California has reached a $6 million settlement with 23andMe, now known as Chrome Holding Co., to resolve allegations that the company failed to protect customers' personal information and genetic data following a 2023 data breach. The settlement was filed in U.S. Bankruptcy Court in the Eastern District of Missouri and is pending court approval, the California Attorney General's Office said.
The breach affected nearly 7 million 23andMe customers across the United States, including more than 855,000 Californians. The settlement also resolves the state's appeal of a decision allowing 23andMe to sell customer genetic information and samples to TTAM Research Institute, a nonprofit established by the company's co-founder and former CEO, during the company's March 2025 bankruptcy filing. California law requires explicit customer consent for the sale or transfer of genetic data.
23andMe, founded in San Francisco, was the first and one of the world's largest direct-to-consumer genetic testing companies. Customers sent saliva samples for DNA analysis and received reports about ancestry, ethnicity, and genetic health predispositions.
Affected consumers retain the right to request deletion of their information and destruction of their biological samples.