California Settles 23andMe Data Breach Claims for $6 Million

California Attorney General Rob Bonta announced on Monday that the state will receive a US$6 million settlement payment in 23andMe’s bankruptcy. This agreement resolves California’s legal claims related to a 2023 data breach that exposed the genetic and other personal information of 6.9 million customers.

Bankruptcy and Asset Sale

23andMe, once a trailblazer in DNA testing kits, filed for bankruptcy in March 2025. The company sought to sell its business at auction following a decline in demand and legal fallout from the data breach. The assets were sold to TTAM Research Institute, a nonprofit controlled by 23andMe co-founder Anne Wojcicki, for US$305 million.

California had unsuccessfully tried to block this sale. The state argued that the bankruptcy sale violated California’s Genetic Information Privacy Act and that consumers did not give express consent to the transfer of their data. A U.S. bankruptcy judge ruled against California’s objections to the sale. The judge later ruled that the state could not sue to recover money from the bankrupt company’s successor. California also lost an appeal over the sale in federal district court.

Settlement Terms and Appeals

According to court documents filed on Monday, California agreed to drop further appeals as part of the US$6 million settlement. While customers of 23andMe retained the option to delete their data during the bankruptcy sale process, California had argued that the court should have disallowed the transfer of any data unless customers first gave express consent.

Attorney General Bonta, a Democrat, stated in a statement on Monday, "I am proud to fight for the privacy rights of Californians and to deliver this settlement for consumers who put their trust in 23andMe." He added, "I want to remind Californians that customers of 23andMe can delete their private, genetic data — no matter who owns it."

Impact on Consumers

The data breach exposed the genetic information of more than 855,000 Californians, according to the attorney general’s office. In addition to the settlement with the state, 23andMe agreed to pay $46.75 million to victims of the 2023 data breach as part of its bankruptcy proceedings.

Why it matters

This settlement marks the conclusion of a significant legal battle over genetic privacy rights and the handling of sensitive consumer data during corporate bankruptcy. It highlights the limitations of state enforcement when federal bankruptcy courts approve asset sales, even when state privacy laws are cited as being violated. The case underscores the ongoing tension between corporate restructuring processes and consumer consent requirements for genetic data.

---

Sources

• bnnbloomberg.ca: California settles 23andMe data breach claims for US$6M
• ctvnews.ca: California settles 23andMe data breach claims for US$6M

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.