California's legal fight with 23andMe is coming to an end, and the price is $6 million. On October 19, Attorney General Rob Bonta announced a settlement with Chrome Holding Co., the company formerly known as 23andMe. It resolves the state's claims over the company's 2023 data breach and its appeal of the denied objection to the sale of customers' genetic records.
The deal is not final yet. According to the Attorney General's office, it was filed in the US Bankruptcy Court for the Eastern District of Missouri and still needs that court's approval.
The Breach Behind the Bill
The California AG's office says the 2023 breach affected nearly 7 million 23andMe customers, more than 855,000 of them Californians. Reuters, in a report carried by CP24, puts the number at 6.9 million customers whose data was exposed.
California brought two separate actions. One was a lawsuit in California state court claiming the company used unreasonable data security and made misrepresentations that misled customers and the public, with a counterpart claim in the bankruptcy proceeding. The other was an objection in bankruptcy court to the sale of 23andMe's genetic data, and later an appeal of the orders denying it. The settlement covers both.
From Bankruptcy to a Nonprofit Buyer
The Record reports that 23andMe filed for bankruptcy in March 2025. Its customer data was then sold to TTAM Research Institute, a nonprofit created by co-founder Anne Wojcicki. The Record also reports that Wojcicki is CEO of Chrome Holding, the entity paying California. TTAM told The Record it had no role in the settlement.
California tried to block that sale and lost. Reuters reports the state failed in its effort to stop the $305 million transaction to TTAM. The AG's office says both the Bankruptcy Court and the District Court denied the state's objection, which was based on California's Genetic Information Privacy Act, a law that requires a customer's separate and explicit consent before genetic data and biological samples are sold or transferred. California appealed. As part of this settlement, the state is resolving that appeal, and court documents cited by Reuters show it agreed to drop any further appeals.
In short, the sale stands. California gets $6 million and ends its litigation instead of fighting the transaction any further.
One Settlement Among Several
California's deal is the latest of several financial outcomes from the breach:
- $18 million, multistate: In July, The Record reports, 23andMe settled with a coalition of 42 additional state attorneys general for $18 million.
- $46.75 million, victims: Reuters reports that 23andMe agreed in bankruptcy to pay $46.75 million to breach victims.
- $6 million, California: The new settlement with Chrome Holding, which still needs court approval.
California's $6 million is separate from the 42-state deal, which The Record describes as covering 42 additional attorneys general. That may reflect the state's large share of affected customers and its separate genetic-privacy claims, but none of the sources give the reasoning behind the figure.
What Customers Keep
The most practical part of the announcement is not the dollar amount. The AG's office says affected consumers retain the right to request deletion of their information and destruction of their samples. The data moved to a new owner, but the settlement keeps that control in customers' hands.
This matters because genetic data is different from most leaked information. You can reset a password and cancel a card. You cannot replace your genome. The AG's office also says California law gives residents the right to ask direct-to-consumer genetic testing companies to delete or destroy their data, no matter who owns it.
What It Means for Defenders
This is a policy story, not a vulnerability story. There is no patch to apply or version to upgrade. Still, there are concrete steps for affected people and lessons for security teams.
Who is affected: The nearly 7 million customers in the 2023 breach (6.9 million according to Reuters), including more than 855,000 Californians, plus anyone whose 23andMe account and samples moved to TTAM in the sale.
What individuals can do:
- If you no longer want a company holding your genetic data, use the right to request deletion of your data and destruction of your samples. California's AG says the settlement keeps that right in place.
- Keep in mind that this settlement goes to the state, not to you. Reuters reports that victim compensation runs through the separate $46.75 million bankruptcy payment.
- The AG's office says you can also revoke permission for your genetic data to be used for research, through your account settings.
What security and compliance teams should take from it:
- Sensitive data outlives the company. When a vendor goes bankrupt, its data can be sold as an asset. California went to court over this sale and lost. When you review a vendor that holds sensitive data about your staff or customers, ask what happens to that data in a bankruptcy, merger or sale, and get the answer in the contract.
- Security claims are legal promises. One of California's claims was that the company made misrepresentations that misled customers and the public. Make sure your public security statements, privacy policies and sales materials match what you actually do. Regulators treat the gap as a legal problem.
- Breach costs keep coming. One breach has now led to an $18 million multistate settlement, a $46.75 million victim payment and a $6 million California deal. Plan your risk budget for that long tail, not just the first response.
- Plan for state-level overlap. California sued on its own, outside the 42-state group. If you handle residents' data in states with their own privacy laws, such as California's Genetic Information Privacy Act, expect parallel actions.
What Happens Next
The bankruptcy court in Missouri still has to approve the deal. If it does, California's claims against 23andMe's successor end, the TTAM sale stays in place, and customers keep their deletion rights. The bigger question remains open: how much protection does genetic data have once the company that collected it no longer exists?
