Chrome Holding Company, the entity formerly known as 23andMe, has agreed to pay California $6 million to resolve claims over the 2023 data breach that exposed information belonging to nearly 7 million people. California Attorney General Rob Bonta announced the deal on Monday, Oct. 19, and it still needs approval from the federal bankruptcy court overseeing the company’s collapse.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
The payment closes two fronts at once: a state lawsuit over how the genetic testing company protected customer data, and an appeal over what happened to that data when the business went bankrupt. For the millions of customers who mailed in saliva samples, the practical effect is less about the money than about the rights the settlement preserves.
What California says 23andMe got wrong
In its press release, the California Department of Justice said the settlement resolves allegations that the company failed to protect customers’ personal information and genetic data, leading to the breach. Bonta said 23andMe collected genetic data about millions of people and failed to meet its obligation to keep that information safe. The department opened its investigation in 2023 after reports of a breach affecting nearly 7 million U.S. customers, including more than 855,000 Californians.
The state also sued Chrome Holding in California court, alleging unreasonable data security practices and misrepresentations to customers and the public, and filed a matching claim in the bankruptcy case. The $6 million payment resolves those pending claims.
The bankruptcy sale and the consent fight
The Record’s report on the settlement by Suzanne Smalley recounts how a longtime Silicon Valley company saw demand for genetic testing shrink, with the breach delivering the final blow. In March 2025, 23andMe filed for bankruptcy and sold customers’ saliva samples and genetic data to TTAM Research Institute, a nonprofit created by Anne Wojcicki, the company’s co-founder and former chief executive.
California objected to that sale. The Department of Justice argued that the Genetic Information Privacy Act requires separate, explicit consent before genetic data and samples are transferred, and that the sale did not meet the requirement. Both the bankruptcy court and the district court denied the objection, and the settlement also resolves the state’s appeal of those rulings. The case is filed in the U.S. Bankruptcy Court for the Eastern District of Missouri, and the parties’ joint stipulation is posted by the attorney general’s office.
TTAM disputes any link to the payment. A spokesperson told The Record that the institute is a “newly established independent nonprofit organization” that “is not involved in matters related to Chrome Holding Co., formerly known as 23andMe, Inc.” and has no role in the settlement. The reporter also noted that a staffer who answered the phone at Chrome Holding said no one there was authorized to speak to the media.
Deletion rights that survive the sale
The settlement says affected consumers keep the right to delete their data and to order genetic samples destroyed. Bonta used the announcement to remind Californians that customers can delete their private genetic data no matter who owns it. The attorney general’s release lays out the steps: log in to a 23andMe account, open Settings, find the section labeled 23andMe Data, and choose to permanently delete data after confirming through an emailed link. Customers can also change their sample storage preference to have a physical sample destroyed, and they can withdraw consent for research use under the account’s consent settings.
Customers are allowed to download their data before deleting it, which matters for anyone who wants a copy of ancestry or health reports. The release says the same rights apply to data held by the 23andMe Research Institute, with options to request deletion, sample destruction or revocation of research permissions.
A second payment after the multistate deal
The California payment follows a larger settlement reached in July. As The Record reported on July 15, a coalition of 42 state attorneys general reached an $18 million settlement over the same October 2023 breach, which exposed information on 6.9 million people. The New York attorney general’s release, dated July 14, says Letitia James joined 42 other attorneys general in that deal, and that New York alone received more than $705,000. James said companies have a duty to protect their customers’ personal information from hackers.
That agreement required risk analyses and a data security advisory board, and it preserved customers’ rights to delete their data. The New York release says the investigation found missing safeguards, including protections against stolen credentials, rate limiting and intrusion detection, and that the company first denied the breach and then blamed customers for how they set up accounts and used passwords.
Bonta framed California’s deal as a point about bankruptcy as much as about security. Companies, he said, cannot evade California’s consumer protection and privacy laws by filing for bankruptcy. Whether other states with genetic privacy statutes press similar arguments in future insolvencies is not addressed in the settlement papers described in the attorney general’s release.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- NOAA now gives this winter a 75% chance of the strongest El Nino since 1950
- Doctors warn a silent liver disease now affects one in three American adults
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
