Chrome Holding Company, the successor to genetic testing firm 23andMe, has agreed to pay California $6 million to resolve allegations that it failed to protect personal and genetic data, enabling a 2023 breach that exposed information on nearly 7 million people. California Attorney General Rob Bonta announced the settlement on Monday.
Terms of the California 23andMe Settlement
The settlement is pending approval by the US Bankruptcy Court for the Eastern District of Missouri. It preserves consumers’ rights to delete their data and to have their genetic samples destroyed. The $6 million payment resolves the state’s allegations that the company did not adequately protect personal and genetic information.
Bonta said companies “cannot evade California’s consumer protection and privacy laws by filing for bankruptcy.” The statement points to the settlement’s central feature: it reaches a company that has already gone through insolvency proceedings.
Bankruptcy and the Sale to TTAM Research Institute
23andMe filed for bankruptcy in March 2025 and sold its genetic data to TTAM Research Institute, a nonprofit led by Anne Wojcicki. TTAM says it is independent and has no role in the California settlement. The remaining corporate entity, Chrome Holding Company, is the party paying the $6 million.
Earlier Multistate Settlement of $18 Million
This is not the first state-level resolution. In July 2026, 23andMe settled with 42 other state attorneys general for $18 million. Together with the California payment, the two settlements account for $24 million in state enforcement over the 2023 breach.
Timeline From Breach to Settlement
The original breach occurred in 2023 and exposed data on nearly 7 million people. The company filed for bankruptcy in March 2025. The multistate settlement followed in July, and California announced its own on Monday.
The announcement frames the case as a test of whether bankruptcy limits state privacy enforcement. Bonta’s statement says it does not. The $6 million payment resolves California’s allegations about the company’s failure to protect personal and genetic data, and the court approval needed is part of the bankruptcy process rather than a separate trial.
The numbers across the two state actions give a sense of the response to the 2023 breach. The company’s $18 million settlement with 42 other state attorneys general came in July 2026, and California’s $6 million followed in October. The breach itself exposed information on nearly 7 million people, and it preceded the company’s March 2025 bankruptcy filing by about a year and a half in the timeline of events.
Consumer Rights Preserved in the Settlement
The settlement preserves the ability of consumers to delete their data and have genetic samples destroyed. That provision matters because the genetic data held by the company was sold to TTAM.
The settlement adds to the enforcement total for the breach and shows state regulators pursuing privacy cases against companies in bankruptcy. Court approval is the remaining step, and the filing in the Eastern District of Missouri will determine when the terms take effect.
The settlement preserves two specific consumer rights: the right to delete data held by the company and the right to have genetic samples destroyed. Those provisions travel with the settlement even though the company has changed hands. TTAM Research Institute, the nonprofit led by Anne Wojcicki that bought the genetic data in the bankruptcy sale, says it is independent of Chrome Holding Company and has no role in the California agreement. The attorney general’s office announced the agreement on Monday, and the bankruptcy court’s approval is the remaining condition before it takes effect.
Genetic data presents a distinct problem in breach cases because it cannot be changed after exposure, unlike a password or a card number. The California action does not describe any specific misuse of the exposed data, and the announcement focuses on the failure to protect it and the rights consumers retain over what remains in the company’s possession.
