California Settles Legal Claims Over 23andMe Data Breach
The state secures a $6 million payment following a 2023 breach that compromised the genetic data of over 855,000 residents.
Updated on Oct. 19, 2026 in Cybersecurity
Live Poll
Do you trust that companies handling genetic information prioritize consumer privacy over corporate financial interests?
California has finalized a settlement agreement regarding the 2023 23andMe data breach, which exposed the personal information of 6.9 million total customers. As part of the resolution, the state will receive $6 million following the company's March 2025 bankruptcy filing.
Why it matters
The settlement concludes California's legal challenge against the $305 million sale of 23andMe assets, which officials argued violated the Genetic Information Privacy Act. By accepting the deal, the state agrees to drop further appeals regarding the sale process.
The 2023 breach compromised the records of 6.9 million customers, including the genetic information of more than 855,000 Californians. In addition to the state payment, 23andMe agreed to pay $46.75 million in total compensation to affected victims.
The players
23andMe
This biotechnology company provides consumer genetic testing services and maintains large databases of customer health and ancestry information.
California
The state government acted as the primary legal challenger to protect the privacy rights of its residents during the company's bankruptcy.
The details
California authorities had initially opposed the $305 million asset sale, asserting it did not sufficiently protect consumer privacy under state law. Despite the settlement, individual customers retain the option to permanently delete their personal data as part of the ongoing bankruptcy process.
Timeline
The data breach exposed 6.9 million customer records in 2023.
23andMe filed for bankruptcy in March 2025.
California announced the settlement agreement on October 19, 2026.
The Tech Race
This settlement highlights the growing tension between personal data ownership and corporate liquidation strategies in the biotech sector. It signals a shift in how states utilize the Genetic Information Privacy Act to force accountability from companies during bankruptcy proceedings.
Californians whose genetic data was exposed in the 2023 breach should monitor the bankruptcy proceedings for instructions on receiving their portion of the $46.75 million compensation fund. Users also maintain the right to request the deletion of their stored genetic information from the company's systems.
The takeaway
This case underscores the importance of managing your privacy settings in dormant online accounts that hold sensitive biological data. Users should proactively delete accounts they no longer utilize to minimize the scope of potential future information leaks.
Further reading
For more on the current state of digital privacy in the region, visit California Cybersecurity.
Live Poll
Do you trust that companies handling genetic information prioritize consumer privacy over corporate financial interests?
