The deal resolves the state’s claims over a 2023 breach that exposed more than 855,000 Californians, and drops its appeals of the sale of customers’ DNA data.
By Staff Reporter
California has agreed to accept about $6 million from the remains of 23andMe and to abandon its long-running legal challenge to the sale of the company’s customer genetic data, closing one of the most closely watched tests of whether state privacy law can follow sensitive information through bankruptcy.
Attorney General Rob Bonta announced the settlement on Monday with Chrome Holding Co., the name the Bay Area genetic-testing company took after it filed for Chapter 11 protection in March 2025. The agreement resolves the state’s claims that 23andMe failed to protect customers’ personal and genetic information before a 2023 data breach, which the attorney general’s office said affected nearly seven million customers nationwide, including more than 855,000 Californians.
“Companies cannot evade California’s consumer protection and privacy laws by filing for bankruptcy,” Mr. Bonta said in a statement. He also urged former customers to use their right to delete their data, “no matter who owns it.”
What the filing says
The joint stipulation, signed on Oct. 16 and filed Monday in the U.S. Bankruptcy Court for the Eastern District of Missouri, allows California’s claims in the amount of $6,010,000. The trust that is winding down the company must pay that sum within 10 calendar days of the court’s approval. The attorney general may use the money for consumer relief related to the breach, and any amount not spent that way within a year goes to a state fund reserved for enforcing consumer protection laws. The trust also agreed to give the attorney general contact information for affected California residents, to the extent needed to distribute relief.
The filing notes that the wind-down plan allows the trust to settle disputed claims without court approval, but that the parties filed it with the court “to provide certainty.” The attorney general’s office describes the settlement as pending court approval.
In exchange, California will dismiss, with prejudice, three pieces of litigation: a lawsuit it filed in May in San Francisco Superior Court accusing the company of unreasonable data security and misleading statements; its appeal of a July bankruptcy court order that partly granted the trust’s request to stop that state lawsuit; and its appeal of the 2025 order approving the sale of 23andMe’s assets. A federal district court affirmed that sale order on Sept. 29, and California filed a notice of appeal to the Eighth Circuit on Oct. 16, the same day it signed the settlement.
The trust, for its part, dropped its position that it could seek reimbursement of legal fees from California for bringing the state court case. It also agreed that the remaining corporate entities will not sell goods or services directly to consumers or collect personal information for five years. Neither side admits liability.
The release covers the bankrupt company and its former officers and directors for claims tied to the breach. The filing states that it “shall in no way apply” to 23andMe Research Institute, the nonprofit that now owns the customer data.
Where the data went
That nonprofit, originally named TTAM Research Institute and since renamed, was founded and is led by Anne Wojcicki, 23andMe’s co-founder and former chief executive. According to a company filing with the Securities and Exchange Commission, it agreed to pay $305 million in cash for 23andMe’s personal genome and research businesses, and the deal closed on July 14, 2025.
California had objected to that sale under the state’s Genetic Information Privacy Act, which, as the attorney general’s office describes it, requires a customer’s separate and explicit consent before genetic data or biological samples are sold or transferred. The bankruptcy court overruled the objection, and the district court upheld that ruling. By dropping its appeal, California forgoes the chance to have a federal appeals court consider whether a state genetic-privacy law can limit such a sale in bankruptcy, leaving the lower-court rulings in place.
California went its own way
Other states settled earlier. On July 14, New York, Michigan and a bipartisan coalition of more than 40 attorneys general announced a settlement that granted the states $150 million in allowed claims but, because of limited funds in the estate, capped their actual recovery at $18 million. California was not among the participating states listed.
The Michigan attorney general’s announcement said investigators found that 23andMe had failed to require multifactor authentication or screen passwords against lists of known breached credentials, and had not adequately monitored for unusual login patterns, including a large spike in login attempts. It said the company also agreed to a $46.75 million class-action settlement for affected U.S. consumers whose claims process closed in February.
The figures suggest California’s separate approach produced a larger return per resident. Michigan said it would receive $436,605 for 162,865 affected residents, and New York said it would receive more than $705,000 for 305,245 residents, or roughly $2.30 to $2.70 a person. California’s $6.01 million works out to about $7 for each of the more than 855,000 affected Californians, before any administrative costs.
What it means for Californians
For the Bay Area, where 23andMe grew from a consumer-genomics startup into a public company, the settlement closes a chapter that began with a breach in October 2023 and ended with the company’s customer data in the hands of a nonprofit led by its founder. The state’s broader legal question about genetic data in bankruptcy remains unresolved at the appellate level.
The attorney general’s office said California customers retain the right under state law to ask the company to delete their genetic data, destroy their saliva samples and withdraw consent for research use, all through their 23andMe account settings. The announcement did not say how or when settlement money would reach consumers.
Thomas Walper, the plan administrator, signed the stipulation on behalf of Chrome Holding and the trust.
