The California Department of Justice said Oct. 19, 2026, that it secured a $6 million settlement with Chrome Holding Co., formerly known as 23andMe; the agreement was filed in the U.S. Bankruptcy Court in the Eastern District of Missouri and is pending court approval.
DOJ said the settlement resolves allegations that the company failed to protect customers’ personal and genetic information in a 2023 data breach that affected nearly 7 million 23andMe customers nationwide, including more than 855,000 Californians.
DOJ said the deal also resolves its appeal from orders by the Bankruptcy Court and the District Court that denied the department’s objection, under California’s Genetic Information Privacy Act, to the sale of Californians’ genetic information and biological samples during the company’s bankruptcy.
Attorney General said, "23andMe collected genetic data about millions of people and failed to meet its obligation to keep that information safe. Companies cannot evade California’s consumer protection and privacy laws by filing for bankruptcy."
The department said consumers retain the right to request deletion of their data, destruction of their test samples, or to revoke research permission; DOJ provided step-by-step instructions to delete data through a 23andMe account, including logging in, opening Settings, selecting "23andMe Data," choosing "Permanently Delete Data," and confirming the request via the emailed link, and it advised users to download a copy first if they want one.
23andMe, founded in San Francisco, filed for bankruptcy in March 2025 and sold certain assets, including customer genetic data and samples, to TTAM Research Institute, a nonprofit established by the company’s co-founder and former CEO, DOJ said. The department objected to that sale because the Genetic Information Privacy Act requires a customer’s separate and explicit consent before genetic data and samples are sold or transferred.
Separately, DOJ sued Chrome Holding Co. in California state court, alleging that 23andMe’s unreasonable data security practices led to the 2023 breach and that the company misled customers and the public, and it filed a counterpart claim in the bankruptcy case. The $6 million payment resolves the pending claims between 23andMe and DOJ, the department said.
State
Rob Bonta
Attorney General · Democrat
Named once in this story.
Portrait: Official portrait
Sources & methodology
This report was written from the primary materials below. Links open at the original publisher.
California Attorney GeneralSee something we should correct? Read our corrections policy.