# The 23andMe Settlement Leaves You One Privacy Decision

> California reached a proposed $6 million settlement over the 23andMe breach and bankruptcy. The useful question for customers now is whether they still want their genetic data and sample stored, and how to act on that choice.

- **Author:** Kubilay Tunca
- **Published:** 2026-10-24
- **Category:** For Mortals
- **Tags:** Data Privacy, Genetic Data, Data Breaches, Account Security
- **Canonical URL:** https://cyber-security-in-plain-english.com/post/mortals/news/23andme-settlement-leaves-one-privacy-decision

---

A password can be changed after a breach. Your DNA cannot. That difference is why a proposed $6 million settlement announced in California on 19 October 2026 deserves more than a glance at the amount and a shrug.

The settlement concerns Chrome Holding Co., the company formerly known as 23andMe, and allegations arising from the 2023 breach of personal and genetic information. It also closes California's challenge to the transfer of customer data and biological samples during the company's bankruptcy. The agreement still needs approval from the US Bankruptcy Court in the Eastern District of Missouri ([California Department of Justice, 19 October 2026](https://oag.ca.gov/news/press-releases/attorney-general-bonta-secures-6-million-settlement-23andme-litigation)).

If you used 23andMe, the useful part of this news is smaller and more personal than the court fight. You still have a choice about data and samples held in your account. California's attorney general says customers can request deletion of their information, destruction of a stored saliva sample, and withdrawal of consent for research use. That choice deserves ten quiet minutes, not panic.

The settlement cannot pull back a copy that was stolen in 2023. Deletion cannot change that history either. It can reduce what remains stored for future use, transfer, or exposure. The right decision depends on whether you still value the service enough to keep that long-lived information there.

## What California actually settled

The headline combines three events that happened years apart. In 2023, attackers gained access to 23andMe customer information. In March 2025, the company entered bankruptcy and later sold certain assets, including customer genetic data and biological samples, to TTAM Research Institute. In October 2026, California announced a proposed $6 million settlement with Chrome Holding Co. over claims tied to the breach and the bankruptcy dispute.

Those are related events, but the names matter. Chrome Holding Co. is the former corporate entity that carried the 23andMe name. TTAM Research Institute is the nonprofit that acquired certain assets and now operates the service. TTAM told The Record that it is independent, was not involved in the matters behind the California settlement, and has no role in it ([The Record, 20 October 2026](https://therecord.media/23andme-california-data-breach-settlement)).

California had objected to the bankruptcy sale. The state argued that transferring genetic data and samples without each customer's separate, explicit consent conflicted with California's Genetic Information Privacy Act. Courts rejected that objection, and the state appealed. The proposed settlement ends that appeal as well as California's pending claims about the earlier security practices and public statements.

The payment settles legal claims. The attorney general's announcement does not describe the $6 million as a cheque that every customer will receive. Other proceedings have involved separate settlements, including a $46.75 million payment to victims approved through the bankruptcy, but those processes should not be mixed together simply because they share the same company and breach ([The Guardian, 19 October 2026](https://www.theguardian.com/us-news/2026/oct/19/california-settlement-23andme-data-breach)).

The agreement is also still proposed. As of 24 October 2026, the bankruptcy court must approve it. Saying that the state “secured” a settlement describes the agreement reached by the parties; it does not mean every court step has finished.

What survives the legal detail is the customer's right to choose. California says affected consumers retain the right to ask for deletion of their information and destruction of their samples. That right existed before this week's announcement, but the settlement puts it back in view at exactly the moment many people have stopped thinking about an old testing account.

## Why genetic data needs a different clock

Most breach advice begins with changing a password because passwords are replaceable secrets. If somebody learns the password to your email account, you create a new one and close the old route. The damage from anything already seen may remain, but the credential itself can be retired.

A genetic profile works on a much longer clock. You cannot issue yourself a fresh sequence after a company breach, sale, or policy change. Parts of that sequence also say something about biological relatives, including people who never opened an account. That does not make every genetic database an immediate danger. It does mean the normal “change it and move on” repair has a hard limit.

