California secures $6 million 23andMe settlement over data breach claims

Traders Union
All News
Regulators
California 23andMe settlement

Highlights

California secured a $6 million settlement from 23andMe in exchange for dropping further appeals over its $305 million asset sale to TTAM Research Institute.
A bankruptcy judge and a federal district court both rejected California's attempts to block the sale and pursue additional monetary recovery against 23andMe's successor.
23andMe agreed to pay $46.75 million to victims of the 2023 data breach—which exposed over 855,000 Californians' genetic data—as part of its bankruptcy proceedings.

Bankruptcy settlement and privacy dispute

As reported by Reuters, citing court documents filed on Monday, California agreed to drop further appeals over 23andMe's asset sale in exchange for the $6 million settlement payment. The state had tried to block the $305 million sale of 23andMe assets to TTAM Research Institute, a nonprofit controlled by co-founder Anne Wojcicki, arguing the transaction violated California's Genetic Information Privacy Act because customers did not give express consent to the sale.

23andMe, once a leading DNA testing kit company, filed for bankruptcy in March 2025 as demand weakened and legal fallout from the data breach mounted. A U.S. bankruptcy judge rejected California's objections to the sale and later ruled that the state could not pursue monetary recovery from the bankrupt company's successor, while a federal district court also rejected the state's appeal.

Consumer impact and broader liabilities

California Attorney General Rob Bonta said the settlement delivers compensation for consumers who entrusted their data to 23andMe and reiterated that customers can still delete their private genetic data regardless of ownership. The attorney general's office said the breach exposed the genetic information of more than 855,000 Californians.

Customers retained the option to delete their data during the bankruptcy sale process, but the state had argued the court should bar any transfer unless 23andMe first obtained express customer consent. Separately, 23andMe agreed to pay $46.75 million to victims of the 2023 data breach as part of its bankruptcy proceedings.

Our earlier coverage of CTOS Digital’s cybersecurity incident examined how service disruptions and remediation efforts can quickly translate into market pressure and earnings risk. We noted that the company expected the breach to dent profit and revenue, and that analysts warned prolonged outages could raise costs and undermine customer confidence even after services begin to recover.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.