Chrome Holding Co., formerly known as 23andMe, is set to pay $6 million to the state of California to settle allegations that it failed to protect customers’ genetic data and sold that data without consent during its bankruptcy process.
The settlement was filed this week in the U.S. Bankruptcy Court in the Eastern District of Missouri and is pending court approval. It resolves two separate lawsuits — one related to a 2023 data breach that affected nearly 7 million 23andMe customers, and another concerning the 2025 sale of genetic data and biological samples following the company’s bankruptcy.
“Companies cannot evade California’s consumer protection and privacy laws by filing for bankruptcy,” California Atty. Gen. Rob Bonta said in a statement. “I am proud to fight for the privacy rights of Californians and to deliver this settlement for consumers who put their trust in 23andMe.”
Co-founded by Anne Wojcicki in 2006, 23andMe popularized at-home genetic testing, allowing customers to send in a saliva sample and receive a DNA analysis. The Mountain View company attracted celebrity attention and spawned a cottage industry of ancestry hunters and true crime sleuths. After it went public in 2021, 23andMe was briefly valued at $6 billion.
However, the business never turned a profit, failed to attract repeat customers and fell victim to internal squabbles. Last March, it filed for Chapter 11 bankruptcy and was sold to TTAM Research Institute, a nonprofit founded by Wojcicki and based in Palo Alto.
The sale raised concerns that sensitive genetic data could fall into the wrong hands. The California Department of Justice tried to block the sale, arguing it was inconsistent with California’s Genetic Information Privacy Act, which requires a customer’s explicit consent before the sale or transfer of genetic data.
Although the Bankruptcy Court and the District Court overruled the Department of Justice’s objection, the department later appealed that decision, leading to this week’s settlement.
Meanwhile, TTAM Research Institute has ambitions of reaching 100 million users and is selling ancestry kits as well as more expensive DNA and blood analysis services.
The $6-million settlement also resolves allegations against Chrome Holding Co., the corporate debtor name that 23andMe is operating under during bankruptcy. Bonta sued Chrome Holding Co. earlier this year, saying that 23andMe did not do enough to protect its customers’ data.
A 2023 investigation by the California Department of Justice found that hackers were able to operate within 23andMe’s systems for five months without being detected. The company only began investigating once the data were offered for sale on the dark web, the investigation found.
“23andMe collected genetic data about millions of people and failed to meet its obligation to keep that information safe,” Bonta said.
The exposed data contained sensitive material such as raw genetic information and health reports that pertained to more than 850,000 Californians.
Under the Genetic Information Privacy Act, Californians have the right to permanently delete their personal information from direct-to-consumer genetic testing databases. Roughly 2 million people requested that 23andMe delete their data during the bankruptcy process.
Customers can still delete their data by logging onto their 23andMe account and navigating to settings, according to the state attorney general. They are also able to download a copy of the data.
“I want to remind Californians that customers of 23andMe can delete their private, genetic data — no matter who owns it,” Bonta said.
