California Settles 23andMe Claims for $6 Million and a Five-Year Data Bar on the Estate

California's attorney general has settled the state's claims against the remains of 23andMe. A joint stipulation filed October 19, 2026 in the company's Missouri bankruptcy case sets the payment at $6.01 million and bars the estate from collecting consumer data for five years. A judge still has to approve it.

Information last verified on October 22, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This covers California's own enforcement claims against 23andMe's corporate successor and the federal bankruptcy proceeding in the Eastern District of Missouri where they were settled. It does not address the consumer class settlement in that same bankruptcy, the multistate attorneys general settlement, or any private claim an individual might have. For the class case and its closed claim window, see our page where you can track the status of the 23andMe class settlement.

What Happened

On Monday, October 19, 2026, the California Department of Justice announced a $6 million settlement with Chrome Holding Co., the entity formerly known as 23andMe Holding Co. The announcement describes the deal as resolving allegations that the company failed to protect customer personal information and genetic data, which led to a data breach disclosed in October 2023.

The underlying document is a Joint Stipulation, Global Settlement, and Agreed Order filed the same day as Docket No. 2760 in Case No. 25-40976-357 in the U.S. Bankruptcy Court for the Eastern District of Missouri, Eastern Division. A footnote records that the Plan Administration Trust filed it on behalf of the Wind-Down Debtor under the January 21, 2026 case closing order. It was executed on October 16, 2026 by the Plan Administration Trust, the Wind-Down Debtor, and the People of the State of California.

The press release rounds the figure. The stipulation does not. Paragraph 2 allows California's proofs of claim in the total amount of $6,010,000.00, and paragraph 3 obliges the Plan Administration Trust to pay that lump sum within 10 calendar days following the court's approval.

"23andMe collected genetic data about millions of people and failed to meet its obligation to keep that information safe. Companies cannot evade California's consumer protection and privacy laws by filing for bankruptcy,"

Attorney General Rob Bonta, California Department of Justice news release, October 19, 2026

The breach figures have been consistent across California's filings. The Department of Justice's May 28, 2026 release put the reach at nearly 7 million customers nationwide, including 855,541 Californians. The October release describes the California number as more than 855,000.

The settlement is pending, not entered

Both the release and the document are explicit that approval is still required. The stipulation's operative language reads "UPON APPROVAL BY THE COURT OF THIS STIPULATION, IT IS SO ORDERED," and payment runs from that approval.

There is one wrinkle worth knowing. A footnote records the parties' position that under Article VI of the confirmed plan, the Plan Administration Trust may settle a disputed claim without any further order or approval from the bankruptcy court, and that they filed the stipulation with the court anyway "to provide certainty to the Parties." So the parties contend approval is not strictly necessary while simultaneously conditioning payment on it.

Paragraph 8 shows the parties are planning for the possibility that approval does not come. It asks the court to move the status conference on estimation of California's claims from November 3 to December 3, 2026, and the estimation hearing from November 10 to December 10, 2026, in order "to preserve the currently scheduled proceedings in the event this Stipulation is not approved."

As of the CourtListener docket's last update on October 21, 2026 at 4:02 p.m., no order approving the stipulation had been entered. The four entries after Doc. 2760 are a notice of docketing record on appeal filed October 19, a reply filed October 20, and a brief and a Chapter 11 post-confirmation report filed October 21. CourtListener carries the case docket for In re Chrome Holding Co., No. 25-40976, and readers who need current docket status should check there or with the court.

What the Stipulation Says That the Press Release Does Not

The filed document contains material terms that the announcement never mentions. Three of them matter.

A five-year ban on the estate's consumer sales and data collection

The first of the three is paragraph 9.

"The Plan Administration Trust agrees that the Debtors and the Wind-Down Debtor shall be prohibited from engaging in (a) direct consumer sales of goods and services for five years and (b) collection of (or maintenance of) personally identifiable information for five years other than personally identifiable information that the Plan Administration Trust is required to retain under the Plan, the Confirmation Order, or the Plan Administration Trust Agreement to fulfill its obligations or perform its duties under those agreements."

Joint Stipulation, Global Settlement, and Agreed Order, In re Chrome Holding Co., No. 25-40976-357, Doc. 2760, at pages 7 and 8 (Bankr. E.D. Mo. filed Oct. 19, 2026), paragraph 9

Read carefully, this constrains the wind-down estate, which is the entity that still exists on paper. It is not an obligation imposed on the business that now holds the genetic data.

