California to receive $6m settlement after 23andMe data breach

California’s attorney general, Rob Bonta, on Monday announced the state will receive a $6m settlement payment in 23andMe’s bankruptcy, resolving California’s legal claims related to a 2023 data breach that exposed 6.9 million customers’ ⁠genetic and other ⁠personal information.

California had ​unsuccessfully tried to block the $305m sale of 23andMe assets to TTAM Research Institute, a non-profit controlled by the 23andMe ⁠co-founder Anne Wojcicki. The state had argued that the bankruptcy sale violated California’s Genetic Information Privacy Act, and it had said ⁠consumers did not give express consent to the sale.

Once a trailblazer in DNA testing ​kits, 23andMe filed for bankruptcy in ‌March 2025, seeking to ‌sell its business at auction after a decline in demand and legal ‌fallout from the data breach.

A US bankruptcy judge ruled against California’s objections to the sale, and later ruled that the state could not sue to recover money from the bankrupt company’s successor. California lost an appeal over the sale in federal district court, and it agreed to drop further appeals as ‌part of the $6m settlement, according to court documents filed on Monday.

Customers of 23andMe retained the option to delete their data during ​the bankruptcy sale process, but California had argued that the court should have disallowed the transfer of any data unless 23andMe customers first gave express consent to the sale.

“I am proud to fight for the privacy rights of Californians and to ⁠deliver this settlement for consumers who put their trust in 23andMe,” ​Bonta, a Democrat, ​said in a statement on ​Monday. “I want to remind Californians that customers of 23andMe ​can delete their private, ‌genetic data – no ​matter who owns ​it.”

The data breach exposed the genetic information of more than 855,000 Californians, according to the attorney general’s office.

23andMe agreed to pay $46.75m to victims of the 2023 data breach as part of its bankruptcy.