Attorney General Bonta secures $6 million settlement from Chrome Holding over genetic data sale

What happened

• Attorney General Rob Bonta reached a $6 million settlement with Chrome Holding Co., the successor to 23andMe, over a 2023 breach affecting nearly 7 million customers, including 855,000 Californians.
• The settlement also resolves disputes about the sale of genetic data and samples without affirmative consent under California's Genetic Information Privacy Act.
• The company must honor deletion requests for data and samples.
• The payment resolves both state and bankruptcy court claims.

Why it matters

Any direct‑to‑consumer genetic testing firm operating in California must obtain separate, explicit consent before transferring or selling genetic data and must be able to delete that data on request, or risk similar penalties.

Business impact

Failure to secure explicit consent and robust data protection could trigger costly settlements and damage consumer trust.

What to check

1. 1

   Obtain explicit consentHigh priority

   Secure separate, affirmative consent before selling or transferring any genetic data or biological samples.

2. 2

   Enhance data securityHigh priority

   Implement technical and organizational measures to protect genetic information from breaches.

3. 3

   Enable deletion requestsMedium priority

   Provide a clear, accessible process for consumers to request deletion of their genetic data and destruction of samples.