California reaches $6 mn 23andMe settlement over genetic data breach

California has reached a $6 mn settlement with Chrome Holding Co., formerly known as 23andMe, resolving allegations that the genetic testing company failed to protect customers’ sensitive personal information and genetic data in a 2023 cyberattack.

California Attorney General Rob Bonta announced the agreement on October 19, 2026. The settlement also resolves the state’s legal challenge to the transfer of customer genetic information and biological samples during 23andMe’s bankruptcy proceedings.

• California reached a $6.01 mn settlement with Chrome Holding, formerly 23andMe, over a 2023 data breach affecting nearly 7 mn US customers, including more than 855,000 Californians.
• The agreement resolves California’s challenge to the transfer of genetic information and biological samples during 23andMe’s bankruptcy, while preserving consumers’ rights to delete their data.
• The settlement follows an $18 mn agreement with 42 other states and separate consumer litigation that ultimately resulted in a $46.7 mn settlement. Court approval of California’s agreement remains pending.

Under the agreement, Chrome Holding will pay approximately $6.01 mn to the California Attorney General’s Office, which may use the funds to provide relief to residents affected by the breach.

More than 855,000 Californians were among nearly 7 mn US customers whose information was compromised in the incident.

The settlement was filed in the US Bankruptcy Court for the Eastern District of Missouri and remains subject to judicial approval. Neither side admitted liability or wrongdoing. “Companies cannot evade California’s consumer protection and privacy laws by filing for bankruptcy,” Bonta said.

The agreement also preserves customers’ rights to request deletion of their genetic information and destruction of biological samples, regardless of changes in ownership of the data.

California settlement addresses 23andMe’s 2023 data breach

Founded in San Francisco, 23andMe became one of the largest direct-to-consumer genetic testing businesses, offering DNA analysis based on saliva samples submitted by customers.

Its services provided information about ancestry, ethnicity, genetic health predispositions and biological relatives. The company maintained sensitive records, including raw genetic information and results derived from customer DNA samples.

In October 2023, 23andMe disclosed a cybersecurity incident that ultimately affected nearly 7 mn customers across the United States.

The compromised information included personal data and, in some cases, limited health, genetic and ethnic information. Certain stolen records were subsequently posted on the dark web.

California’s Department of Justice opened an investigation into the incident, examining the company’s handling of personal information and its security practices.

In May 2026, the state filed a lawsuit against Chrome Holding, alleging that unreasonable cybersecurity practices had contributed to the breach.

The complaint also accused the company of making misleading representations to customers and the public about its security protections.

California sought penalties of $1,000 per violation under its genetic privacy legislation. The state subsequently pursued corresponding claims in the bankruptcy proceedings, bringing the security allegations into the broader dispute over 23andMe’s remaining assets and obligations.

The proposed $6 mn payment resolves those pending claims without establishing liability through a court judgment.

23andMe bankruptcy raised concerns over genetic data ownership

23andMe filed for Chapter 11 bankruptcy protection in March 2025, following financial difficulties compounded by the costs and legal consequences of the 2023 data breach.

The bankruptcy proceedings involved the sale of certain company assets, including customer genetic information and biological samples.

Those assets were transferred to TTAM Research Institute, a nonprofit established by 23andMe co-founder and former chief executive Anne Wojcicki.

California’s Department of Justice objected to the transaction, arguing that transferring genetic information without obtaining customers’ affirmative consent violated the state’s Genetic Information Privacy Act.

The legislation requires direct-to-consumer genetic testing companies to obtain separate, explicit consent before selling or transferring customers’ genetic data and biological samples.

State officials maintained that bankruptcy proceedings did not eliminate those legal obligations.

The US Bankruptcy Court rejected California’s objection to the asset sale. The federal district court subsequently upheld that decision, prompting the state to pursue further appellate proceedings.

The October settlement resolves the remaining legal challenges associated with the transaction.

Under the agreement, California will withdraw its pending appeals and other legal actions against Chrome Holding once the relevant settlement conditions are satisfied.

The settlement does not reverse the transfer of genetic information and biological samples to TTAM Research Institute.

Instead, it resolves the state’s objections while preserving the individual rights available to affected customers under California law.