The information in a consumer testing account is broader than a tube of saliva. The California Department of Justice says 23andMe stored raw DNA sequence data and used it to produce reports about ancestry, ethnicity, and genetic health predispositions. The service also held ordinary account information needed to run a customer relationship. Those categories carry different consequences, but they can become more revealing when joined.

Picture a family in which one person took a test to answer a harmless ancestry question. Years later, an email carrying the correct family surname, ancestry detail, and testing-company reference arrives. None of those details proves the message is genuine. Together, they can make a lie feel familiar enough to earn a click or a reply.

That is the practical risk for most readers. A stolen record does not give a stranger supernatural knowledge, and it does not mean a medical insurer has changed a policy overnight. It gives someone durable facts that may help with profiling, impersonation, harassment, or a convincing approach. The appropriate response is to make future contact pass a second check rather than treating every mention of DNA as proof of a disaster.

The long clock also changes how you judge storage. Keeping a shopping receipt for a year and keeping a genetic sample for decades are different choices. The benefit may be real: continued access to reports, new matches, or future features. The privacy cost lasts as long as the data, the sample, and usable copies remain. You are allowed to decide that the service is still worth that trade. You are equally allowed to decide that the question you asked has already been answered.

## How a small door reached a large room

The 2023 incident is often described as a breach of nearly 7 million people. That number is accurate at the broad level used by California, which says the incident affected nearly 7 million customers nationwide and more than 855,000 Californians. It can still hide the mechanism that made the event unusually instructive.

Attackers used passwords exposed elsewhere to enter a much smaller set of customer accounts, a method commonly called credential stuffing. People reuse passwords, so a password stolen from an unrelated site can sometimes open another account. Reporting at the time put the directly accessed group at roughly 14,000 accounts, or about one tenth of one percent of the customer base ([TechCrunch, 4 December 2023](https://techcrunch.com/2023/12/04/23andme-confirms-hackers-stole-ancestry-data-on-6-9-million-users/)).

The reach expanded through features that connected customers to genetic relatives. Once inside an account, an intruder could see information made available through those connections. A comparatively small number of account takeovers therefore exposed profile information associated with millions of people. The front door was password reuse; the large room behind it was a network of relatives.

This mechanism matters because it changes the lesson. Telling 6.9 million people that all of them chose bad passwords would be wrong. Many affected people had no direct account takeover. At the same time, treating passwords as irrelevant would miss the route that started the incident. A shared feature turned one person's account security into part of another person's privacy.

Family matching is useful precisely because it connects records. That same connection creates reach. A contact list has a similar property: compromise one mailbox and you learn about people who never used that password. Genetic matching adds an unusually personal and lasting relationship to the graph.

The right lesson is neither shame nor helplessness. Use a different password for every service, especially email, health, finance, and identity accounts. Turn on the strongest second step the service offers. Then remember that your safety can still depend partly on how a provider limits the view from one account and detects unusual collection across connected profiles.

23andMe later required additional account protections, but today's stronger login does not rewrite the 2023 exposure. It protects the account that exists now. This distinction between past copies and present storage is the centre of the decision in front of customers.

## What deletion can change, and what it cannot

Deleting an account can reduce future exposure by removing data the service continues to hold under that account, subject to the company's legal and operational retention duties. It can also trigger destruction of a stored sample when the relevant conditions are met. Those are meaningful results because a record that is no longer retained cannot be included in the next ordinary product use or transfer.

Deletion cannot reach into an attacker's computer and recover a stolen copy. It cannot erase information already included in research that has been completed or published in a form that cannot reasonably be separated back out. It also cannot remove facts about you from a relative's independent genetic record. A deletion request changes custody going forward; it does not edit the past.

That limit should make the choice clearer rather than pointless. Imagine cancelling an old payment card after its number was copied. Cancellation cannot make the copy disappear, but it prevents that number from authorising future charges. Genetic deletion lacks such a complete switch because the underlying sequence remains true, yet reducing the number of retained copies still reduces opportunities for later use or loss.

