California settles with 23andMe for $6 million: how to delete your genetic data
The state's privacy fight with the bankrupt DNA testing company is ending. Your right to delete your data and destroy your sample still stands.
California has settled its privacy fight with the company that used to be 23andMe. On October 19, 2026, Attorney General Rob Bonta announced a $6 million settlement with Chrome Holding Co., the bankrupt company formerly known as 23andMe. If you or anyone in your family ever spit in a tube for a 23andMe kit, the most useful part of the announcement is a reminder: you can still ask for your genetic data to be deleted and your sample destroyed.
What happened
In October 2023, 23andMe disclosed a data breach. According to the Attorney General's office, it affected nearly 7 million U.S. customers, including more than 855,000 Californians. Reuters puts the number at 6.9 million customers whose genetic and other personal information was exposed.
The company filed for bankruptcy in March 2025. Its customers' genetic data and biological samples were then sold to TTAM Research Institute, a nonprofit set up by 23andMe's co-founder. Reuters reports the sale was valued at $305 million. California objected, arguing that the state's Genetic Information Privacy Act requires separate, explicit consent before genetic data and samples change hands. The bankruptcy court and a federal district court both rejected that objection, and California had just filed a further appeal.
The new deal ends that fight. The settlement filed in bankruptcy court on October 19 sets the payment at $6,010,000, due within 10 days after the court approves it. Once paid, California drops its appeals and its state court lawsuit. The company also agrees not to make direct consumer sales or collect personal information for five years, apart from data it must keep to wind down. The filing says the deal is made without any admission of liability.
What it means for you
Here is what is confirmed and what is not.
Confirmed: the settlement has been filed and, according to the Attorney General, is pending court approval. Its terms are in the court filing linked above.
Also confirmed: the settlement does not decide who holds your genetic data. That data went to the buyer in the 2025 sale. The filing refers to that buyer as 23andMe Research Institute, formerly TTAM Research Institute, and says California's release of claims "shall in no way apply" to it.
Not confirmed: whether individual Californians will get money. The filing says the Attorney General may use the funds for consumer relief related to the breach, and that unused money goes to a state consumer protection fund. It does not promise payments to individuals, and no claim process has been announced. Treat any email or text offering you a "23andMe settlement payment" with care, and check it against the Attorney General's site before clicking anything.
Separately, Reuters reports that 23andMe agreed in its bankruptcy to pay $46.75 million to breach victims. That is a different settlement from California's.
The bigger point is about bankruptcy. "Companies cannot evade California's consumer protection and privacy laws by filing for bankruptcy," Bonta said in the release. Even so, the data itself moved to a new owner. Your best protection is the right to delete, and that right did not go away. The release says affected consumers keep the right to request deletion of their information and destruction of their samples.
What to do now
If you have a 23andMe account, the Attorney General's release lays out these steps:
- Log in to your 23andMe account and open Settings in your profile.
- Scroll to "23andMe Data" at the bottom of the page and click View.
- Download a copy of your data first if you want to keep it.
- In the Delete Data section, choose permanent deletion.
- Confirm the request through the link in the email 23andMe sends you.
To have your saved sample destroyed, change your sample preference under Preferences in your account settings. To stop research use, withdraw permission under Research and Product Consents.
Do this for each family member who tested. Each account is separate, so a parent deleting their own data does nothing for a teenager's or a grandparent's kit.
If you are not sure whether you ever made an account, your inbox is a good place to look. Ghostifier reads who has emailed you and the subject lines, never the contents of your messages, so it can show you which companies have been emailing you. From there it can unsubscribe you, opt you out and send deletion requests, including to data brokers on paid plans. For your genetic data specifically, the steps in your 23andMe account are the direct route, and they are worth doing today.
This is general information, not legal advice. If you have questions about your rights in your state, check with your state attorney general's office.