Where the $6 million actually goes

Paragraph 3 provides that the funds "may be used in the sole discretion of the Attorney General of the State of California to provide consumer relief related to the 2023 Cyber Security Incident and for the costs associated therewith," and that any amount not used for that purpose is transferred within one year into the Unfair Competition Law Fund for the exclusive use of the Attorney General in enforcing consumer protection laws.

That is a meaningful distinction for anyone searching for a payout. This is a recovery by the state, with discretionary consumer relief as a permitted use, not a claims fund with a form and a deadline. Paragraph 5 does require the estate to give the Attorney General identifying and contact information for California residents whose information was compromised, to the extent reasonably necessary to distribute the consumer relief in paragraph 3, so distribution is contemplated. The stipulation does not describe what it would look like.

The data buyer is carved out of the release

Paragraph 10 provides that once the Plan Administration Trust pays the settlement amount, California releases the Debtors, the Wind-Down Debtor, their estates, any successors including the Plan Administration Trust, and a long list of affiliated parties from claims arising out of the 2023 incident. It then adds: "For the avoidance of doubt, this release shall in no way apply to 23andMe Research Institute (f/k/a TTAM Research Institute)."

TTAM Research Institute is the nonprofit, established by 23andMe's co-founder and former chief executive, that bought the customer genetic data and biological samples in the 2025 bankruptcy sale. The Washington Attorney General's office noted the rename in its own July 14, 2026 release. The entity holding the data is therefore outside the scope of what California just released.

The Appeals This Ends

The $6 million closes a fight that had been running on two tracks, and the recitals in the stipulation lay out the sequence.

23andMe's corporate predecessors filed Chapter 11 petitions in the Eastern District of Missouri on March 23, 2025. On June 27, 2025 the bankruptcy court entered a sale order approving the sale of substantially all assets and overruling California's objection. California appealed to the district court on July 3, 2025. The sale closed on July 14, 2025.

California's objection rested on the state's Genetic Information Privacy Act. According to the Attorney General's October release, that statute requires a customer's separate and explicit consent before genetic data and biological samples are sold or transferred. Both the bankruptcy court and the district court rejected the objection. On September 29, 2026 the district court affirmed the sale order and dismissed California's appeal with prejudice.

California did not stop there. On October 16, 2026, the same day it signed this settlement, the state filed a notice of appeal in the U.S. Court of Appeals for the Eighth Circuit. Three days later the settlement that gives that appeal up was on the docket.

The second track was the state court case. California filed its complaint in San Francisco Superior Court, and the clerk's stamp shows electronic filing on May 27, 2026, the day before the Attorney General announced it. The estate responded on May 31, 2026 with an emergency motion to enforce the plan and confirmation order against California, seeking an order prohibiting the state from pursuing the case and requiring it to dismiss. On July 10, 2026 the bankruptcy court granted that motion in part and denied it in part, and California appealed that order too on July 17, 2026.

Under paragraph 5, within four business days of payment California dismisses with prejudice the sale order appeal, the state litigation appeal, the state court action, and any other proceeding comprising the disputes. Under paragraph 11, once the settlement amount is paid, the estate's own release of California covers any claim for reimbursement or costs related to the disputes, giving up the Trust's recorded contention that Article XII.R of the plan entitled it to seek the attorneys' fees and costs it incurred because California commenced the state court case.

Paragraph 19 records that nothing in the stipulation reflects an admission by any party, and the recitals say the parties resolved the disputes "while preserving all defenses and without admission of liability by any Party." The allegations in California's complaint remain allegations.

Three Separate 23andMe Money Events, Told Apart

This is the third separate sum of money attached to the same 2023 breach, and they are routinely confused. They are not alternatives, and none of them is a second bite at another.

The consumer class settlement, roughly $46.8 million. This is the one directed to individuals. The Washington Attorney General's July 14, 2026 release describes it as a $46.8 million class action settlement in the bankruptcy for affected consumers who filed claims by February 17, 2026. The claim window is closed. Our tracker entry carries the approval history and distribution status.

The multistate attorneys general settlement, $18 million. Announced July 14, 2026 by a coalition of attorneys general, this resolved state investigation claims in the bankruptcy and is paid to participating state governments, not to consumers. There was never a claim form. The Oregon Department of Justice's announcement says the $18 million is paid out of available bankruptcy funds immediately. Critically, the New York release's roster of participating jurisdictions does not include California, which is precisely why California still had claims left to settle in October. You can read our coverage of the multistate attorneys general deal announced in July 2026.

California's own settlement, $6.01 million. Announced October 19, 2026. It pays the State of California, resolves California's proofs of claim and its state court case, ends two appeals, and carries the five-year restriction in paragraph 9. It also awaits court approval.