Chrome Holding faces five-year restrictions under settlement

Beyond the financial payment, the agreement places restrictions on the bankrupt company’s future operations. Chrome Holding’s debtors and wind-down entity are barred for five years from engaging in direct consumer sales of goods and services.

The agreement also restricts those entities from collecting or maintaining personally identifiable information during the same period, subject to applicable bankruptcy administration requirements.

These provisions apply to the specified debtor entities rather than imposing an equivalent blanket prohibition on TTAM Research Institute.

The settlement requires Chrome Holding to pay approximately $6.01 mn to the California Attorney General’s Office for potential consumer relief connected to the breach.

The agreement does not establish a fixed compensation amount for each of the more than 855,000 affected California residents.

California’s decision to resolve the litigation also means that the remaining appeals over the bankruptcy asset sale will be discontinued under the settlement terms.

California deal follows $18 mn multistate settlement

California’s agreement is separate from other legal resolutions arising from the 2023 breach.

In July 2026, Chrome Holding agreed to an $18 mn settlement with 42 other states, resolving their claims associated with the incident.

Consumer litigation also proceeded separately through a multidistrict class action involving individuals whose personal and genetic information had been compromised.

More than 40 class action lawsuits were filed following disclosure of the breach, alleging that 23andMe failed to implement adequate safeguards for sensitive customer data. Those cases were consolidated into federal multidistrict litigation in California in 2024.

An initial settlement agreement announced in 2024 proposed a $30 mn fund to compensate affected consumers.

Attorneys representing customers described that agreement as an “outstanding result”, citing the company’s uncertain financial position and the importance of securing available compensation.

The consumer settlement provided for reimbursement of up to $10,000 for qualifying losses directly associated with the breach.

It also included cash compensation for certain individuals whose health information was exposed, along with payments for eligible residents of Alaska, California, Oregon and Illinois, where genetic privacy laws provide statutory damages.

The original agreement additionally offered three years of privacy protection services through Privacy Shield.

Following 23andMe’s bankruptcy, the separate consumer litigation resulted in a revised settlement amount of approximately $46.7 mn, approved in 2026. That compensation arrangement is distinct from California’s $6 mn regulatory settlement and the $18 mn agreement involving other states.

The separate proceedings address different legal claims and compensation arrangements, meaning the settlement amounts should not be treated as a single fund available for direct distribution to affected customers.

California consumers retain rights to delete genetic information

The California Attorney General’s Office has emphasized that customers retain control over their genetic information even after 23andMe’s bankruptcy and the transfer of certain assets.

Under California’s Genetic Information Privacy Act, consumers can request deletion of personal and genetic data maintained by direct-to-consumer testing companies.

Customers whose information or biological samples are maintained by 23andMe Research Institute can also request destruction of stored samples or withdraw permission for their genetic data to be used in research.

Consumers seeking to delete their data can sign in to their 23andMe account and open the “Settings” section.

Customers who want to retain a personal copy of their genetic information can download it before requesting permanent deletion. To remove the information, they can select “Permanently Delete Data” and follow the confirmation instructions sent by email.

Individuals who previously agreed to have their saliva samples and DNA stored can change that preference through the “Preferences” section of their account.

Customers who consented to genetic research may withdraw that permission under “Research and Product Consents.”

These rights remain relevant to consumers who are concerned about continued storage or use of their genetic information following the company’s bankruptcy.

Court approval remains necessary for $6 mn settlement

The California agreement is documented in the bankruptcy case In re: Chrome Holding Co. (F/K/A 23andMe Holding Co.), Case No. 4:25-bk-40976, before the US Bankruptcy Court for the Eastern District of Missouri.

The proposed resolution covers California’s claims concerning the 2023 breach and its continuing objections to the transfer of genetic data and biological samples.

It provides approximately $6.01 mn for potential consumer relief, establishes operational restrictions on the bankrupt debtor entities and requires California to end its remaining legal challenges once the agreed conditions are met.

The agreement does not involve an admission of wrongdoing by Chrome Holding. Court approval is still required before the proposed settlement becomes final.

For consumers, the most immediate consequence is the preservation of their rights to request removal of personal genetic information, destruction of stored DNA samples and withdrawal of research consent.

The settlement also brings California closer to resolving its legal claims arising from a breach that affected nearly 7 mn people and the subsequent transfer of highly sensitive genetic information during bankruptcy.