The Record reported that the company once known as 23andMe agreed to pay California $6 million. Attorney General Rob Bonta announced the deal on Monday. The state alleges the company failed to protect personal and genetic data, which led to a 2023 breach. That breach exposed information on nearly 7 million people. The company is now called Chrome Holding Company. In July, it also settled with 42 other state attorneys general for $18 million.
The deal is not final, because a federal bankruptcy court in Missouri must approve it. Bonta's office said customers keep the right to delete their data and have genetic samples destroyed. TTAM Research Institute, a nonprofit, received customers' saliva samples and genetic data after 23andMe filed for bankruptcy in March 2025. A TTAM spokesperson said the institute had no part in the settlement. The sources do not say how the breach happened or what the company must change.
For teams that build, run or buy software, this shows California pursuing a company over data protection even after it entered bankruptcy. Bonta said bankruptcy does not let a company escape the state's consumer protection and privacy laws. Firms holding sensitive personal data should treat that duty as lasting.