Story Highlights
- California’s attorney general announced a $6 million settlement payment from 23andMe’s bankruptcy, resolving the state’s legal claims over a 2023 data breach affecting 6.9 million customers
- The breach exposed genetic and personal information of more than 855,000 Californians, prompting the state to challenge the company’s asset sale
- California had unsuccessfully attempted to block a $305 million sale of 23andMe assets to TTAM Research Institute, arguing the transaction violated the state’s Genetic Information Privacy Act
- 23andMe agreed to pay $46.75 million to victims of the data breach as part of its bankruptcy proceedings
What Happened
California’s attorney general announced Monday that the state will receive a $6 million settlement payment through 23andMe’s bankruptcy proceedings. This settlement resolves California’s legal claims stemming from a significant 2023 data breach that compromised genetic and personal information belonging to 6.9 million customers, including more than 855,000 residents of California.
The settlement represents the conclusion of a contentious legal battle between California and 23andMe over how the company handled its bankruptcy and asset sales. California had mounted an aggressive challenge to the company’s proposed $305 million asset sale to TTAM Research Institute, a nonprofit entity controlled by 23andMe co-founder Anne Wojcicki. State officials contended that this transaction violated California’s Genetic Information Privacy Act and that consumers had not provided express consent for the transfer of their sensitive genetic data.
Despite California’s opposition, a U.S. bankruptcy judge ruled against the state’s objections to the sale. The state subsequently appealed the ruling in federal district court but ultimately lost that appeal as well. As part of the settlement agreement, California agreed to forgo further legal challenges and appeals in exchange for the $6 million payment.
- 23andMe filed for bankruptcy in March 2025 following declining demand and legal complications from the data breach
- The state challenged the $305 million asset sale, arguing it violated California’s Genetic Information Privacy Act
- California agreed to drop further appeals as part of the settlement terms
- 23andMe separately committed $46.75 million to compensate victims of the 2023 data breach
Why It Matters
This settlement carries significant implications for consumer privacy rights in California and across the nation. The case represents a fundamental clash between corporate bankruptcy law and state consumer protection statutes, particularly those governing sensitive genetic information. California’s Genetic Information Privacy Act is among the nation’s strictest protections for DNA data, and the dispute highlighted tensions between these protections and the practical realities of corporate restructuring through bankruptcy.
The exposure of genetic information from over 855,000 Californians represents a breach of extraordinarily sensitive personal data. Unlike other types of personal information, genetic data cannot be changed or reset if compromised, making it uniquely valuable and vulnerable. The settlement sends a message about accountability for companies that fail to adequately protect such information, though the reduced payment from what California initially sought reflects the limitations state authorities face when dealing with bankrupt entities.
Additionally, the case underscores the importance of express consent requirements for handling genetic data. California’s position that consumers should have explicitly authorized data transfers during bankruptcy highlights growing consumer expectations regarding control over biometric and genetic information. The agreement preserving customers’ ability to delete their data regardless of ownership demonstrates recognition of fundamental privacy principles.
- The settlement reinforces that companies handling genetic data face serious legal consequences for breaches, even during bankruptcy
- California consumers retain the right to delete their genetic data regardless of who owns the company
- The case demonstrates the tension between state privacy protections and federal bankruptcy law
- Genetic data’s permanent and irreplaceable nature gives it unique sensitivity compared to other personal information
Political and Public Context
California has positioned itself as a national leader in privacy protection, particularly regarding biometric and genetic information. The state’s Genetic Information Privacy Act reflects a proactive stance toward emerging technologies and their privacy implications. Attorney General Rob Bonta’s aggressive defense of this law, despite ultimately losing the central legal battle over the asset sale, demonstrates the state’s commitment to these principles even when facing powerful corporate and bankruptcy law considerations.
The 23andMe case arrives amid broader national conversations about data privacy, consent, and corporate responsibility. DNA testing services experienced explosive growth in the 2010s as consumer interest in ancestry and health information surged. However, the industry has faced recurring scrutiny regarding data security practices and the permanence of genetic information once collected. The case also reflects larger questions about whether current legal frameworks adequately protect consumers in the context of corporate insolvency.
Once considered a trailblazer in consumer DNA testing, 23andMe’s descent into bankruptcy illustrates how data breaches and legal consequences can fundamentally damage corporate viability. The company’s decline also underscores that consumer trust in data handling practices significantly affects business sustainability in sensitive industries.
- California has established itself as a national leader in genetic information privacy protection
- The DNA testing industry has faced mounting scrutiny over data security and consumer consent practices
- 23andMe’s bankruptcy followed declining demand and legal complications stemming from the breach
- The case reflects ongoing tensions between emerging privacy protections and traditional bankruptcy law frameworks
California settles 23andMe data breach claims for $6 million https://t.co/8rwNCQOHXq
— Reuters Legal (@ReutersLegal) October 19, 2026
What Happens Next
The $6 million settlement provides California with recovery for its legal efforts while the state forecloses any additional litigation over the bankruptcy proceedings. However, the separate $46.75 million compensation fund established by 23andMe for breach victims will proceed independently. Consumers affected by the breach can file claims through that process, and the company’s bankruptcy proceedings will continue to wind down the transfer of assets to TTAM Research Institute.
The outcome may influence how other states approach similar situations involving sensitive consumer data breaches during corporate bankruptcies. Future cases will likely examine whether states can develop additional protections for genetic information that better survive bankruptcy challenges, or whether they must work within existing federal bankruptcy frameworks. The case may also prompt other DNA testing and genetic analysis companies to strengthen their data security practices and more clearly communicate their data handling policies to consumers.
California consumers retain the ongoing ability to delete their genetic data from 23andMe’s systems, a right preserved throughout the bankruptcy and asset transfer process. The state will continue to monitor implementation of the settlement terms and the separate victim compensation fund to ensure compliance with agreed-upon conditions.
- Consumers affected by the breach will pursue claims through 23andMe’s separate $46.75 million victim compensation fund
- California retains the right to monitor settlement implementation and compliance with privacy terms
- Other states may reference this case when developing genetic information protections for bankruptcy situations
- The outcome may influence industry practices regarding data security and consumer consent in the DNA testing sector
