California secures $6m settlement over 23andMe data breach

State drops appeals against sale of genetic data assets to Wojcicki nonprofit

By LineZotpaper

Published19 October 2026

Read Time2 min

California Attorney General Rob Bonta on Monday announced a $6 million settlement resolving state legal claims against bankrupt genetic testing firm 23andMe, stemming from a 2023 data breach that exposed the personal and genetic data of 6.9 million customers.

California Attorney General Rob Bonta announced the state will receive a $6 million settlement payment in the bankruptcy of 23andMe, resolving California legal claims related to a 2023 data breach that exposed 6.9 million customers' genetic and other personal information.

The state had previously and unsuccessfully tried to block the $305 million sale of 23andMe's assets to TTAM Research Institute, a nonprofit controlled by 23andMe co-founder Anne Wojcicki. California argued the bankruptcy sale violated the Genetic Information Privacy Act, stating customers did not give express consent to the transfer of their data.

A US bankruptcy judge ruled against the state's objections. California lost an appeal over the sale in federal district court and agreed to drop further appeals as part of the $6 million settlement, according to court documents.

The data breach exposed the genetic information of more than 855,000 Californians, according to the attorney general's office. 23andMe agreed to pay $46.75 million to victims of the 2023 data breach as part of its bankruptcy.

'I am proud to fight for the privacy rights of Californians and to deliver this settlement for consumers who put their trust in 23andMe,' Bonta said in a statement. 'I want to remind Californians that customers of 23andMe can delete their private, genetic data, no matter who owns it.'

Analysis

Why This Matters

The settlement represents a significant state-level enforcement of genetic privacy rights, even against a defunct company. It sets a precedent for how sensitive data is handled in bankruptcy.
It highlights the legal tension between federal bankruptcy law and state genetic privacy statutes.
The case serves as a warning to consumers and companies about the long-term vulnerability of genetic data after a business fails.

Background

23andMe was a pioneering direct-to-consumer DNA testing company. Following a major data breach in 2023 and a sharp decline in demand, it filed for bankruptcy in March 2025. The company's assets were sold to a nonprofit controlled by its co-founder. The state of California objected to the sale, arguing that transferring genetic data without explicit consumer consent violated state law. The state's legal challenges were unsuccessful in court, leading to the negotiated settlement.

Key Perspectives

California Attorney General: The settlement compensates the state for violations of resident privacy and upholds key provisions of the Genetic Information Privacy Act. Bonta framed it as a victory for consumer trust and data rights. 23andMe Successor (TTAM): The bankruptcy sale has been legally finalized. The settlement removes a significant legal cloud over the acquisition, allowing the entity to move forward without the state appeal hanging over the data assets. Consumer Advocates and Privacy Experts: The situation underscores the fragility of genetic privacy protections in corporate insolvency. The opt-in data deletion mechanism was deemed insufficient by the state, yet the court allowed the sale, raising questions about the adequacy of current laws.

What to Watch

Distribution of the $46.75 million victim compensation fund.
Any future regulatory or legislative action in California or other states regarding genetic data bankruptcy provisions.
Whether this settlement prompts other 23andMe customers to pursue individual claims or opt for data deletion.

Sources

California to recieve $6m settlement after 23andMe data breach · World news | The Guardian

Checked

12 claims in this story checked against 1 source: 12 supported.

Show each claim

SupportedCalifornia secures $6m settlement over 23andMe data breachWorld news | The Guardian: “California’s attorney general, Rob Bonta, on Monday announced the state will receive a $6m settlement payment in 23andMe’s bankruptcy, resolving California’s legal claims related to a 2023 data breach”
SupportedState drops appeals against sale of genetic data assets to Wojcicki nonprofitWorld news | The Guardian: “California lost an appeal over the sale in federal district court, and it agreed to drop further appeals as part of the $6m settlement, according to court documents filed on Monday.”
SupportedBonta on Monday announced a $6 million settlement resolving state legal claims against bankrupt genetic testing firm 23andMeWorld news | The Guardian: “California’s attorney general, Rob Bonta, on Monday announced the state will receive a $6m settlement payment in 23andMe’s bankruptcy, resolving California’s legal claims related to a 2023 data breach”
SupportedData breach exposed personal and genetic data of 6.9 million customersWorld news | The Guardian: “a 2023 data breach that exposed 6.9 million customers’ genetic and other personal information”
SupportedCalifornia tried to block $305 million sale of 23andMe's assets to TTAM Research Institute, a nonprofit controlled by Anne WojcickiWorld news | The Guardian: “California had unsuccessfully tried to block the $305m sale of 23andMe assets to TTAM Research Institute, a non-profit controlled by the 23andMe co-founder Anne Wojcicki.”
SupportedCalifornia argued the bankruptcy sale violated the Genetic Information Privacy Act, stating customers did not give express consentWorld news | The Guardian: “The state had argued that the bankruptcy sale violated California’s Genetic Information Privacy Act, and it had said consumers did not give express consent to the sale.”
SupportedA US bankruptcy judge ruled against the state's objectionsWorld news | The Guardian: “A US bankruptcy judge ruled against California’s objections to the sale”
SupportedCalifornia lost an appeal over the sale in federal district court and agreed to drop further appeals as part of the $6 million settlementWorld news | The Guardian: “California lost an appeal over the sale in federal district court, and it agreed to drop further appeals as part of the $6m settlement, according to court documents filed on Monday.”
SupportedData breach exposed genetic information of more than 855,000 Californians, according to attorney general's officeWorld news | The Guardian: “The data breach exposed the genetic information of more than 855,000 Californians, according to the attorney general’s office.”
Supported23andMe agreed to pay $46.75 million to victims of the 2023 data breach as part of its bankruptcyWorld news | The Guardian: “23andMe agreed to pay $46.75m to victims of the 2023 data breach as part of its bankruptcy.”
SupportedI am proud to fight for the privacy rights of Californians and to deliver this settlement for consumers who put their trust in 23andMeWorld news | The Guardian: ““I am proud to fight for the privacy rights of Californians and to deliver this settlement for consumers who put their trust in 23andMe,” Bonta, a Democrat, said in a statement on Monday.”
SupportedI want to remind Californians that customers of 23andMe can delete their private, genetic data, no matter who owns itWorld news | The Guardian: ““I want to remind Californians that customers of 23andMe can delete their private, genetic data – no matter who owns it.””