Attorney General Bonta Secures $6 Million Settlement in 23andMe Litigation

What happened

Attorney General Rob Bonta reached a $6 million settlement with Chrome Holding Co., the successor to 23andMe, over a 2023 breach affecting nearly 7 million customers, including 855,000 Californians. The settlement also resolves disputes about the sale of genetic data and samples without affirmative consent under California's Genetic Information Privacy Act. The company must honor deletion requests for data and samples. The payment resolves both state and bankruptcy court claims.

Why it matters

Any direct‑to‑consumer genetic testing firm operating in California must obtain separate, explicit consent before transferring or selling genetic data and must be able to delete that data on request, or risk similar penalties.

Business impact

Failure to secure explicit consent and robust data protection could trigger costly settlements and damage consumer trust.

Checklist

• Obtain explicit consentHigh priority

  Secure separate, affirmative consent before selling or transferring any genetic data or biological samples.

• Enhance data securityHigh priority

  Implement technical and organizational measures to protect genetic information from breaches.

• Enable deletion requestsMedium priority

  Provide a clear, accessible process for consumers to request deletion of their genetic data and destruction of samples.

Who reported it

Discussion