close
close
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Enforcement · Settlement / consent order

23andMe reaches $18M multistate settlement over genetic data breach affecting 6.9M people

Iowa Consumer Data Protection Act (ICDPA) Iowa

A coalition of 42 state attorneys general reached an $18 million settlement with 23andMe over its 2023 data breach, which exposed genetic and personal data belonging to 6.9 million customers. The breach stemmed from 23andMe's failure to implement basic protections like multifactor authentication and rate limiting, allowing attackers to access customer data, which was later sold on the dark web.

Why it matters Genetic data is uniquely permanent and uniquely sensitive, and this is one of the largest privacy settlements ever tied to a single breach of it.
Read the primary source
Iowa Attorney General
Open source

Published by Editorial on Sep 23, 2026. Not independently re-checked against the primary source — read it via the link above.

Related actions

Administrative fine

Irish DPC fines Google €403M over unlawful location data processing

Google Ireland Limited

GDPR

€403,000,000Decided

The fourth-largest GDPR fine ever issued, for tracking exactly the kind of location data most apps collect by default.

Primary source
Settlement / consent order

Meta pays $459M to settle Cambridge Analytica privacy claims with four states

Meta Platforms, Inc.

California

$459,300,000Settled

Eight years after Cambridge Analytica broke, states are still collecting on it. This time it's $459 million, folded into an even larger settlement over Meta's design choices for kids.

Primary source
Settlement / consent order Pending

DOJ’s $400M TikTok privacy settlement hits a snag: a judge may reject part of it

TikTok Inc. and ByteDance Ltd.

COPPA Federal

$400,000,000Pending

A $400M privacy settlement isn't final just because the government announced it: a judge can still send both sides back to the table.

Primary source

Summaries are DataGrail’s wording, not statutory text; amounts and outcomes come from the linked primary source.

This summary is DataGrail's own plain-language account, written for privacy practitioners. It is not legal advice. For the authoritative text, follow the primary-source link above.