Attorney Generals Secure $18 Million Multistate Settlement with 23andMe Over Genetic Data Breach

Lede

New York Attorney General John M. Formella and Alabama Attorney General Steve Marshall announced an $18 million multistate settlement with direct‑to‑consumer genetics company 23andMe, ending a series of lawsuits tied to a breach that exposed customers’ genetic data.

Core developments

The settlement, disclosed in a joint statement from the two attorneys general, resolves claims filed in multiple states after a 2023 security incident at 23andMe. The company agreed to pay $18 million to cover consumer restitution, civil penalties, and the costs of a court‑approved bankruptcy plan that had been challenged by state regulators.

Formella’s office described the agreement as “the largest coordinated settlement of its kind” and emphasized that the funds will be allocated to affected consumers, as well as to bolster state‑level oversight of genetic‑data handling practices. Marshall’s announcement highlighted that the settlement also settles “bankruptcy claims” that had been lodged by states seeking to protect residents from the fallout of the breach.

Both attorneys general noted that the settlement does not constitute an admission of wrongdoing by 23andMe, but it does obligate the firm to implement enhanced security measures and to submit to ongoing monitoring by state regulators.

Why it matters

Genetic information is uniquely personal, revealing not only health predispositions but also familial relationships. When that data is compromised, the risks extend beyond identity theft to potential discrimination in employment, insurance, and social contexts. The 23andMe breach, which reportedly exposed the genetic profiles of millions of customers, underscored the need for stricter safeguards in the burgeoning direct‑to‑consumer testing market.

Legal scholars have long warned that existing privacy statutes lag behind the rapid commercialization of genomic data. The settlement therefore serves as a practical test case for how state authorities can intervene when federal regulations, such as the Genetic Information Nondiscrimination Act (GINA), fall short of protecting consumers. By pooling resources across state lines, the attorneys general demonstrated a model for coordinated enforcement that could shape future privacy litigation.

Financially, the $18 million figure represents a significant punitive and remedial sum for a technology company whose market valuation exceeds $10 billion. While the amount does not fully compensate every individual whose data was compromised, it signals that the economic calculus of data security breaches is shifting—companies may now face more substantial liabilities for lapses in protecting biometric data.

Differing viewpoints and reactions

State officials framed the settlement as a victory for consumer protection. Formella said, “This agreement sends a clear message that companies handling sensitive health information must prioritize security and transparency.”

We are committed to ensuring that the privacy of New Yorkers is upheld, and this settlement reflects that commitment. John M. Formella, New York Attorney General

Marshall echoed the sentiment, noting that Alabama’s participation helped close “a chapter of uncertainty for families who trusted 23andMe with their most intimate health data.”

The settlement provides meaningful relief to Alabamians and reinforces the importance of robust data‑security standards. Steve Marshall, Alabama Attorney General

Consumer‑advocacy groups, while welcoming the payout, cautioned that the settlement does not address the broader systemic issues that allowed the breach to occur. A spokesperson for the Genetic Privacy Alliance said, “We need comprehensive federal legislation that treats genetic data with the same rigor as financial data.” The company’s spokesperson declined to comment on the settlement’s specifics but reaffirmed 23andMe’s commitment to “enhancing our security protocols and restoring consumer confidence.”

What’s next

Under the terms of the agreement, 23andMe must submit a detailed security‑enhancement plan to the participating states within 90 days. The plan will be subject to periodic audits, and any non‑compliance could trigger additional penalties.

State regulators have indicated they will monitor the rollout of these measures closely, and they reserve the right to bring further action if the company fails to meet the stipulated standards. Meanwhile, legislators in several states have introduced bills aimed at codifying stricter consent and data‑retention requirements for genetic‑testing firms.

For consumers, the settlement means that restitution checks will begin to be issued in the coming months, though the exact distribution mechanism will vary by state. Legal analysts suggest that the case could set a precedent for future multistate actions against other biotech and health‑tech firms that collect and store biometric data.

As the industry continues to expand, the 23andMe settlement underscores a growing expectation that companies must treat genetic information with the highest level of security, or face coordinated legal and financial repercussions.