DNA-testing firm agrees to $6 million settlement over data-privacy violations

Chrome Holding Co., the corporate name used by 23andMe during its Chapter 11 proceedings, has agreed to a $6 million payment to the state of California to settle allegations of inadequate data security and unauthorized sale of genetic information. The agreement, pending court approval in the Eastern District of Missouri, resolves two separate actions: one stemming from a 2023 cyber-attack that exposed data of almost 7 million customers, and another concerning a 2025 transfer of DNA samples after the company's bankruptcy.

California Attorney General Rob Bonta emphasized that bankruptcy does not shield firms from the state's consumer-protection and privacy statutes. The settlement also implicates the sale of 23andMe to the nonprofit TTAM Research Institute, created by co-founder Anne Wojcicki, raising concerns about the future handling of the DNA of roughly 13 million users. The Department of Justice had previously challenged the sale under the Genetic Information Privacy Act, but courts allowed it to proceed, leading to one outlet resolution.