California Attorney General Rob Bonta announced Monday that Chrome Holding Company, formerly known as 23andMe, will pay $6 million to resolve allegations that it failed to protect customers' personal and genetic data, leading to a 2023 breach that exposed information belonging to nearly 7 million people. The settlement is pending approval by the U.S. Bankruptcy Court in the Eastern District of Missouri.
Under the agreement, affected consumers retain the right to delete their data and request that genetic samples be destroyed. Bonta said companies cannot evade California's consumer protection and privacy laws by filing for bankruptcy. The company filed for bankruptcy in March 2025 and sold customers' saliva samples and genetic data to the TTAM Research Institute, a nonprofit created by former CEO Anne Wojcicki.
TTAM said in a statement that it is a newly established independent nonprofit and was not involved in the settlement or the underlying matters. The California settlement follows a separate $18 million agreement with 42 state attorneys general in July. Chrome Holding Company did not provide comment.