California’s $6.01 Million 23andMe Data Breach Settlement, No Claim Form Yet, and What Chrome Holding Co.’s Deal Means for Your Genetic Data

California Attorney General Rob Bonta announced a proposed $6,010,000 settlement with Chrome Holding Co., formerly known as 23andMe Holding Co., resolving California’s legal claims over the company’s 2023 data breach and the sale of customers’ genetic information during bankruptcy.

The agreement was filed in the U.S. Bankruptcy Court for the Eastern District of Missouri on October 19, 2026. As of October 20, 2026, California’s official announcement says it is pending court approval.

There is no new public claim form for consumers to collect a share of this $6.01 million. The money is payable to California, not divided automatically among individual customers. The Attorney General may use it for consumer relief related to the breach and the costs of providing that relief. Any amount left after one year must go to California’s Unfair Competition Law Fund, which supports consumer-protection enforcement.

The agreement also resolves California’s appeals and related disputes over the transfer of customers’ genetic data during the bankruptcy. Consumers can still ask 23andMe to delete their data, destroy stored samples and withdraw research consent, subject to applicable law.

This is separate from the private 23andMe data breach settlement, which has already paid approved claims. Do not confuse the two.

Quick Facts: California’s Settlement With Chrome Holding Co. (23andMe)

Detail	Verified information
Exact settlement amount	$6,010,000
Company	Chrome Holding Co., formerly 23andMe Holding Co.
Related company	ChromeCo, Inc., formerly 23andMe, Inc.
Government plaintiff	The People of the State of California
Attorney General	Rob Bonta
California court case	The People of the State of California v. Chrome Holding Co., et al., Case No. CGC-26-636891
State court	Superior Court of California, City and County of San Francisco
Bankruptcy case	In re Chrome Holding Co., Case No. 25-40976-357 (Document 2760)
Bankruptcy court	U.S. Bankruptcy Court for the Eastern District of Missouri
Agreement filed	October 19, 2026
Status as of October 20, 2026	Filed; California says court approval is pending
Payment timing	Within 10 calendar days after court approval, subject to the agreement’s terms
Individual payout	No individual amount specified
New consumer claim form	None announced
Separate private settlement	$46,750,000; payments for approved claims issued September 29–30, 2026
Consumer privacy options	Request data deletion, sample destruction or withdrawal of research consent

What Did California Allege in Its Lawsuit Against Chrome Holding Co. and ChromeCo, Inc.?

California sued Chrome Holding Co., ChromeCo, Inc. and Does 1 through 50 on May 27, 2026, in San Francisco Superior Court. The complaint alleged that 23andMe failed to take reasonable steps to protect highly sensitive customer information and made misleading statements about its security practices and the extent of the breach.

These were allegations in a government complaint, not trial findings. The settlement resolves the dispute without an admission of liability.

Which California Laws Did the State Cite Against 23andMe?

The state alleged violations of several laws, summarized here with their code sections:

• Genetic Information Privacy Act (Civil Code § 56.18 et seq.): Protects genetic data collected through direct-to-consumer genetic testing. It requires separate, express consent before a company discloses or sells a consumer’s genetic data or stored biological sample.
• Reasonable data security requirement (Civil Code § 1798.81.5): Requires businesses that hold California residents’ personal information to maintain reasonable security procedures.
• California Consumer Privacy Act (Civil Code § 1798.100 et seq.): Gives consumers rights over their personal information. Section 1798.150 separately lets consumers sue for certain data breaches caused by a business’s failure to maintain reasonable security, with statutory damages set per consumer per incident.
• False Advertising Law (Business and Professions Code § 17500 et seq.): Prohibits false or misleading statements in advertising. Civil penalties of up to $2,500 per violation are available under § 17536.
• Unfair Competition Law (Business and Professions Code § 17200 et seq.): Prohibits unlawful, unfair or fraudulent business practices. Section 17206 allows civil penalties of up to $2,500 per violation in actions brought by the Attorney General.

California’s data-breach notification statute (Civil Code § 1798.82) also governs how and when businesses must notify affected residents, though the sources reviewed do not say it was a pleaded count.

How Did the 2023 23andMe Data Breach Happen?

According to California’s complaint, the attack used credential stuffing, which tries usernames and passwords stolen from other breaches on a different service. The complaint alleged attackers accessed approximately 14,000 customer accounts over several months, then used the DNA Relatives feature to obtain information tied to nearly 7 million customers.

Exposed information included names, ancestry information, genetic relationships and other profile details, and for some users sensitive health or genetic information. The complaint also alleged 23andMe received warnings about possible compromises before it disclosed the breach on October 6, 2023, and failed to act adequately.

Genetic data is different from a password or card number. It reveals family relationships and ancestry, and it cannot be replaced once exposed.

How Will California Use the $6,010,000 From Chrome Holding Co.?

