (¶198). This claim asserts that Tempus AI engaged in unlawful, unfair, or fraudulent business practices, whereby the deception and unauthorized use of genetic data allegedly misled consumers about the privacy and security of their personal health information.
Finally, Count IV addresses allegations of a breach of New York General Business Law § 349. The plaintiffs contend that Tempus AI’s actions constitute deceptive acts or practices in conducting their business (¶190). This is significant since damages under this statute carry a minimum of $50 per violation (¶198). The plaintiff alleges the artificial perpetuation of consumer misconceptions regarding the safety and unauthorized sharing of genetic information, which New York law deems unlawful.
The plaintiffs seek remedies that include statutory damages, due to what they describe as intentionally reckless or negligent privacy breaches, and injunctive relief to prevent further unauthorized disclosures of genetic information. None of these claims have been proven, and no response from the defendants has been recorded in the court docket yet.
Claims Against Tempus AI (Counts V-VIII) and AstraZeneca (Count IX)
The plaintiffs in Barone v. Tempus AI, Inc. assert several claims against Tempus AI in addition to engaging AstraZeneca under an aiding and abetting theory. The fifth cause of action seeks relief for unjust enrichment, arguing that Tempus AI's utilization of the plaintiffs' genetic data for significant commercial gain unjustly enriched the company at the expense of the plaintiffs, who were unaware of and did not consent to the use of their data (¶55).
The sixth claim alleges fraudulent concealment. The plaintiffs argue that Tempus AI deliberately withheld critical information regarding the acquisition of Ambry Genetics, including the significant implications of data transfer to Tempus AI (¶212). This concealment allegedly prevented the plaintiffs from making informed decisions regarding their genetic data, resulting in a loss of privacy and security regarding their personal information.
The seventh cause of action involves a purported violation of the Illinois Uniform Deceptive Trade Practices Act (¶220). According to the plaintiffs, Tempus AI engaged in deceptive practices by failing to maintain the confidentiality and security of the plaintiffs’ genetic information despite providing explicit assurances to the contrary. The complaint further alleges that Tempus AI disclosed genetic testing information to third parties without obtaining the necessary written authorization, as required under state law.
For the eighth claim, the complaint asserts that Tempus AI violated the Illinois Personal Information Protection Act by failing to disclose the transfer of genetic data in "the most expedient time possible" after the acquisition of Ambry Genetics, which allegedly resulted in the unlawful distribution of sensitive genetic information (¶229).
AstraZeneca faces allegations of aiding and abetting these statutory violations under the ninth cause of action. The plaintiffs contend that AstraZeneca was aware of Tempus AI's improper data practices concerning the Genetic Information Privacy Act and California Confidentiality of Medical Information Act requirements. AstraZeneca's financial investments and agreements with Tempus AI allegedly provided both the means and incentive for perpetuating these practices (¶241, ¶242).
The allegations remain unproven at this stage, and no response has yet been filed by the defendants.
Distinctive Allegations and Privacy Concerns
The complaint against Tempus AI, Inc. highlights significant privacy concerns associated with the handling of genetic data. According to the plaintiffs, genetic information is inherently identifiable, with a substantial risk of re-identification even when structurally anonymized. They argue that the genetic data collected by Tempus AI can easily be traced back to individuals, contradicting claims of anonymization (¶104, ¶117). The plaintiffs emphasize that genetic information is uniquely tied to individuals due to its inherent biological markers, which makes complete anonymization nearly impossible under current scientific standards.
Additionally, the plaintiffs contend that Tempus AI has prioritized profit generation over patient privacy protections, allegedly making strategic business decisions that favored commercial gain at the expense of privacy rights. The legal filing points out that Tempus AI's integration and utilization of genetic data were aimed at driving its data licensing business, which saw significant growth percentages, notably a 58% year-over-year increase as driven by such agreements (¶109, ¶243).
Moreover, the complaint references privacy restrictions placed by institutions like the National Institutes of Health (NIH) on access to genetic databases. The NIH limits access to certain controlled genomic collections, reflecting the sensitivity and potential privacy risks associated with genetic data (¶71). This underscores the perception that genetic data requires stringent privacy measures, further highlighting the alleged negligence by Tempus AI in failing to adopt robust anonymization techniques and sufficient privacy safeguards.
These allegations illustrate the ongoing debates around the use of genetic data in artificial intelligence models and the necessary balance between technological advancements and legal compliance with privacy rights. The plaintiffs seek statutory damages, injunctive relief, and class certification to address these significant privacy concerns. The case is yet to see a response from the defendants, and the allegations remain unproven at this stage (¶66, ¶55(b)).
Financial Figures in Context
The complaint details the financial landscape surrounding the alleged unauthorized use and disclosure of genetic data, centering on Tempus AI's acquisition and data licensing strategies. Tempus AI acquired Ambry Genetics for $600 million, comprising $375 million in cash and $225 million in shares, significantly expanding its repository of genomic data (¶206). This acquisition forms part of Tempus AI's strategy to build one of the world's most comprehensive libraries of clinical and molecular data (¶238).
Tempus AI's business model has reportedly resulted in substantial contract value, with the company announcing a total remaining contract value of $1.1 billion by the end of 2025. This figure underscores the financial success driven by its licensing agreements, such as the prominent $200 million agreement with AstraZeneca and Pathos, which facilitated access to a substantial 300 petabytes of data for drug development purposes (¶207, ¶93).
AstraZeneca, one of Tempus AI's primary partners in these licensing deals, has engaged in substantial financial commitments outside their deal with Tempus. For instance, AstraZeneca's investment portfolio covers partnerships worth $5.3 billion in collaboration with CSPC Pharmaceutical, a $880 million investment in Verge Genomics, and a $555 million investment in Algen Biotechnologies, highlighting its strategic focus on leveraging expansive genetic data assets to support pharmaceutical development (¶237).
These financial figures paint a picture of a strategic and financially lucrative relationship between Tempus AI and pharmaceutical companies like AstraZeneca, serving as the backdrop for the alleged violations of privacy laws highlighted in the case. The figures reflect how high the stakes can become when large databases of genetic information are involved.
Relief Sought and Procedural Posture
The plaintiffs in Barone et al. v. Tempus AI, Inc. et al. seek statutory damages for each alleged violation of the Illinois Genetic Information Privacy Act (GIPA), with amounts ranging from $2,500 for negligent violations to $15,000 for intentional or reckless violations (¶160). In addition to these statutory damages, the plaintiffs are also pursuing injunctive relief, which aims to prevent further unauthorized disclosures of genetic information, as well as class action certification to include all similarly situated individuals (¶162).
The complaint was officially filed on March 30, 2026, in the United States District Court for the Northern District of Illinois under case number 1:26-cv-03516. The filing seeks to address what the plaintiffs allege are pervasive deficiencies in how Tempus AI and its associates have handled patients' genetic information, specifically focusing on alleged unauthorized disclosures and the subsequent use of that data for profit.
No responses have been filed by the defendants as of this filing, leaving the allegations unproven at this time. The procedural developments ahead will determine the scope of discovery and any potential pre-trial resolutions.
The allegations described here are taken from the filing and remain unproven; no responsive pleading is reflected in the source document.
The allegations described here are taken from the filing and remain unproven; no responsive pleading is reflected in the source document.
David Brunk is a civil litigation attorney. He can be reached at david@newmanbrunk.com.
Questions about this topic: david@newmanbrunk.com