Attorney General Bonta Secures $6 Million Settlement in 23andMe Litigation
Consumers maintain right to ask company to delete their data
OAKLAND — California Attorney General Rob Bonta today secured a $6 million settlement with Chrome Holding Co., formerly known as 23andMe. The settlement, which was filed in the U.S. Bankruptcy Court in the Eastern District of Missouri and is pending court approval, resolves allegations that the company failed to protect its customers’ personal information and genetic data resulting in a 2023 data breach. Today's settlement also resolves Attorney General Bonta's appeal from the denial of his objection under California law to the sale of Californians' genetic information and samples in the course of the bankruptcy without their affirmative consent. Affected consumers retain the right to request the deletion of their information and the destruction of their samples.
“23andMe collected genetic data about millions of people and failed to meet its obligation to keep that information safe. Companies cannot evade California’s consumer protection and privacy laws by filing for bankruptcy,” said Attorney General Bonta. “I am proud to fight for the privacy rights of Californians and to deliver this settlement for consumers who put their trust in 23andMe. I want to remind Californians that customers of 23andMe can delete their private, genetic data — no matter who owns it.”
BACKGROUND
Founded in San Francisco, 23andMe was the first and one of the largest direct-to-consumer genetic testing companies in the world. Customers sent their saliva samples to 23andMe for DNA analysis. The company stored data on consumers’ raw DNA sequence and used that information to provide consumers with reports about their ancestry, ethnicity, and genetic health predispositions.
In 2023, DOJ initiated an investigation into 23andMe after reports of a data breach that impacted nearly 7 million 23andMe customers across the United States, including more than 855,000 Californians.
In March 2025, 23andMe filed for bankruptcy and sold certain assets, including the genetic data and biological samples of its customers, to TTAM Research Institute, a non-profit established by the co-founder and former CEO of 23andMe. The California Department of Justice (DOJ) objected to the sale because it was inconsistent with California's Genetic Information Privacy Act, which requires a customer’s separate and explicit consent before the sale or transfer of genetic data and biological samples. DOJ's objection to the asset sale under the Genetic Information Privacy Act was denied by both the Bankruptcy Court and the District Court, and today's settlement also resolves DOJ's appeal of those orders.
Separately, DOJ filed a lawsuit against Chrome Holding Co., 23andMe’s successor, in California state court alleging that 23andMe violated California law because its unreasonable data security practices led to the 2023 data breach and that the company made certain misrepresentations that misled its customers and the public. DOJ also filed a counterpart claim in the Bankruptcy proceeding.
Today’s settlement secures a $6 million payment to resolve the pending claims between 23andMe and DOJ.
CALIFORNIA CONSUMERS’ RIGHT TO DELETION
In addition to announcing the settlement, Attorney General Bonta reminds Californians that California law provides them with the right to control the use of their personal and sensitive data. This includes the right, under the Genetic Information Privacy Act, to request that direct-to-consumer genetic testing companies delete or destroy any of their personal data that the company maintains on them. With regard to the genetic data or samples maintained by 23andMe Research Institute, consumers can request that the company delete their data, destroy their test sample, or revoke their permission for their genetic data to be used for research.
To Delete Your Genetic Data from 23andMe:
1. Log into your 23andMe account on their website.
2. Go to the “Settings” section of your profile.
3. Scroll to a section labeled “23andMe Data” at the bottom of the page.
4. Click “View” next to “23andMe Data.”
5. Download your data: If you want a copy of your genetic data for personal storage, choose the option to download it to your device before proceeding.
6. Scroll to the “Delete Data” section.
7. Click “Permanently Delete Data.”
8. Confirm your request: You’ll receive an email from 23andMe; follow the link in the email to confirm your deletion request.
To Destroy Your 23andMe Test Sample:
If you previously opted to have your saliva sample and DNA stored by 23andMe, but want to change that preference, you can do so from your account settings page, under “Preferences.”
To Revoke Permission for Your Genetic Data to be Used for Research:
If you previously consented to 23andMe and third-party researchers to use your genetic data and sample for research, you may withdraw consent from the account settings page, under “Research and Product Consents.”
Legal Disclaimer:
EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.