The Plan Administration Trust must pay California $6,010,000 within 10 calendar days after the court approves the stipulation. The Attorney General has discretion to use the money for consumer relief related to the 2023 breach and the costs of providing it. Whatever is not used for that purpose must be transferred within one year to the Unfair Competition Law Fund.

The agreement does not set a fixed amount per affected customer, and it does not create a claims administrator or a process for customers to file claims. It does require the Plan Administration Trust to provide identifying and contact information for California residents whose data was accessed, to the extent reasonably necessary to distribute consumer relief. That may help California deliver relief later, but the agreement does not say what form it will take or who will qualify.

Wait for an official California announcement before assuming you can claim money.

Is California’s $6.01 Million Deal the Same as the $46.75 Million 23andMe Consumer Settlement?

No. These are two separate resolutions of the same underlying breach.

The private settlement resolved In re: 23andMe, Inc. Customer Data Security Breach Litigation, first consolidated in the U.S. District Court for the Northern District of California and later handled through the bankruptcy. The court-authorized settlement website reports final approval on January 30, 2026, a bankruptcy-court-approved final amount of $46.75 million on July 7, 2026, and payments for approved claims on September 29–30, 2026. Its claim deadline was February 17, 2026, and has passed.

Question	California’s $6.01M settlement	Private 23andMe settlement
Purpose	Resolve California’s enforcement claims and related bankruptcy disputes	Compensate eligible members of the private consumer litigation
Who receives the money?	State of California	Eligible consumers who filed approved claims
Exact amount	$6,010,000	$46,750,000
Individual claim form	None announced	Claim period closed February 17, 2026
Payment status	Pending court approval	Approved claims paid September 29–30, 2026
Can consumers newly apply?	No	No

Do not add the two amounts together as one fund. For background on the private case, see 23andMe Class Action Lawsuit Settlement, $30M Payout Approved, What Eligible Customers Can Expect Next. That article was written earlier, before the final amount reached $46.75 million.

What Happened to 23andMe’s Genetic Data in the Chapter 11 Bankruptcy and TTAM Research Institute Sale?

23andMe filed for Chapter 11 on March 23, 2025. It later sold substantially all its assets to TTAM Research Institute, a nonprofit founded by co-founder and former chief executive Anne Wojcicki. The sale was completed on July 14, 2025, according to the settlement stipulation, and included customer data and biological samples.

California objected, arguing the transfer conflicted with the Genetic Information Privacy Act’s separate-consent requirements. The bankruptcy court rejected the objection, the district court proceedings also went against the state, and California appealed.

Which Bankruptcy Laws Governed the 23andMe Asset Sale?

The sale was approved under the Bankruptcy Code’s asset-sale provisions (11 U.S.C. § 363). When a debtor’s sale includes personally identifiable information and the debtor’s privacy policy limits transfers, § 363(b)(1) and § 332 provide for review, including the possible appointment of a consumer privacy ombudsman. A state’s argument that its own privacy statute blocks a sale runs into the federal bankruptcy court’s authority over the estate, which is the clash California lost in the lower courts.

What Does the October 2026 Agreement Resolve?

California must dismiss the specified actions and appeals with prejudice after the $6,010,000 is paid in full. Dismissal with prejudice generally means the state cannot simply refile the same claim.

The release does not extend to 23andMe Research Institute, formerly TTAM Research Institute, so the deal is not a blanket release of everyone connected to the data transfer. The parties also settled without admitting liability, so it does not prove every allegation in the complaint.

How California Residents Can Delete 23andMe Genetic Data, Samples and Research Consent

California Attorney General Rob Bonta’s October 19 announcement reminds consumers they can request deletion of genetic data, destruction of stored samples and withdrawal of research consent, subject to applicable legal and operational requirements. The Genetic Information Privacy Act and the California Consumer Privacy Act’s deletion right (Civil Code § 1798.105) support these requests.

How to Delete Your 23andMe Data

Per the Attorney General’s published instructions:

1. Log in to your 23andMe account.
2. Open Settings in your profile.
3. Find 23andMe Data and select View.
4. Download a copy of your data first if you want to keep one.
5. Scroll to Delete Data.
6. Select Permanently Delete Data.
7. Follow the confirmation email to finish the request.

If the interface has changed, follow the current official instructions instead of relying on these labels.

How to Request Destruction of a Stored 23andMe Saliva Sample

If you previously let 23andMe keep your saliva sample, the Attorney General says you can review that choice in your account settings under Preferences. Check the current options and follow the official process.

How to Withdraw Research Consent From 23andMe and Its Partners

You can review research permissions under Research and Product Consents in your account settings. Withdrawing research consent is different from deleting data, and the results of either request may depend on legal requirements and records that must be kept.

Important: Deleting your data now does not undo information an attacker copied in 2023. It helps you control what 23andMe still holds.

The California Attorney General’s official settlement announcement has the current instructions.

Do Federal Genetic Privacy Laws Protect 23andMe Customers?

