Chrome Holding Co., the company formerly known as 23andMe, has agreed to pay $6 million to the state of California to resolve allegations related to inadequate protection of customer genetic data and the unauthorized sale of such data during its bankruptcy proceedings. The proposed settlement, filed this week in the U.S. Bankruptcy Court for the Eastern District of Missouri, awaits court approval and addresses two lawsuits stemming from incidents in 2023 and 2025.
The first lawsuit concerns a major data breach in 2023 that exposed the genetic information of nearly 7 million 23andMe customers. An investigation by the California Department of Justice revealed that hackers accessed the company’s systems for approximately five months without detection. The breach involved sensitive information, including raw genetic data and health reports affecting over 850,000 California residents. Authorities found that the company only acted after the stolen data appeared for sale on the dark web.
The second lawsuit centers on the sale of genetic data and biological samples following 23andMe’s Chapter 11 bankruptcy filing in March 2025. The company was acquired by TTAM Research Institute, a nonprofit founded by 23andMe co-founder Anne Wojcicki and based in Palo Alto. The California Department of Justice challenged the sale, arguing it violated the Genetic Information Privacy Act, which prohibits the sale or transfer of genetic information without explicit customer consent. Although bankruptcy and district courts initially overruled the department's objection, the state appealed, culminating in the current settlement.
“Companies cannot evade California’s consumer protection and privacy laws by filing for bankruptcy,” California Attorney General Rob Bonta said in a statement. “I am proud to fight for the privacy rights of Californians and to deliver this settlement for consumers who put their trust in 23andMe.” Bonta also emphasized that customers retain the right to delete their genetic data at any time, regardless of ownership changes.
Founded in 2006, 23andMe gained popularity by offering at-home genetic testing services that analyze saliva samples to provide ancestry and health-related insights. The Mountain View, California-based company achieved a peak valuation of $6 billion following its 2021 public listing but struggled with profitability, customer retention, and management conflicts. After filing for bankruptcy, 23andMe’s business operations continued under Chrome Holding Co., its corporate debtor name.
TTAM Research Institute plans to expand the user base to 100 million, offering both ancestry kits and advanced DNA and blood analysis services. The $6 million settlement addresses the state’s concerns about protecting consumer genetic data and upholds California’s stringent privacy regulations in the rapidly evolving direct-to-consumer genetic testing industry.
Customers who used 23andMe’s services can still delete their genetic information by accessing their accounts and following instructions in the settings menu. They also have the option to download their data. Approximately 2 million people requested data deletion during the bankruptcy process, according to the California Department of Justice.