Penalty Amount
$18,000,000
Consumers Affected
6,900,000
A coalition of 42 state attorneys general settled with the bankruptcy trustee for 23andMe over a 2023 data breach that exposed genetic data of 6.9 million customers. The states will receive $18 million from bankruptcy funds, and 23andMe agreed to enhanced data security requirements and consumer deletion rights as part of the asset sale to TTAM Research Institute.
The states will be paid $18 million out of bankruptcy funds. The asset sale to TTAM Research Institute includes enhanced data security requirements, risk analysis, an advisory board, binding to comprehensive privacy laws, and continued consumer deletion rights.
In-house legal teams should review vendor agreements for data security and breach notification clauses, particularly those involving sensitive personal data like genetic or biometric information. The 23andMe case highlights the need for clear obligations on affirmative consent before selling or disclosing sensitive data, and for robust data security practices to prevent credential stuffing attacks. Customer-facing privacy policies should be updated to specify data retention schedules and consumer deletion rights. Additionally, any agreements involving data assets in bankruptcy or sale scenarios should include provisions ensuring continued compliance with privacy laws and consumer rights.
Entity
23andMe, Inc.
Industry
TechnologyOfficial Press Release
https://coag.gov/2026/attorney-general-phil-weiser-announces-multistate-settlement-of-bankruptcy-claims-against-23andme-over-genetic-data-breach/
?url=https://msqcje7ab.cc.rs6.net/tn.jsp?f=001CwYHnpaawM2AIJ
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmsqcje7ab.cc.rs6.net%2Ftn.jsp%3Ff%3D001CwYHnpaawM2AIJmsy5vL9loj-HafP8wb9wAMCXL8OgLJKH6Kfi6uEc2bcAQpYyzIoPbYW6uyj_GR0dqYvapf1a4Xc0xehu2bYw5HjRzd4Q-seXZtC-hJLEjPzFwgcWWUl5XVQIAvZ7Y0wSsKmjOffpieEExSuh2PRjPbZgjqK-aUYNAPu-487YRFLgJqkEYysxPomd6SSjo%3D%26c%3DcIU-DFA6NxPpfZfGyNt8wYA1jY6szMluQbTU2C1ypNddqA0-e9MLKQ%3D%3D%26ch%3DGHMFtVWYmZcAuNzrBjbu4QTYb2eLfNn9DC5EoX1leVAXSLVmXZPFwQ%3D%3D&data=05%7C02%7Cmaxwell.mead%40coag.gov%7C7f7a330cdd1a41045dc808dee1c4a658%7C811650beeaf1453ea4b43e7953f7056b%7C0%7C0%7C639196431895546946%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=r%2BpAK49AkldVzKPZaW52pos5vx8awQT4FDV3poHP1s0%3D&reserved=0
Colorado Attorney General Enforcement Page
https://coag.gov/
"23andMe"
"the states will be paid $18 million out of available bankruptcy funds immediately"
"data breach that compromised the genetic data of 6.9 million customers"
"23andMe engaged in unreasonable data security practices"
"Companies cannot sell or disclose biometric data without affirmative consent from consumers"
"Colorado Privacy Act includes enhanced protections for biometric data"
$18.0M
Attorney General Jennifer Davenport joined a bipartisan coalition of 42 attorneys general in announcing a settlement with the bankruptcy trustee for 23andMe, resolving allegations from a 2023 data breach that compromised genetic data of 6.9 million people worldwide, including nearly 150,000 in New Jersey. The settlement provides $18 million to states from available bankruptcy funds, plus enhanced data security and consumer deletion rights for the successor entity, 23andMe Research Institute.
$18.0M
A coalition of 42 state attorneys general reached a settlement with the bankruptcy trustee for 23andMe over a 2023 data breach that compromised the genetic data of 6.9 million customers. The settlement provides $18 million from bankruptcy funds, with Minnesota receiving $514,871, and imposes data security requirements on the successor entity, 23andMe Research Institute.
New York Attorney General Letitia James, joined by 27 other state attorneys general and the District of Columbia, filed a lawsuit against 23andMe to block the company’s planned sale of 15 million customers’ genetic and health data without their consent or knowledge. The coalition argues 23andMe must comply with state laws requiring express informed consent for the sale or transfer of sensitive genetic data. The lawsuit seeks to prevent misuse, exposure in future breaches, and unauthorized use of customers’ private genetic information.
Federal Trade Commission Chairman Andrew N. Ferguson issued a letter to the U.S. Trustee overseeing the 23andMe bankruptcy proceeding, expressing concerns about the potential sale or transfer of consumers' personal genetic data. The letter underscores the importance of companies honoring their privacy promises to consumers, particularly regarding sensitive information, during bankruptcy proceedings.
$29.6M
Attorney General Phil Weiser joined a bipartisan coalition of 48 states and territories in announcing a $29.6 million settlement with Glenmark Pharmaceuticals. The settlement resolves allegations that Glenmark participated in a widespread conspiracy to inflate prices, reduce competition, and restrain trade for numerous generic prescription drugs. Glenmark also agreed to cooperate in ongoing multistate litigation and implement internal reforms.
$45.0M
Attorney General Phil Weiser announced a $45 million multistate settlement with Block, Inc., the company behind Cash App, for misleading consumers about the safety of the platform and failing to protect users from fraud. The settlement requires Block to implement antifraud measures, provide customer support, and stop deceptive marketing practices.