California's published instructions place permanent deletion inside Account Settings and advise customers who want a personal copy to download it before proceeding. Read the current wording on the confirmation screen before acting because the choice is meant to be irreversible. Save the confirmation so you have a dated record of what you requested.

Downloading first creates another copy, this time under your control. That can be sensible if you genuinely expect to use the raw file with a clinician or another service. It can also become a forgotten attachment in email, an unencrypted file in Downloads, or a copy swept into several cloud backups. “Keep it just in case” is a real choice, but it comes with a storage job.

If you download, place the file in encrypted storage you understand, give it a plain name that does not advertise its contents, and remove the loose browser download after checking the protected copy. Do not email it to yourself. Do not upload it to a new interpretation website until you have read who receives it, how long it stays, whether it will be used for research, and how deletion works there. Moving the same file to a less accountable service would exchange one known concern for a new unknown one.

Research consent is a separate control. Withdrawing permission can stop future research use under the service's terms, while work already performed may remain. Sample storage is separate again. A customer who wants to keep the account but no longer wants the physical sample stored may have that option. Treat account data, research permission, and sample storage as three switches rather than one vague privacy setting.

## Make the decision before opening the settings page

Privacy menus encourage people to click first and think later. This decision works better on paper. Ask what continuing value you receive, what material is still held, and whether you are willing to keep that material with the present service under its current ownership and policies.

For some people, the answer will be yes. They actively use relative matching, follow updated reports, or participate in research they value. Keeping an account after a considered choice is different from keeping it because the forgotten login sits outside daily life. If you stay, secure the account and review every optional connection and consent.

For others, the original question ended years ago. They wanted an ancestry estimate, received it, and have not signed in since. A dormant account holding long-lived information offers them little continuing benefit. Deletion is a reasonable default when the service no longer does anything they want.

Family circumstances deserve a pause. A test may have connected you with relatives who use the service, and your decision may affect matches or shared family work. You do not need permission from the whole family to control your own account. A brief warning can still prevent confusion if somebody relies on a family tree or a match they expect to revisit.

Legal and medical needs can also change the order. If a clinician has asked for a file, if a legal matter depends on account records, or if you are making a request for a deceased relative, preserve the material and obtain appropriate advice before irreversible deletion. Most people will not be in that position. Those who are should resist a generic checklist that assumes every account is interchangeable.

Write one sentence before you log in: “I am keeping this because…” or “I am deleting this because…”. If the sentence contains a specific benefit or a clear wish to reduce stored data, you have a decision. If it says only “maybe someday,” give that possibility an honest price in continuing storage.

## A calm ten-minute account review

Start through the website or app you normally use, not a link in an email about the settlement. News about a breach and payout attracts fake claims pages, urgent messages, and offers to “protect” DNA. Type the known address yourself or use a saved bookmark. A real settlement does not make an unexpected message trustworthy.

Once signed in, check that the email address belongs to you and that the password is unique. If you used the same password anywhere else, change those other accounts too, starting with email. Your email account is the key used for password resets, so protecting it matters more than polishing every low-value login.

Then choose one of two paths. If you are keeping the account, review relative-matching visibility, research consent, sample-storage preferences, connected applications, and any sharing features. Remove what you do not use. Keep the smallest useful version of the service rather than accepting every optional connection by default.

If you are leaving, California's instructions published on 19 October 2026 give a direct sequence:

1. **Sign in through the normal 23andMe site.** Open the Settings section of your profile and find the area labelled “23andMe Data.”

2. **Decide whether to download first.** Keep a copy only when you have a named use for it and a protected place to store it. Check the downloaded file before continuing because account deletion is permanent.

3. **Request permanent deletion.** In the data section, choose the permanent deletion option. The service should send a confirmation email, and the request is not complete until you follow that confirmation step.

4. **Check sample storage and research consent.** California says sample preferences appear under “Preferences” and research permission under “Research and Product Consents.” Review both rather than assuming account closure and every separate consent mean exactly the same thing.

5. **Keep a receipt without keeping the sensitive file loose.** Save the confirmation date and a screenshot or PDF of the completed request in your ordinary records. Record what you asked to delete or destroy. You do not need to keep the raw genetic download beside that receipt unless you deliberately chose to retain it.

