California Settles 23andMe Data Breach Claims for $6 Million
State resolves legal claims regarding 2023 genetic data breach following 23andMe's bankruptcy proceedings.
1Settlement Terms Finalized
California Attorney General Rob Bonta announced a $6 million settlement regarding 23andMe's 2023 data breach. This agreement resolves state legal claims stemming from the exposure of sensitive genetic information. The payment occurs within the context of the company's broader bankruptcy proceedings, marking a conclusion to California's specific litigation efforts against the firm.
2Scope of Data Exposure
The 2023 security incident compromised the personal and genetic data of approximately 6.9 million total customers globally. Within California specifically, the breach impacted over 855,000 residents. This massive exposure of highly sensitive biological information triggered significant regulatory scrutiny and subsequent legal action from the state's attorney general office.
3Bankruptcy and Asset Sale
23andMe filed for bankruptcy in March 2025 following declining demand and intense legal fallout. California unsuccessfully attempted to block the $305 million sale of assets to TTAM Research Institute, a nonprofit entity controlled by co-founder Anne Wojcicki. The state argued the sale violated the California Genetic Information Privacy Act.
4Legal Hurdles and Appeals
A federal bankruptcy judge rejected California's objections to the asset sale and ruled the state could not pursue the company's successor for damages. After losing an appeal in federal district court, California agreed to drop further legal challenges. This decision was a prerequisite for finalizing the $6 million settlement payment.
5Consent and Data Rights
California officials argued that the court should have prohibited the transfer of user data unless customers provided express consent. While the court allowed the sale, 23andMe customers retained the right to delete their information throughout the process. The attorney general continues to emphasize that users can still request data deletion.
6Victim Compensation Framework
Beyond the $6 million settlement with the state, 23andMe has committed to paying $46.75 million to victims of the 2023 data breach. This separate allocation is part of the company's bankruptcy plan, aiming to address the direct harm caused to individuals whose genetic profiles were exposed during the security failure.
7Regulatory Privacy Enforcement
This case highlights the intersection of bankruptcy law and state-level genetic privacy protections. By pursuing this settlement, California reinforces its commitment to enforcing the Genetic Information Privacy Act. The outcome serves as a reminder of the ongoing legal responsibilities companies face regarding consumer data protection, even when facing insolvency.
8Future Data Ownership Risks
The transition of genetic databases during corporate liquidations presents unique risks for consumer privacy. As 23andMe moves under new ownership via the TTAM Research Institute, the ability for users to manage their data remains a critical concern. Regulators are increasingly focused on ensuring that bankruptcy sales do not bypass consumer rights.
Original article: mint - companies — California Settles 23andMe Data Breach Claims for $6 Million