23andMe agrees to $6 million California settlement over genetic-data litigation

Chrome Holding Co., formerly known as 23andMe, has agreed to pay California $6 million to resolve litigation concerning customer genetic information, the California Department of Justice announced on October 19, 2026. The agreement awaits approval in the Eastern District of Missouri Bankruptcy Court, the department said.²³

Breach and bankruptcy sale

The settlement addresses claims arising from the company’s 2023 data breach as well as a dispute over the sale of customer genetic data and biological samples during its 2025 bankruptcy. California’s justice department said the agreement resolves its pending claims and its appeal against the rejection of its objection to that sale.¹²

According to Reuters, genetic details and additional personal data for 6.9 million customers were compromised in the breach. The state department estimated that the incident affected almost 7 million people nationwide, among them over 855,000 Californians.²³

The department alleged that inadequate security practices led to the breach and that 23andMe made misleading representations to customers and the public. According to Bloomberg’s report in the Los Angeles Times, the state’s investigation found that hackers remained inside the company’s systems for five months without detection.¹²

The information at issue included the raw DNA sequences that 23andMe stored to produce reports on ancestry, ethnicity and genetic predispositions to health conditions, according to the department. Bloomberg reported that exposed material included raw genetic information and health reports concerning more than 850,000 Californians.¹²

Consent and the asset transfer

The department’s account places the bankruptcy filing and sale of certain assets to TTAM Research Institute in March 2025. Those assets included customer genetic information and biological samples. Bloomberg described TTAM as a Palo Alto nonprofit founded by 23andMe co-founder Anne Wojcicki.¹²

California challenged the sale under the Genetic Information Privacy Act. The department said that law requires separate, explicit customer consent before genetic data and biological samples can be sold or transferred. The Bankruptcy Court and District Court rejected the state’s objection, and the department appealed.²

California Attorney General Rob Bonta said: “Companies cannot evade California’s consumer protection and privacy laws by filing for bankruptcy.” He also accused the company of failing to adequately safeguard the genetic information it had collected.¹

Customers’ remaining rights

California consumers can still ask for their personal data to be deleted and their samples destroyed, the department said. They can also withdraw permission for their genetic information to be used in research. Bloomberg reported that roughly 2 million people sought deletion of their data during the bankruptcy process.¹²

The payment to California is distinct from a $46.75 million settlement for breach victims included in the bankruptcy, according to Reuters. The state agreement remains subject to judicial approval; the department identified the Eastern District of Missouri Bankruptcy Court as the court considering it.²³