Most website owners will never hold anything as sensitive as a DNA profile. The 23andMe case still matters to them, because the California Attorney General has now put a price on two things any business can get wrong: weak account security, and telling customers something about an incident that turns out not to be true. Even Chapter 11 didn't make the state go away.
What Happened
On October 19, 2026, Attorney General Rob Bonta announced a $6 million settlement with Chrome Holding Co., the company formerly known as 23andMe. It was filed in the U.S. Bankruptcy Court for the Eastern District of Missouri, where the company's Chapter 11 case sits, and it still needs that court's approval.
The money resolves the lawsuit Bonta filed in San Francisco Superior Court on May 28, 2026 over the company's 2023 data breach, which reached nearly 7 million customers nationwide and more than 855,000 Californians. That complaint alleged violations of the Genetic Information Privacy Act, the Reasonable Data Security Law, the False Advertising Law, the Unfair Competition Law, and the California Consumer Privacy Act. According to the Attorney General, the company failed to guard against credential stuffing, never checked for reused passwords even after the MyHeritage breach, missed several chances to spot the attack, and left a coding error in its "DNA Relatives" feature open to exploitation. It also kept telling consumers there had been no security incident within its systems.
The settlement ends a second fight too. In 2025 the company sold customers' genetic data and samples to TTAM Research Institute, a nonprofit founded by its former CEO. California objected under the Genetic Information Privacy Act, which requires separate consent for that kind of transfer; the bankruptcy and district courts overruled the objection, and the state appealed. That appeal is now resolved. Customers keep the right to have their data deleted and their samples destroyed, whoever owns them. "Companies cannot evade California's consumer protection and privacy laws by filing for bankruptcy," Bonta said.
What Website Owners Should Do
The security failures here are ordinary ones. If your site has customer accounts, check whether you screen for passwords that appear in known breach dumps, rate-limit login attempts, and alert on bursts of failed sign-ins from the same sources. The CCPA already requires reasonable security procedures under § 1798.100, and § 1798.150 is the one provision consumers can sue over directly when a breach follows from their absence.
Then read your privacy policy the way a regulator would after an incident. Does it describe the right to delete accurately, and say how to use it? Does it disclose what happens to personal information in a merger, sale, or bankruptcy? Statements you make about your own data handling are the ones the state can test against what you actually did, and the misrepresentation claims in this case rested on exactly that.
Where Privisy Fits
A scan from outside your site can't audit password storage or breach detection, and Privisy doesn't claim to. What it does check is the public side of the same promises: whether your privacy policy explains the right to delete and how to submit a request, whether it covers sensitive personal information where your forms collect it, and whether the trackers on your pages match what the policy says you share. When something goes wrong, those are the documents people read first.
Check What Your Policy Promises
Run a full audit to see whether your privacy policy and your site's behavior line up before anyone else compares them.
Get Your Audit