California has reached a $6 million settlement with 23andMe over legal claims connected to a major 2023 data breach that exposed the genetic and personal information of millions of customers.
California Attorney General Rob Bonta announced the agreement on Monday, October 19, 2026. The settlement, which is subject to court approval, resolves the state’s claims concerning the breach and its objections to the transfer of customers’ genetic information during the company’s bankruptcy proceedings.
The incident exposed information belonging to approximately 6.9 million 23andMe customers, including more than 855,000 Californians, according to reports and the state attorney general’s office.
California Raises Concerns Over Customers’ Genetic Data
California had challenged the sale of 23andMe’s assets to TTAM Research Institute, a nonprofit controlled by company co-founder Anne Wojcicki.
The transaction was valued at $305 million. California argued that transferring customers’ genetic information and biological samples without their explicit consent conflicted with the state’s Genetic Information Privacy Act.
The state sought to prevent the transfer and pursued legal action over the handling of sensitive customer information. However, a bankruptcy court rejected its objections to the sale, and a federal district court subsequently ruled against California’s appeal.
Under the new settlement, California has agreed to abandon further appeals as the parties seek to resolve the outstanding claims.
How the 2023 Data Breach Affected 23andMe Customers
23andMe became widely known for its direct-to-consumer DNA testing kits, which allow customers to submit saliva samples for information about ancestry, genetic relationships and certain health predispositions.
The 2023 cyberattack exposed personal information associated with millions of customers. Depending on the individual, the compromised information included genetic data and other details linked to customers’ accounts.
The incident triggered legal scrutiny and contributed to the challenges facing the company. 23andMe filed for bankruptcy protection in March 2025, citing the effects of the breach and related litigation alongside declining demand and increased competition.
The company’s assets were subsequently sold to TTAM Research Institute.
Separate Compensation for Data Breach Victims
The $6 million agreement with California is separate from a settlement intended to compensate customers affected by the 2023 breach.
In July 2026, a US bankruptcy judge approved a $46.75 million settlement for victims. The amount was to be reduced by $14.29 million previously distributed in connection with the breach, leaving an additional payout of $32.46 million.
The California agreement instead addresses the state’s legal claims against the company and its challenge to the transfer of genetic information during bankruptcy proceedings.
Customers Can Still Request Deletion of Their Data
Following the announcement, Bonta reminded California residents that they can request the deletion of personal genetic information held by 23andMe.
Under California law, eligible customers can also request the destruction of stored biological samples and withdraw permission for their genetic information to be used in research.
The attorney general said the settlement was intended to protect consumers who had trusted the company with highly sensitive personal information.
The agreement still requires court approval. Its outcome also highlights the legal and privacy questions that can arise when companies holding genetic information face bankruptcy or transfer customer data to new owners.