23andMe successor agrees to $6M settlement with California over data breach

23andMe lawsuit settlement overview:

• Who: California Attorney General Rob Bonta reached a settlement with Chrome Holding Co., formerly known as 23andMe Holding Co.
• Why: The deal would resolve California’s claims that 23andMe failed to protect customers’ personal and genetic data in a 2023 data breach.
• Where: The settlement was filed in Missouri federal bankruptcy court.

California has reached a $6 million deal with the company formerly known as 23andMe to resolve claims that the genetic testing company failed to safeguard customer information exposed in a 2023 data breach.

Attorney General Rob Bonta announced the agreement on Oct.19, which would also end the state’s challenge to the sale of customer genetic data during 23andMe’s bankruptcy. The 23andMe lawsuit settlement was filed in Missouri federal bankruptcy court and still needs a judge’s approval, Law360 reports.

Under the agreement, Chrome Holding, as the company is now known, will pay roughly $6.01 million to the California Attorney General’s Office, which will use the money to provide relief to some 855,000 affected residents.

The stipulation also bars the bankrupt company from selling directly to consumers or collecting or keeping personally identifiable information for five years. Neither side admitted liability, and California agreed to drop all pending appeals and other legal actions against the company as part of the settlement.

“Companies cannot evade California’s consumer protection and privacy laws by filing for bankruptcy,” Bonta said in a statement. The deal also preserves consumers’ rights to delete their data and have their genetic samples destroyed.

23andMe filed for Chapter 11 bankruptcy in March 2025, citing in part the cost of dealing with the 2023 data breach, in which a hacker accessed data belonging to nearly 7 million U.S. users.

California deal follows $18M multistate 23andMe data breach settlement

California’s agreement is separate from a July deal in which Chrome Holding agreed to pay $18 million to 42 other states. Consumers also brought a class action lawsuit over the 23andMe data breach, which the company agreed to settle for $30 million in 2024. Chrome Holding has since agreed to pay $46.7 million to claimants under a deal reached in June.

California had objected to the sale of 23andMe’s assets to TTAM Research Institute, a nonprofit created by co-founder Anne Wojcicki, arguing it violated a state law requiring customers’ explicit consent before their genetic data is transferred. 

The state also sued Chrome Holding in state court in May, alleging security lapses led to the breach and that the company misled consumers about its safeguards. The lawsuit sought $1,000 per violation of the state’s genetic privacy law, but these claims were later resolved and settled for $6 million through an agreement filed in the U.S. Bankruptcy Court for the Eastern District of Missouri.

Were you affected by the 23andMe data breach? Let us know in the comments.

California is represented by Rob Bonta, Nicklas A. Akers, Stacey D. Schesser, Bernard A. Eskandari, Ian Hogg, Daniel M.B. Nadal and Yen P. Nguyen of the California Department of Justice.

The 23andMe lawsuit settlement is In re: Chrome Holding Co. (F/K/A 23andMe Holding Co.), Case No. 4:25-bk-40976, in the U.S. Bankruptcy Court for the Eastern District of Missouri.

Read About More Class Action Lawsuits & Class Action Settlements:

• ‘Park outside’ advisory issued for Hyundai Genesis recall
• Class action lawsuit accuses OpenAI of unlawfully extracting children’s data
• Gap, Athleta class action lawsuit claims employees denied breaks, overtime pay
• Wayfair’s extended sale emails spark class action lawsuit