California has settled its claims against 23andMe — now owned by the non-profit TTAM Research Institute — for US$6 million, resolving alleged violations of state law over the 2023 credential-stuffing breach that exposed the personal and genetic data of about 6.9 million people, including 855,000 Californians. Attorney General Rob Bonta's office opted out of the US$18 million multistate settlement agreed in July with 42 other attorneys general; under the new deal the state drops its appeals of a bankruptcy-court ruling that barred it from suing TTAM over the breach after the company's US$305 million sale. Customers retain the right to demand deletion of their personal and genetic data. 23andMe separately paid US$46.75 million to settle consumer class actions, approved in July 2026. Why it matters: the settlement closes the costliest privacy chapter of the breach while establishing that a post-bankruptcy asset sale does not extinguish state genetic-privacy enforcement — and it preserves consumer deletion rights over data now held by a different legal entity.

• Source article