If you are trying to work out whether money is coming to you personally, the short answer from the documents is that the consumer money event was the class settlement, and its deadline passed in February 2026.

What the Law Actually Says

California's complaint, filed as People v. Chrome Holding Co., No. CGC-26-636891 in San Francisco Superior Court, pleads four causes of action. Reading them is the clearest way to see which statutes this settlement actually touches.

The first is the Genetic Information Privacy Act, Civil Code section 56.18 and following. The complaint alleges that 23andMe was a "direct-to-consumer genetic testing company" under section 56.18, subdivision (b)(5), and that it violated section 56.181, subdivision (d)(1), which the complaint describes as requiring such a company to implement and maintain reasonable security procedures and practices protecting a consumer's genetic data against unauthorized access, destruction, use, modification, or disclosure. The Attorney General's authority to bring the action comes from section 56.182, and section 56.182, subdivision (a) is the civil penalty provision the complaint invokes.

One caveat on sourcing. The consent requirement that drove California's bankruptcy objection, separate and explicit consent before genetic data and samples are sold or transferred, is how the Attorney General's October 19, 2026 release characterizes the statute. We could not reach the official California legislative text of the Genetic Information Privacy Act from our newsroom; the state's legislative information site returned HTTP 403 on every attempt on October 22, 2026. We are therefore reporting that requirement as the Attorney General's description of the law rather than quoting the statute, and we have not quoted statutory language we did not read.

The second cause of action is the California Consumer Privacy Act, Civil Code section 1798.100 and following, pleaded through subdivision (e) of section 1798.100, which the complaint describes as requiring reasonable security procedures appropriate to the nature of the personal information, in accordance with Civil Code section 1798.81.5. The third is the False Advertising Law, Business and Professions Code section 17500 and following, aimed at the company's statements about its security measures, the severity of the breach, and the DNA Relatives feature.

The fourth is the Unfair Competition Law, Business and Professions Code section 17200 and following, which sweeps in the other violations as predicates. Those predicates include the Genetic Information Privacy Act and California Consumer Privacy Act claims, Civil Code section 1798.81.5 standing alone, the California Online Privacy Protection Act at Business and Professions Code section 22575 and following, and the right to privacy established in article I, section 1 of the California Constitution. Note that section 1798.81.5, California's reasonable data security provision, is pleaded as a predicate inside the unfair competition count rather than as its own freestanding cause of action.

If you want the standing framework rather than this one case, our overview of how California's privacy statutes fit together covers the consumer privacy act, breach notification, and the reasonable security duty, and our explainer on the Delete Act and the deletion rights it created covers the broader data-deletion machinery California has built alongside the genetic privacy statute.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The quotable line from the Attorney General is that companies cannot evade California's consumer protection and privacy laws by filing for bankruptcy. The record in this case is more complicated than that, and worth sitting with.

California lost the fight it cared most about. Its Genetic Information Privacy Act objection to the sale of Californians' genetic data without affirmative consent was overruled by the bankruptcy court in June 2025, the sale closed in July 2025, and the district court affirmed and dismissed the appeal with prejudice in September 2026. The data moved. What California then obtained was money and a restriction on a wind-down entity, plus the preservation of consumer deletion rights that the Attorney General says exist under state law independent of this settlement.

That pattern tells you something structural about how a state privacy statute performs inside a federal bankruptcy. A consent requirement is a transactional veto, and a veto has to be enforced before the transaction closes to do what it was written to do. Once assets are sold free and clear and the sale is consummated, the state's leverage shifts from blocking a transfer to pricing a claim. By the time of this settlement, California was litigating an appeal in the Eighth Circuit about a sale that had closed fifteen months earlier.

The five-year restriction in paragraph 9 deserves the same skepticism. Barring a wind-down estate that no longer runs a genetic testing business from direct consumer sales and from collecting personal information is real as drafting, but it binds the entity whose business is already over. The entity that actually holds the customer genetic data and biological samples is expressly carved out of the release in paragraph 10 and is not a party to this stipulation. Whatever obligations constrain the data going forward come from the sale order terms, the separate multistate settlement, and the statutes themselves, not from this document.

The settlement amount is also a bankruptcy number rather than a penalty number. California's proofs of claim sought an unliquidated amount of civil penalties and were allowed as general unsecured claims at $6,010,000, which is what an estate with finite assets and many competing claimants can pay. The states in the multistate deal ran into the same ceiling in July. None of these figures should be read as a measure of what the conduct was worth.

