23andMe Agrees to $6 Million Settlement Over 2023 California Data Breach

Chrome Holding Co., the successor to genetic testing company 23andMe, has agreed to a $6 million settlement with the California Attorney General to resolve claims arising from a 2023 data breach that compromised the personal and genetic information of nearly 7 million customers nationwide, including more than 855,000 Californians. The settlement is pending court approval and addresses allegations that the company failed to adequately protect sensitive customer data.

The settlement also resolves an appeal concerning the sale of genetic information and biological samples during 23andMe’s 2025 bankruptcy proceedings without obtaining explicit customer consent, as required under California’s Genetic Information Privacy Act.

Key Takeaways

• The 2023 data breach exposed genetic and personal data of millions, including over 855,000 Californians.
• The settlement resolves claims that 23andMe’s successor violated data security laws and improperly sold genetic data without consent.
• Consumers affected by the sale have rights to request deletion of their genetic information and destruction of biological samples.

Background of the 2023 Data Breach and Bankruptcy Sale

23andMe was a San Francisco-based direct-to-consumer genetic testing company that collected saliva samples to provide customers with ancestry and health-related genetic reports. In 2023, a data breach compromised the personal and genetic information of nearly 7 million customers nationwide. The California Department of Justice (DOJ) launched an investigation into the breach, focusing on the company’s data security practices.

Following financial difficulties, 23andMe filed for bankruptcy in 2025. During bankruptcy proceedings, the company sold certain assets, including genetic data and biological samples, to TTAM Research Institute, a nonprofit founded by 23andMe’s co-founder and former CEO. The California DOJ alleged that this sale violated the Genetic Information Privacy Act, which mandates explicit customer consent before transferring genetic information or biological samples.

Settlement Resolves Data Security and Consent Disputes

The $6 million settlement between Chrome Holding Co. and the California Attorney General resolves pending claims related to the 2023 data breach and the contested sale of genetic data during bankruptcy. The settlement agreement, filed in U.S. Bankruptcy Court in the Eastern District of Missouri, also addresses an appeal by the California DOJ concerning the sale’s legality under state privacy laws.

The lawsuit had further alleged that Chrome Holding Co. made misrepresentations that misled customers and the public about its data security practices. The settlement ends these claims without an admission of liability.

Legal Issues Surrounding Genetic Data Privacy and Security

This case highlights significant legal issues in personal injury and privacy litigation involving sensitive genetic information. Key concerns include the adequacy of data security measures to prevent breaches and compliance with state laws requiring explicit consent for the sale or transfer of genetic data and biological samples.

California’s Genetic Information Privacy Act imposes strict requirements on companies handling genetic data, reflecting the sensitive nature of this information and the potential for harm if misused. The case also underscores challenges in bankruptcy proceedings where genetic data is treated as an asset, raising questions about consumer consent and data ownership.

For personal injury and wrongful death claims involving genetic data breaches, issues such as identifying all responsible parties, preserving electronic evidence, and evaluating damages related to privacy violations can be complex and require specialized legal expertise.

Why the 23andMe Settlement Matters to Californians

The settlement is noteworthy because it addresses the intersection of data privacy, consumer protection, and corporate accountability in the rapidly evolving field of genetic testing. With millions of Californians affected, the case emphasizes the importance of robust data security practices and clear consent protocols for handling genetic information.

Additionally, the resolution of the appeal concerning the sale of genetic data during bankruptcy clarifies legal boundaries for companies managing sensitive biological materials and data assets. Consumers now have enforceable rights to request deletion of their genetic information and destruction of biological samples, providing a measure of control over their personal data.

Cases involving serious data breaches like this one can require thorough investigation beyond the initial breach, including examination of corporate policies, digital records, and compliance with privacy laws. San Diego County personal injury attorneys and privacy law experts often evaluate these factors when advising clients affected by data breaches.

Frequently Asked Questions

What is the Genetic Information Privacy Act?

It is a California law that requires companies to obtain explicit consent before selling or transferring genetic information or biological samples.

Who is affected by the 23andMe data breach?

Nearly 7 million customers nationwide, including over 855,000 Californians, had their genetic and personal data compromised.

What rights do consumers have after the settlement?

Affected consumers can request deletion of their genetic information and destruction of their biological samples held by the company.

Does the settlement mean 23andMe admitted wrongdoing?

No, settlements typically resolve claims without an admission of liability by the defendant.

If you or a loved one has been affected by a serious data breach or privacy violation, consulting experienced attorneys can help protect your rights. For a free case review, consider reaching out to qualified legal professionals.

Original reporting on this settlement is available from Insurance Journal.