23andMe Successor Settles With California for $6m

California has settled its last fights with the company that used to be 23andMe, and the price of peace is $6.01 million and a five-year exit from the consumer business. Attorney General Rob Bonta announced the deal on 19 October, saying it resolves allegations that the DNA-testing company “failed to protect its customers’ personal information and genetic data resulting in a 2023 data breach.”

The settlement, with Chrome Holding Co., as the bankrupt company is now called, was filed in the US Bankruptcy Court for the Eastern District of Missouri and is pending court approval. It also ends California’s long-running appeal against the sale of Californians’ genetic data and samples in the bankruptcy without their consent, a fight the state had already lost twice. “Companies cannot evade California’s consumer protection and privacy laws by filing for bankruptcy,” Bonta said.

In brief

Chrome Holding, formerly 23andMe, will pay California $6.01m and stay out of consumer sales and personal data for five years, if the bankruptcy court approves.
California drops its lawsuit and its appeals over the sale of customers’ genetic data, so the sale to TTAM, now 23andMe Research Institute, stands.
Customers can still delete their data and samples; the judge has yet to rule on the deal.

The money goes to consumers, and the company stays out of their data

The joint stipulation, signed on 16 October and filed on 19 October, allows California’s claims at $6,010,000. Chrome’s plan administration trust must pay within 10 calendar days of the court’s approval. Bonta can use the money for consumer relief linked to the breach; any amount not used that way moves within a year into a fund the attorney general uses to enforce consumer-protection laws. To help pay out that relief, Chrome must give the attorney general contact details for the Californians whose information was exposed.

The terms go beyond cash. Chrome and its former subsidiaries are barred for five years from selling goods or services directly to consumers and from collecting or holding personal data, beyond what the trust needs to wind up the bankruptcy. Within four business days of payment, California must drop its state-court lawsuit and both of its appeals. Neither side admits liability.

One carve-out stands out. California’s release of claims “shall in no way apply to 23andMe Research Institute”, the renamed TTAM Research Institute that bought the company’s assets, including its customers’ genetic data and samples.

California lost the consent fight before it settled

The breach came to light in October 2023. California’s justice department says it affected nearly 7 million 23andMe customers in the US, more than 855,000 of them in California; Reuters put the figure at 6.9 million. 23andMe filed for Chapter 11 on 23 March 2025, and in June 2025 the bankruptcy judge approved selling substantially all of its assets, overruling California’s objection, according to the stipulation. Reuters reported the price as $305 million and described TTAM as a nonprofit controlled by co-founder Anne Wojcicki.

California’s argument rested on its Genetic Information Privacy Act, which the attorney general says “requires a customer’s separate and explicit consent” before genetic data or samples are sold or transferred. Both the bankruptcy court and the federal district court rejected the objection; the district court affirmed the sale on 29 September 2026, and California filed a further appeal to the Eighth Circuit on 16 October, the same day it signed the settlement. Bonta had also sued Chrome in San Francisco Superior Court in May 2026, alleging poor security and misleading statements, and the bankruptcy judge later ruled that the state could not pursue the company’s successor for money, Reuters reported.

California’s deal follows earlier ones. In July, 23andMe settled with 42 other state attorneys general for $18 million, The Record reported, and Reuters says the company agreed to pay $46.75 million to breach victims as part of its bankruptcy.

British customers were hit too

The breach reached the UK as well. In June 2025 the Information Commissioner’s Office fined 23andMe £2.31 million after a joint investigation with Canada’s privacy commissioner. The ICO said a hacker used credential stuffing, reusing passwords stolen in earlier, unrelated breaches, between April and September 2023, reaching information on 155,592 UK residents, and that 23andMe lacked safeguards such as mandatory multifactor authentication.

Deletion is now the main lever left

For compliance teams, the outcome is a mixed precedent. Bankruptcy did not wipe out the state’s breach claims, which were turned into cash and a five-year ban. But the consent challenge ends without a ruling in California’s favour, and the sale order stands: the genetic data stays with 23andMe Research Institute, which the release expressly leaves outside its scope.

That leaves individual deletion as the practical control. The attorney general reminds customers that they can still ask the company to delete their data, destroy their saliva sample or withdraw consent for research, through the settings in their 23andMe account. “I want to remind Californians that customers of 23andMe can delete their private, genetic data — no matter who owns it,” Bonta said.

The next step is the judge’s signature. If the court declines to approve the deal, the parties have asked to move the hearing on the value of California’s claims from 10 November to 10 December.