California Attorney General Rob Bonta announced a $6 million settlement with the company that used to be 23andMe on October 19, 2026. The deal covers a 2023 data breach that exposed information on more than 855,000 Californians, and it still needs approval from the U.S. Bankruptcy Court for the Eastern District of Missouri.
The payment comes from Chrome Holding Co., the successor to 23andMe, which filed for bankruptcy in March 2025. The Attorney General’s release does not say that any of the $6 million goes to customers. It describes the money as a payment to resolve the state’s claims.
What the release does say is what customers can still do. People who used 23andMe keep the right to ask for their genetic data to be deleted and their saved DNA samples destroyed, no matter who owns the company’s records now. Bonta said customers can delete their private genetic data “no matter who owns it.” To start, a customer logs in, opens Settings, scrolls to the section labeled 23andMe Data, and clicks View.
Retirement deadlines, in your inbox: Miss an enrollment or claim deadline and the money can be gone. The Retirement Money Brief keeps you ahead of the ones that matter, every weekday.
Get the Retirement Money Brief →
We may earn a commission from links on this page.
What does California’s $6 million settlement resolve?
The state’s claims against the company included allegations that 23andMe failed to protect customers’ personal and genetic data, which led to the 2023 breach. The California Department of Justice also sued Chrome Holding Co. in California state court, alleging unreasonable data security practices and misrepresentations, and filed a counterpart claim in the bankruptcy case.
The settlement also ends two appeals. Bonta had appealed the denial of his objection under California law to the sale of Californians’ genetic information and samples without their affirmative consent. The California Department of Justice had appealed the bankruptcy and district court orders that denied its objection under the Genetic Information Privacy Act. The $6 million resolves those claims between 23andMe and the state.
Who was caught in the breach?
The 2023 breach affected nearly 7 million 23andMe customers across the United States. More than 855,000 of them were Californians, the Attorney General’s office said.
Bonta framed the case as a limit on what bankruptcy can erase. “Companies cannot evade California’s consumer protection and privacy laws by filing for bankruptcy,” he said in the release.
Who holds customers’ DNA data now?
In March 2025, 23andMe filed for bankruptcy and sold its assets, including customers’ genetic data and biological samples, to TTAM Research Institute. TTAM is a nonprofit set up by 23andMe’s co-founder and former chief executive.
The Attorney General’s office objected to the sale. It argued the sale was inconsistent with the Genetic Information Privacy Act, which requires separate, explicit consent before genetic data or samples are transferred. Both the bankruptcy court and the district court denied the objections, and the two appeals are now resolved by the settlement.
How can a customer delete data and destroy a sample?
According to the Attorney General, the steps to delete genetic data are short. After clicking View under 23andMe Data, a customer can download a copy of the data if desired, then scroll to Delete Data, click Permanently Delete Data, and confirm through the link in a follow-up email.
Two other controls sit in account settings. A customer can change the storage preference for a saved test sample under Preferences, which is how the release says to ask for a sample to be destroyed. A customer can also withdraw consent for research use under Research and Product Consents.
Whether the court approves the deal and when are the open questions. The Attorney General’s release gives no hearing date, and it does not say whether any of the money will reach the people whose data was exposed.
Worried about what a 23andMe breach leaves exposed?
The $6 million settlement does not mention payments to customers, and genetic data cannot be changed the way a password can. Deleting an account closes one door, but anything already taken in the 2023 breach stays out there.
The Senior Fraud Defense & First-Hour Recovery Kit does not touch the 23andMe case itself. It covers the job that follows a data exposure: locking down what is left. It includes the free credit-freeze steps, the first-hour recovery plan and a fraud evidence and report log.
Get the credit-freeze steps and report log in the fraud defense kit →
More Financial Reading
- 21 Ways to Stretch a $2,087 Social Security Check
- 15 Places to Find Your Share of the $4.25 Billion States Give Back
- 15 Steps to Stop the Scams That Took $7.7 Billion From Seniors
This article was produced with AI assistance and edited for accuracy against the sources linked above.