The labels may move as a website changes, so compare them with the current support page and the California instructions at the time you act. If a button is missing or a request fails, capture the error and contact official support from the site. Do not hand raw genetic data to a stranger who offers to complete deletion on your behalf.

Afterward, expect account closure to take the route described by the service rather than assuming one click erased every system instantly. Keep the confirmation. If you remain able to sign in after the stated processing period, or if you receive conflicting notices, follow up through the official support channel with the date and reference you saved.

## Treat messages about the settlement as untrusted

A public settlement provides excellent material for a scam. The message can name the company, quote a real dollar amount, and refer to a breach the recipient remembers. Accuracy around the edges makes the false centre easier to accept.

A typical lure might promise a payment, demand a small “verification fee,” or ask for a DNA file to prove eligibility. Another may say that deletion expires tonight. The proposed California settlement is pending court approval, and the attorney general's announcement directs customers to their account settings for privacy choices. It does not tell them to send genetic files to a claims agent.

Use a second route for every settlement message. If an email mentions a court case, find the attorney general's announcement, the court record, or the official settlement site independently. If it mentions your account, open the service through your own bookmark. Do not use the phone number in the message to decide whether the message is genuine.

No legitimate privacy repair should require your account password, email verification code, or raw DNA file to arrive by reply. A support worker may need to confirm account ownership through an official process. That process should happen inside the known site or through contact details you obtained there.

Family members may forward the lure because they are trying to help. Correct them without embarrassment. “The settlement is real, but this link is not how I will check it” is enough. Shame makes people hide a click; calm makes it easier to stop before money or more information leaves.

If you already entered a reused password on a suspicious site, change it on the real account and anywhere else it was used. Secure the email account tied to it, review recent sessions, and keep an eye out for follow-up messages that use what you disclosed. You do not need to replace every bank card because somebody sent a fake DNA-settlement email. Match the repair to what actually left your hands.

## What relatives can and cannot decide for you

Genetic privacy has a family edge that ordinary account advice often misses. Your record can reveal relationships, and a relative's record can reveal something about you. One person's deletion therefore cannot create perfect family privacy.

That does not make individual choices useless. You still control whether your own detailed account, profile, consents, and stored sample remain with the service. Removing your copy narrows one source and one set of permissions. The fact that another source exists is a reason to be honest about the limit, not a reason to abandon the choice.

A family conversation should stay practical. Ask whether anyone relies on a shared tree or match, explain whether you plan to leave, and agree not to upload another person's raw file without clear permission. Avoid turning the discussion into an argument about whether testing was a mistake. The useful question concerns what each person wants from this point onward.

Parents and guardians have an extra responsibility for accounts or samples created for children. A child cannot meaningfully revisit a decision made before they understood long-term data use. Check who controls the account, which consents were given, and whether continued storage still serves the child. Seek specific legal or medical advice where custody, guardianship, or clinical care complicates the decision.

People who never tested may still receive a message claiming they were “found through family DNA.” Treat the claim as a detail to verify, not as proof that the sender knows anything. A genuine relative match and a scam can use the same language. Keep the conversation on the platform until identity has been checked through a separate family route.

The hard limit remains: nobody can promise invisibility once genetic information has been shared. A sensible privacy decision can reduce copies, permissions, and connections. That is worthwhile even though it cannot make the family tree disappear.

## The lesson reaches beyond 23andMe

The settlement puts one company in the headline, but the decision pattern applies to every service that stores information you cannot easily replace. Voice recordings, facial scans, health histories, identity documents, and a child's location archive all deserve a longer storage question than a shopping basket.

Before handing over such information, ask what continuing service requires it. Find the deletion route before upload, not years later. Check whether the company sells assets in bankruptcy, whether a successor must follow the same promises, and whether a physical sample exists alongside the digital record. A privacy policy is easier to judge while you still have the option to walk away.

Account security matters, but provider design sets the size of the room behind the account. A unique password and a strong second step can block the common route used in the 2023 incident. They cannot control how much connected data one successful login can read. Companies that build family, contact, or social graphs must limit collection through those links and notice unusual access before a small group of accounts becomes millions of records.

