California has reached a $6 million settlement with 23andMe, resolving the state’s legal claims related to a 2023 data breach that exposed the sensitive genetic and personal information of millions of customers. The agreement marks another major development in the company’s long-running privacy dispute, which expanded into bankruptcy proceedings and a contentious fight over the ownership and transfer of genetic data.
On October 19, 2026, California Attorney General Rob Bonta announced the settlement involving Chrome Holding Co., the company formerly known as 23andMe. The agreement was filed in the U.S. Bankruptcy Court for the Eastern District of Missouri and remains subject to court approval.
The settlement resolves California’s claims concerning the company’s alleged failure to safeguard customer information. It also ends the state’s appeal challenging the sale of 23andMe’s assets to TTAM Research Institute, a nonprofit controlled by co-founder Anne Wojcicki.
The agreement is significant because genetic information is unusually sensitive: unlike a password, a person’s DNA cannot simply be changed after it has been exposed. The case has therefore raised broader questions about consumer privacy, corporate accountability and the protection of genetic information when a company faces financial distress.
According to California’s attorney general, the 2023 breach affected approximately 6.9 million customers worldwide, including 855,541 California residents. The company has also agreed to provide a separate $46.75 million fund for eligible victims of the breach under the bankruptcy-related settlement process.
Sources: https://www.oag.ca.gov/news/press-releases/attorney-general-bonta-secures-6-million-settlement-23andme-litigation
What Does the $6 Million Settlement Cover?
The agreement resolves California’s legal claims against Chrome Holding Co. concerning the 2023 data breach and the transfer of customer genetic information during the company’s bankruptcy sale.
California Attorney General Rob Bonta alleged that 23andMe failed to take reasonable steps to protect its customers’ personal and genetic information. His office also challenged the sale of the company’s assets, arguing that transferring Californians’ genetic information and biological samples without their affirmative consent violated the state’s Genetic Information Privacy Act.
The state sought to prevent the transfer of sensitive information without customers’ express consent and attempted to recover monetary relief through its legal action.
However, the bankruptcy court rejected California’s objections to the sale, and the state subsequently lost an appeal. The settlement resolves the remaining dispute, with California agreeing to drop further appeals.
The $6 million payment is intended to resolve the state’s claims. It should not be confused with the separate compensation fund established for customers affected by the data breach.
The settlement also does not amount to a finding that every allegation made by California was proven at trial. It resolves the disputed claims through an agreement rather than a final judgment on every allegation.