What the settlement resolves

The $6m payment settles California's legal claims tied to the 2023 23andMe data breach, which exposed the genetic and other personal information of 6.9 million customers, according to the attorney general's announcement on Monday.

The attorney general's office said the breach exposed the genetic information of more than 855,000 Californians. Separately, 23andMe agreed to pay $46.75m to victims of the breach as part of its bankruptcy.

California's challenge to the bankruptcy sale

The state had tried and failed to block the $305m sale of 23andMe assets to TTAM Research Institute, a nonprofit controlled by co-founder Anne Wojcicki. California argued the bankruptcy sale violated California's Genetic Information Privacy Act and that consumers did not give express consent to the sale.

23andMe filed for bankruptcy in March 2025, seeking to sell its business at auction after declining demand and legal fallout from the breach. A US bankruptcy judge ruled against California's objections and later ruled that the state could not sue to recover money from the bankrupt company's successor. California then lost an appeal over the sale in federal district court.

What customers can do with their data

Customers of 23andMe retained the option to delete their data during the bankruptcy sale process. Bonta reminded Californians that customers can delete their private, genetic data – no matter who owns it.