Estimated reading time: 8 minutes.
Key facts
- What happened: California Attorney General Rob Bonta announced on October 19, 2026, that Chrome Holding Co., the company formerly known as 23andMe, agreed to pay California $6.01 million over the 2023 data breach and the sale of customers' genetic data in bankruptcy.
- The case: In re Chrome Holding Co. (f/k/a 23andMe Holding Co.), No. 25-40976, in the U.S. Bankruptcy Court for the Eastern District of Missouri. The settlement is a joint stipulation filed on October 19, 2026, as Docket No. 2760.
- Who it covers: The attorney general says the breach affected nearly 7 million 23andMe customers nationwide, including more than 855,000 Californians.
- Where the money goes: The attorney general may use the money for consumer relief related to the breach. Any money not used that way within a year goes to a state consumer protection enforcement fund.
- Other terms: The bankruptcy estate may not make direct consumer sales or collect personal information for five years, and California will drop its pending lawsuit and appeals.
- Status: The agreement is filed with the bankruptcy court and is described as pending approval. There is no claim form, and no consumer relief plan has been announced.
In this article
- What the settlement does
- Why California was fighting 23andMe in bankruptcy
- How this differs from the class action payout
- How to delete your 23andMe data
- Timeline
- Who may be affected and what you can do now
- What remains unresolved
- What happens next
- Frequently asked questions
What the settlement does
The agreement is between California and the Plan Administration Trust, which is winding down what is left of 23andMe after its bankruptcy. Under the stipulation, the state's claims are allowed at $6,010,000. The trust must pay that amount in a lump sum within 10 calendar days after the court approves the stipulation.
That payment would resolve every pending dispute between California and the bankruptcy estate. Within four business days of being paid, California must dismiss its state court lawsuit, its appeal of a July 2026 bankruptcy court order, and its appeal over the sale of 23andMe's assets.
The stipulation says the trust will give the attorney general the names and contact information of California residents whose data was exposed, to the extent needed to distribute consumer relief. It also bars the remaining 23andMe entities from direct consumer sales and from collecting or keeping personal information for five years, except as the bankruptcy plan requires.
Neither side admits liability.
Court approval is still a step The attorney general describes the settlement as pending court approval, and payment is due only after approval. A footnote in the stipulation says the trust believes it could settle without the court but filed the agreement to give the parties certainty.
Why California was fighting 23andMe in bankruptcy
23andMe disclosed in October 2023 that a hacker had accessed information about some of its customers. The California Department of Justice began investigating that year.
23andMe filed for Chapter 11 bankruptcy on March 23, 2025. The court approved the sale of substantially all of its assets, including customers' genetic data and saliva samples, and the sale closed on July 14, 2025. According to the attorney general, the buyer was TTAM Research Institute, a nonprofit set up by 23andMe's co-founder and former CEO.
California objected to the sale under the state's Genetic Information Privacy Act, which requires a customer's separate and explicit consent before genetic data or samples are sold or transferred. The bankruptcy court overruled that objection, and on September 29, 2026, the federal district court affirmed and dismissed California's appeal. California filed a notice of appeal to the Eighth Circuit on October 16, 2026, the same day the stipulation was signed.
Separately, the state sued Chrome Holding in San Francisco Superior Court on May 27, 2026, alleging that weak data security led to the breach and that the company misled customers. In a July 10, 2026, order, the bankruptcy judge ruled that California had to drop or narrow the money claims in that suit, finding they were covered by the bankruptcy plan. California appealed. The settlement ends all of those fights.
What changes for your data The settlement does not undo the sale to TTAM. The attorney general says customers still have the right to ask the company holding their data to delete it, destroy their sample, or stop using it for research.
How this differs from the class action payout
This is a government settlement, not a class action. It is separate from the nationwide class settlement in In re: 23andMe, Inc. Customer Data Security Breach Litigation, which was first filed in federal court in San Francisco and is now handled in the same bankruptcy case.
According to the class settlement website, final approval was granted on January 30, 2026, the court approved a final settlement amount of $46.75 million on July 7, 2026, and payments for approved claims went out on September 29 and 30, 2026. The site says the breach involved personal information of about 6.4 million U.S. residents. Bloomberg Law reported that Chrome also agreed in July to pay $18 million to 42 states.
Government money, not a class payout The $6.01 million goes to the California attorney general, who decides how to use it for consumer relief. It does not reopen the class action claims process or add money to it.
How to delete your 23andMe data
The attorney general's announcement gives these steps for deleting genetic data:
- Log in to your 23andMe account on the website.
- Go to the Settings section of your profile.
- Scroll to the section labeled 23andMe Data and click View.
- If you want a copy, download your data first.
- Scroll to Delete Data and click Permanently Delete Data.
- Confirm the request through the link in the email you receive.
To have your saliva sample destroyed, change your storage preference under Preferences in account settings. To withdraw consent for research use, go to Research and Product Consents in account settings.
Timeline
| Date | Event |
|---|---|
| October 2023 | 23andMe discloses the data breach |
| March 23, 2025 | 23andMe files for Chapter 11 bankruptcy |
| July 14, 2025 | Sale of 23andMe assets closes |
| May 27, 2026 | California sues Chrome Holding in San Francisco Superior Court |
| July 10, 2026 | Bankruptcy court limits California's state court money claims |
| September 29, 2026 | District court affirms the sale order and dismisses California's appeal |
| October 16, 2026 | Stipulation signed; California appeals to the Eighth Circuit |
| October 19, 2026 | Stipulation filed and settlement announced |
Who may be affected and what you can do now
This settlement matters mainly to California residents whose 23andMe data was exposed in the 2023 breach. There is no form to fill out. If the attorney general creates a consumer relief program, the office would announce how it works.
If you were a 23andMe customer anywhere, you can still use the deletion steps above. Be cautious with emails or texts that claim to offer 23andMe settlement money and ask for payment or account details.
For other cases that are open now, see our list of class action cases you can join.
What remains unresolved
- Court approval. The bankruptcy court has not yet acted on the stipulation, based on what we reviewed.
- The relief plan. The attorney general has not said what form consumer relief will take or who will receive it.
- Backup hearing dates. If the deal is not approved, the parties asked to move a status conference to December 3, 2026, and a hearing on California's claims to December 10, 2026.
This article is for information only and is not legal advice.
What happens next
Once the court approves the stipulation, the trust has 10 days to pay, and California then has four business days to dismiss its cases. We will update this story if the attorney general announces how the money will reach consumers.
Frequently asked questions
What is the 23andMe California settlement?
Chrome Holding Co., formerly 23andMe, agreed to pay California $6.01 million to resolve the state's claims over the 2023 data breach and the sale of genetic data in bankruptcy.
Do I need to file a claim?
No claim process exists. The attorney general may use the money for consumer relief and has not announced a plan.
Is this the same as the 23andMe class action settlement?
No. The class action settlement is separate. Its website says payments for approved claims were issued on September 29 and 30, 2026.
How many Californians were affected?
The attorney general says more than 855,000 Californians were among nearly 7 million customers affected nationwide.
Who owns my 23andMe data now?
According to the attorney general, the data and samples were sold to TTAM Research Institute, a nonprofit set up by 23andMe's co-founder and former CEO.
Can I still delete my genetic data?
Yes. The attorney general says customers can request deletion, sample destruction, or withdrawal of research consent through account settings.