The Genetic Information Nondiscrimination Act (GINA) bars health insurers and employers from using genetic information in coverage and hiring decisions, but it does not directly regulate direct-to-consumer testing companies like 23andMe. The Federal Trade Commission can pursue unfair or deceptive data-security practices under Section 5 of the FTC Act (15 U.S.C. § 45). That is why state laws like California’s carry much of the weight in this area.

What Does the California Attorney General’s 23andMe Settlement Mean for Other Data Breach Victims?

An attorney general’s settlement does not automatically give every affected consumer an individual claim. California’s case enforced privacy and consumer-protection laws on the state’s behalf, while the private litigation had court-approved eligibility rules, claim forms and individual payments.

Other breach cases follow different paths. Some stay putative class actions awaiting certification, others end in regulatory settlements, and others proceed as individual lawsuits.

For comparison, see Nephrology Associates Medical Group Data Breach Lawsuit Investigation, What California Patients Need to Know, which involves a different organization and different alleged exposure. The Citizens Bank Data Breach Class Action Lawsuit 2026, What Happened, Who Is Affected, and What to Do Now shows how a putative class action over a breach can remain unresolved. Check each case’s status, eligibility rules and claims process separately.

If you were affected by a breach, keep your notices, change reused passwords, turn on multifactor authentication and monitor your accounts. These steps reduce future risk but do not decide whether you qualify for compensation.

Key Dates in the California Settlement With Chrome Holding Co.

Date	Event
October 6, 2023	23andMe publicly disclosed the data breach
March 23, 2025	23andMe filed for Chapter 11 bankruptcy
July 14, 2025	Sale of substantially all assets to the purchaser completed, per the stipulation
January 30, 2026	Private consumer settlement received final approval
February 17, 2026	Private settlement claim deadline
May 27, 2026	California filed Case No. CGC-26-636891
July 7, 2026	Bankruptcy court approved the $46.75 million final amount in the private settlement
September 29–30, 2026	Payments for approved private-settlement claims issued
October 16, 2026	California settlement stipulation dated
October 19, 2026	Stipulation filed (Document 2760) and settlement announced
October 20, 2026	Publication cutoff; court approval pending

Frequently Asked Questions About the California 23andMe Settlement

Can I claim money from California’s $6.01 million 23andMe settlement?

No public claim form or individual payout process has been announced. The money is payable to California, and the Attorney General may use it for consumer relief related to the breach and the costs of providing it.

How much is California’s settlement with Chrome Holding Co.?

The exact amount in the filed agreement is $6,010,000. Headlines commonly round it to $6 million.

Is California’s $6.01 million settlement the same as the $46.75 million 23andMe settlement?

No. The $6.01 million agreement resolves California’s government claims and related bankruptcy disputes. The separate $46.75 million private settlement compensated eligible class members, and approved claims were paid on September 29–30, 2026.

Has the court approved California’s 23andMe settlement?

Not as of October 20, 2026. California’s announcement says the filed settlement is pending approval, and payment is due within 10 calendar days after approval, subject to its terms.

What information did the 23andMe breach expose?

According to the California Attorney General, personal and genetic information tied to nearly 7 million customers, which included ancestry, genetic relationships, profile details and, for some users, health-related reports.

Can California residents still delete their 23andMe genetic data?

Yes. The Attorney General says consumers can request deletion of personal data, destruction of stored samples and withdrawal of research consent, subject to applicable legal requirements.

Did 23andMe admit wrongdoing in the California settlement?

No. The stipulation says the parties are resolving the disputes without an admission of liability.

Does the settlement release TTAM Research Institute from all claims?

No. The release expressly does not apply to 23andMe Research Institute, formerly TTAM Research Institute.

Official Sources and Court Records

1. California Department of Justice, October 19, 2026: “Attorney General Bonta Secures $6 Million Settlement in 23andMe Litigation.” Read the announcement
2. U.S. Bankruptcy Court for the Eastern District of Missouri, Case No. 25-40976-357, Document 2760: Joint Stipulation, Global Settlement, and Agreed Order by and Among the Plan Administration Trust, the Wind-Down Debtor, and the People of the State of California, filed October 19, 2026. Read the filed stipulation
3. Court-authorized 23andMe Data Breach Settlement Website: Final approval, the $46.75 million amount and payment status of the private settlement. Read the separate settlement website
4. California Department of Justice, May 28, 2026: “Attorney General Bonta Sues Chrome Holding Co., Formerly Known as 23andMe, Over 2023 Data Breach.” Read the complaint announcement

Disclaimer: This article is for general information only and is not legal advice. AllAboutLawyer.com is a legal information website, not a law firm. No individual claim form for the $6.01 million government payment has been announced.

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against the California Attorney General’s announcement, the filed Joint Stipulation (Document 2760, Case No. 25-40976-357) and the court-authorized 23andMe data breach settlement website (23andmedatasettlement.com), as of October 20, 2026. Last Updated: October 20, 2026.