California settles 23andMe data breach claims for $6m

California will receive a $6 million settlement payment in 23andMe’s bankruptcy, resolving the state’s legal claims over a 2023 data breach that exposed the genetic and other personal information of 6.9 million customers, Attorney General Rob Bonta announced on Monday.

The breach exposed the genetic information of more than 855,000 Californians, according to the attorney general’s office.

California had unsuccessfully tried to block the $305 million sale of 23andMe’s assets to TTAM Research Institute, a non-profit controlled by co-founder Anne Wojcicki. The state argued the sale violated California’s Genetic Information Privacy Act and said customers had not given express consent to the transfer of their DNA data.

A US bankruptcy judge ruled against California’s objections to the sale and later held that the state could not sue to recover money from the company’s successor. California lost an appeal in federal district court and agreed to drop further appeals as part of the $6 million settlement, according to court documents filed on Monday.

“I am proud to fight for the privacy rights of Californians and to deliver this settlement for consumers who put their trust in 23andMe,” Bonta said in a statement. “I want to remind Californians that customers of 23andMe can delete their private, genetic data — no matter who owns it.”

Once a trailblazer in DNA testing kits, 23andMe filed for bankruptcy in March 2025 after falling demand and legal fallout from the breach.

Sources: The Guardian; Reuters