Regulation and settlements can create consequences after a failure. They can preserve deletion rights and force disputed conduct into public view. They cannot turn genetic data into a replaceable secret. The customer's most useful power remains deciding who should hold a copy, for how long, and for what continuing benefit.

For a normal household, that is enough work for one afternoon. Open the account through a trusted route. Decide whether the service still earns the data it keeps. Secure the account if the answer is yes; download deliberately and delete if the answer is no. Then save the receipt and get on with your life.

The proposed $6 million settlement is a legal event with more court procedure ahead. Your privacy decision does not need to wait for the final stamp. The settings already exist, the right to ask remains, and the trade is yours to make.

For more calm, practical security explanations, join the newsletter. It is one email per month.

## Sources

- [California Department of Justice: Attorney General Bonta Secures $6 Million Settlement in 23andMe Litigation](https://oag.ca.gov/news/press-releases/attorney-general-bonta-secures-6-million-settlement-23andme-litigation), accessed 2026-10-24
- [The Record: 23andMe successor settles with California for $6 million over cybersecurity failings](https://therecord.media/23andme-california-data-breach-settlement), accessed 2026-10-24
- [The Guardian and Reuters: California to receive $6m settlement after 23andMe data breach](https://www.theguardian.com/us-news/2026/oct/19/california-settlement-23andme-data-breach), accessed 2026-10-24
- [TechCrunch: 23andMe confirms hackers stole ancestry data on 6.9 million users](https://techcrunch.com/2023/12/04/23andme-confirms-hackers-stole-ancestry-data-on-6-9-million-users/), accessed 2026-10-24

---

## About the author

Kubilay Tunca — Senior Full Stack Developer and Author. Founded Cyber Security in Plain English to translate complex security concepts into clear, practical advice, and writes the accompanying books on security, privacy, secure development, and AI systems.

## Books by this author

- **The Digital Fortress** — Your Everyday Guide to a Safer Digital Life. A warm, plain-English guide for people with real lives and finite patience. Learn the handful of habits that genuinely protect your money, accounts, and family, and get honest permission to ignore the rest. [Amazon](https://buy.cyber-security-in-plain-english.com/digital-fortress) · [Details](https://cyber-security-in-plain-english.com/books/the-digital-fortress)
- **The Anonymity Playbook** — Digital Survival for Whistleblowers, Journalists, Activists, and Everyone Else. A practitioner’s field manual for journalists protecting sources, whistleblowers, and activists. It explains how the surveillance actually works, what each technique costs you, and exactly where it fails. [Amazon](https://buy.cyber-security-in-plain-english.com/anonymity-playbook) · [Details](https://cyber-security-in-plain-english.com/books/the-anonymity-playbook)
- **Secure Software Development** — Practical patterns for building secure software. A hands-on security guide for developers and IT professionals who ship real software. Build, deploy, and maintain secure systems without slowing down or drowning in theory. [Amazon](https://buy.cyber-security-in-plain-english.com/secure-software-development) · [Details](https://cyber-security-in-plain-english.com/books/secure-software-development)
- **The Secure Harness** — Shipping Production Code with AI Coding Agents. A calm, practical guide to letting agents do useful work inside boundaries you set, enforce, and audit. Ships with 15 copy-pasteable artifacts: hook scripts, permission configs, release gates, and MCP templates. [Amazon](https://buy.cyber-security-in-plain-english.com/secure-harness) · [Details](https://cyber-security-in-plain-english.com/books/the-secure-harness)
- **The AI Native Engineer** — Build, Evaluate, and Ship AI Systems That Work in Production. Sixteen hands-on chapters, one real product. Grow it from a single model call into a retrieved, tool-using, observable, production-grade system, with evaluation treated as a habit from the first feature. [Amazon](https://buy.cyber-security-in-plain-english.com/ai-native-engineer) · [Details](https://cyber-security-in-plain-english.com/books/the-ai-native-engineer)

Full catalogue with contents and intended audience: https://cyber-security-in-plain-english.com/books

_As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog._