Penalty Amount
$18,000,000
Consumers Affected
6,900,000
Virginia Attorney General Jay Jones joined a coalition of 42 state attorneys general in a multistate settlement with 23andMe over a 2023 data breach that exposed the genetic data of approximately 6.9 million customers. The settlement requires 23andMe to pay $18 million to the states and $46.75 million to affected consumers, resolving allegations of inadequate security practices and delayed breach notification.
23andMe agreed to pay $18 million to a multistate coalition of attorneys general and $46.75 million to affected consumers in a class-action settlement, resolving allegations stemming from a 2023 data breach that compromised genetic data of nearly 7 million customers.
In-house legal teams should review vendor agreements with genetic testing companies or any data processors handling sensitive health data. Key clauses to examine include data security obligations (e.g., reasonable security procedures), breach notification timelines (immediate vs. delayed), consent requirements for data sharing and processing, liability and indemnification for data breaches, and compliance with state genetic privacy laws such as Virginia's Genetic Data Privacy Law. Additionally, customer-facing agreements should be reviewed for clear consent mechanisms and data handling disclosures.
Entity
23andMe, Inc.
Industry
TechnologyOfficial Press Release
https://www.oag.state.va.us/media-center/news-releases/3084-what-virginians-are-seeing-attorney-general-jay-jones-shares-weekly-roundup-of-actions-taken-2026-07-24
tn.jsp?f=001Eah mt2Wiy3THdBDf mtozKkESLf44nZqX8HKlDbyqNO AZs
https://6rdh5iebb.cc.rs6.net/tn.jsp?f=001Eah_-mt2Wiy3THdBDf_mtozKkESLf44nZqX8HKlDbyqNO-AZsY0w30PhMEGFFkobWU6RPEHqi1VRLYP0ZZHnTDs-q7erMSGRhmTUsPU7XiyaZyQgoL4UUiFrwHLCpPG21QB3YHWlshQpjOIZWytqE1E5H6HbAkcjehuVmiejNP67Ay8yx3MjsUgkUYiScfkJn-uFcHvyYPkPQc3XMv_uwcN01QN-kH0fzA-8k_Q5f6AQyzpwmEQkx0oFQjAb9KUKUN7V5aOF-aa8YPMcAi5qhKe2qSuKF2VmWIrkdDc8RdqV_1mb1WHyQIPIoOZYQht93ikDEXmZnUskvtRbVCbMzrPD13ezXUP_LeI_hzMqiwo=&c=vJzIyTMuznUPWcNDxBmsmgPj5tAk_rKb66ql395Lidtpqshb0PVImA==&ch=Opf-WOgiZ9nwe4h1RFNWBn_lwWdiX0WKypcZ6T_4BPZMe9oFDwXjAA==
Virginia Attorney General Enforcement Page
https://www.oag.state.va.us/consumer-protection/
"23andMe"
"recovery was limited to $18 million"
"Virginia Code § 59.1-597(1)"
"2023 data breach that compromised the genetic data of nearly seven million customers"
"23andMe failed to maintain proper security measures"
$18.0M
Attorney General Jennifer Davenport joined a bipartisan coalition of 42 attorneys general in announcing a settlement with the bankruptcy trustee for 23andMe, resolving allegations from a 2023 data breach that compromised genetic data of 6.9 million people worldwide, including nearly 150,000 in New Jersey. The settlement provides $18 million to states from available bankruptcy funds, plus enhanced data security and consumer deletion rights for the successor entity, 23andMe Research Institute.
$18.0M
A coalition of 42 state attorneys general settled with the bankruptcy trustee for 23andMe over a 2023 data breach that exposed genetic data of 6.9 million customers. The states will receive $18 million from bankruptcy funds, and 23andMe agreed to enhanced data security requirements and consumer deletion rights as part of the asset sale to TTAM Research Institute.
$18.0M
A coalition of 42 state attorneys general reached a settlement with the bankruptcy trustee for 23andMe over a 2023 data breach that compromised the genetic data of 6.9 million customers. The settlement provides $18 million from bankruptcy funds, with Minnesota receiving $514,871, and imposes data security requirements on the successor entity, 23andMe Research Institute.
New York Attorney General Letitia James, joined by 27 other state attorneys general and the District of Columbia, filed a lawsuit against 23andMe to block the company’s planned sale of 15 million customers’ genetic and health data without their consent or knowledge. The coalition argues 23andMe must comply with state laws requiring express informed consent for the sale or transfer of sensitive genetic data. The lawsuit seeks to prevent misuse, exposure in future breaches, and unauthorized use of customers’ private genetic information.
Federal Trade Commission Chairman Andrew N. Ferguson issued a letter to the U.S. Trustee overseeing the 23andMe bankruptcy proceeding, expressing concerns about the potential sale or transfer of consumers' personal genetic data. The letter underscores the importance of companies honoring their privacy promises to consumers, particularly regarding sensitive information, during bankruptcy proceedings.
Attorney General Jay Jones announced the creation of the Regulated Products Enforcement Unit to centralize civil enforcement for liquid nicotine products, THC and hemp-derived products, kratom, and related intoxicants. The unit will oversee compliance, directory administration, and public education. It will coordinate with Virginia ABC and other agencies to take legal action against violators.