Chrome Holding Co. settles with California for $6 million over 23andMe data breach

Chrome Holding Co., the entity formerly known as 23andMe, has agreed to a $6 million settlement with California to resolve allegations regarding a 2023 data breach. The breach affected nearly 7 million customers nationwide, including more than 855,000 residents of California.

The settlement, which is pending approval in the U.S. Bankruptcy Court for the Eastern District of Missouri, addresses claims that the company’s data security practices were unreasonable and that it misled the public. The agreement ensures that affected consumers retain the right to delete their genetic data, have saliva samples destroyed, and withdraw research consent.

Following its March 2025 bankruptcy filing, 23andMe sold its assets, including biological samples and genetic data, to the TTAM Research Institute, a nonprofit founded by the company’s co-founder and former CEO, Anne Wojcicki. California had previously challenged this sale under the Genetic Information Privacy Act, but the settlement concludes the state's legal challenges. This follows a separate $18 million settlement reached in July with a coalition of 42 other state attorneys general.