California Attorney General Rob Bonta announced on Monday, October 19 2026 that California will receive a $6 million settlement from 23andMe’s bankruptcy estate, resolving the state’s legal claims over the 2023 data breach.
The breach exposed genetic and personal data of about 6.9 million 23andMe customers. More than 855 thousand of the affected customers are Californians, according to the attorney general’s office. As part of its bankruptcy proceedings, 23andMe agreed to pay $46.75 million to victims of the 2023 data breach. The company filed for bankruptcy in March 2025 after declining demand and legal fallout from the breach.
As part of the bankruptcy, 23andMe agreed to sell its assets for $305 million to TTAM Research Institute, a non-profit controlled by co-founder Anne Wojcicki. California attempted to block the $305 million sale, arguing it violated the state’s Genetic Information Privacy Act and lacked express consumer consent. A U.S. bankruptcy judge rejected California’s objections to the sale and later ruled the state could not sue to recover money from the bankrupt company’s successor.
California lost a federal district‑court appeal over the sale and agreed to drop further appeals as part of the $6 million settlement. During the bankruptcy sale process, 23andMe customers could delete their data. California contended the court should have barred any data transfer without express consent. In a statement, Bonta said he is proud to fight for Californians’ privacy rights and to deliver the settlement for consumers who trusted 23andMe, and he reminded Californians that they can delete their private genetic data regardless of who owns it.
Join the discussion