Finally, the sequencing in mid-October is a reminder that a notice of appeal can be a negotiating posture as much as a litigation plan. California filed in the Eighth Circuit on October 16 and executed a stipulation giving that appeal up on the same date.

How This Affects You

If you were a 23andMe customer, the operative point from the October 19, 2026 release is that affected consumers retain the right to request deletion of their information and destruction of their samples, and that this right does not depend on who owns the company. The Attorney General frames that right as coming from California law, including the Genetic Information Privacy Act, rather than from this settlement.

The release describes the account steps as of that date. Deletion runs through the Settings area of a 23andMe account, where a section labeled 23andMe Data offers a download option and then a permanent deletion option, confirmed by following a link in an email the company sends. Sample storage preferences are changed under Preferences. Research permissions are withdrawn under Research and Product Consents. Those are the Attorney General's instructions as described in a news release, not a court order, and a company's interface can change, so what you see in your account may differ.

Residents of other states should be careful about generalizing from this. The deletion and consent rights the Attorney General is describing here are California statutory rights, grounded in the Genetic Information Privacy Act, and this settlement resolved claims brought by California alone. What a resident of another state can demand turns on that state's own law, which this record does not speak to.

If you are deciding what to do after any breach notice, the general sequence of freezing credit, monitoring accounts, and keeping documentation does not change because of a settlement, and our guide to practical steps after a breach notice walks through it. Nothing in this settlement creates a claim you can file, and no deadline in it runs against you.

This is general legal information, not legal advice. It covers California law and a federal bankruptcy proceeding in the Eastern District of Missouri, and reflects sources verified on October 22, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• Our report on the May 2026 complaint this settlement ends
• Track the status of the 23andMe class settlement
• The multistate attorneys general settlement announced in July 2026
• California's privacy statutes, start to finish
• What the Delete Act changed about data deletion
• Practical steps to take after a data breach notice

---

Last updated: 2026-10-22. This is a developing story; details verified as of 2026-10-22.

Frequently Asked Questions

Will I get money from California's $6 million 23andMe settlement?

There is no claim form for this settlement and no individual payout to apply for. Under paragraph 3 of the October 19, 2026 stipulation, the $6,010,000 is paid to the State of California, and the Attorney General may use it at his sole discretion for consumer relief related to the 2023 breach, with any unused amount moving into California's Unfair Competition Law Fund within one year. Paragraph 5 does require the estate to hand the Attorney General contact information for affected California residents to the extent reasonably necessary to distribute consumer relief, so some form of distribution is contemplated, but the stipulation does not define one.

Is the California 23andMe settlement final?

No. The California Department of Justice's October 19, 2026 release states the settlement is pending approval in the U.S. Bankruptcy Court for the Eastern District of Missouri, and the stipulation itself conditions payment on the court's approval and is captioned to take effect upon approval. The parties also asked the court to push the estimation status conference from November 3 to December 3, 2026 and the estimation hearing from November 10 to December 10, 2026, specifically to preserve those proceedings if the stipulation is not approved.

How is this different from the $46.8 million 23andMe settlement?

They are different cases with different beneficiaries. The roughly $46.8 million settlement was a consumer class settlement in the bankruptcy, paid to class members who filed claims by February 17, 2026, per the Washington Attorney General's July 14, 2026 release. This $6 million deal resolves the State of California's own law enforcement claims and appeals, and it pays the state, not class members.

Was California part of the $18 million multistate 23andMe settlement?

No. The New York Attorney General's July 14, 2026 release names the participating jurisdictions, and California is not among them. California had filed its own action in San Francisco Superior Court on May 27, 2026 and pursued its own objection and appeals in the bankruptcy, which is what the October 2026 stipulation resolves.

Can I still delete my 23andMe data and have my sample destroyed?

The California Department of Justice's October 19, 2026 release states that affected consumers retain the right to request deletion of their information and destruction of their samples, and describes the account steps as of that date: delete data from the Settings area under the 23andMe Data section, change the sample storage preference under Preferences, and withdraw research permission under Research and Product Consents. Those are the Attorney General's instructions as of October 19, 2026, not a court order, and a company can change its interface.

Who holds 23andMe's genetic data now?

Per the California Attorney General's October 19, 2026 release, 23andMe sold certain assets in its 2025 bankruptcy, including the genetic data and biological samples of its customers, to TTAM Research Institute, a nonprofit established by the company's co-founder and former chief executive. TTAM has been renamed 23andMe Research Institute, as both paragraph 10 of the stipulation and the Washington Attorney General's July 14, 2026 release note. Paragraph 10 says California's release does not apply to it.