The short version
- California Attorney General Rob Bonta announced a $6 million settlement resolving state claims related to the 2023 breach and subsequent asset sale.
- Federal courts rejected California's attempts to block the transfer of data to TTAM Research Institute, ruling that consumers had not given express consent for the specific transaction.
- The resolution concludes legal challenges regarding the bankruptcy sale, while customers retain the ability to delete their genetic information from the new owner's database.
California has reached a financial settlement with the bankrupt entity formerly known as 23andMe, bringing closure to a protracted legal dispute over the handling of sensitive genetic data. Attorney General Rob Bonta announced on Monday that the state will receive $6 million as part of the company’s bankruptcy proceedings. This payment resolves California’s specific legal claims concerning a major data breach that occurred in 2023, which compromised the personal and genetic information of millions of users.
The incident exposed the private data of approximately 6.9 million customers globally, including more than 855,000 residents of California. The state had pursued legal action to challenge the transfer of this sensitive information during the company’s financial collapse. Officials argued that the sale violated the Genetic Information Privacy Act, a law designed to protect consumers from unauthorized use of their biological data. The core contention centered on whether customers had provided explicit consent for their data to be transferred to a new owner.
The legal conflict intensified when 23andMe filed for bankruptcy in March 2025. Facing declining demand and significant liability from the breach, the company sought to auction its assets. A US bankruptcy judge approved the sale of these assets to TTAM Research Institute, a nonprofit organization controlled by Anne Wojcicki, one of the company’s co-founders. California officials moved to block this transaction, asserting that the transfer of genetic data required direct, express consent from each individual customer, which had not been obtained.
Despite the state’s objections, federal courts ruled against California’s efforts to halt the sale. A bankruptcy judge determined that the transfer did not violate existing protections in a way that would justify blocking the auction. Subsequently, a federal district court upheld this decision, ruling that the state could not sue to recover funds from the successor entity. After losing an appeal regarding the sale, California agreed to drop further legal challenges as part of the settlement agreement filed on Monday.
The $6 million payment represents a fraction of the total financial obligations associated with the breach. As part of its bankruptcy plan, 23andMe had already agreed to pay $46.75 million to victims affected by the 2023 security failure. The settlement with California specifically addresses the state’s regulatory claims and the legal costs incurred during the fight over the asset sale. It does not alter the compensation structure for individual consumers, who are covered under the broader victim payment plan.
Attorney General Bonta emphasized the importance of consumer privacy rights in his statement regarding the settlement. He noted that while the financial resolution provides some recourse for the state, the primary protection for individuals remains their ability to control their own data. Bonta reminded Californians that they retain the option to delete their private genetic information from the database, regardless of which entity currently owns it. This right persists even as the data resides with TTAM Research Institute.
The case highlights the complex intersection of bankruptcy law and data privacy regulations. While 23andMe was once a leader in direct-to-consumer DNA testing, its collapse underscores the risks associated with storing large volumes of sensitive biological information. The failure to secure explicit consent for the data transfer became a central point of contention, illustrating how consumer protection laws are tested during corporate insolvency.
Moving forward, TTAM Research Institute will manage the remaining assets and data of the former company. The settlement ensures that California’s legal claims are satisfied without further litigation, allowing the nonprofit to proceed with its operations. For consumers, the immediate implication is the continued availability of their data within the new framework, alongside the persistent option to request deletion. The resolution marks the end of a significant chapter in the oversight of genetic privacy in the United States.
The broader implications for the biotechnology sector remain under scrutiny. Other companies holding similar data may face increased pressure to clarify consent mechanisms and ensure compliance with state-specific privacy laws. California’s aggressive stance on this issue signals a continued commitment to enforcing strict standards for genetic information, even when corporate restructuring complicates traditional regulatory enforcement. The outcome serves as a precedent for how future breaches and bankruptcies involving sensitive data might be handled.
Sources behind this briefing
Go to the original reporting
- The Guardian World↗California to recieve $6m settlement after 23andMe data breach
