Skip to content
23andMe
HEALTH & FITNESS
LAST UPDATED 10 SEP 2026
19
OF 100
PARANOIA SCORE
F
EDITORIAL OPINION · HOW WE SCORE ›

WHAT THE POLICIES SAY

23andMe is a consumer genetic testing service that analyzes customers' saliva samples to provide ancestry and health reports, collecting genotype data, the physical sample, and self-reported health and family information. Its opt-in research consent model let de-identified data from consenting customers support an exclusive drug-development collaboration with GSK from 2018. A 2023 credential-stuffing attack cascaded through the DNA Relatives feature to expose profile data far beyond the directly accessed accounts, drawing a £2.31 million UK ICO fine in June 2025. The company entered Chapter 11 in March 2025; its assets were acquired in July 2025 by TTAM Research Institute, a nonprofit led by founder Anne Wojcicki, with published privacy commitments. The company publishes a transparency report and offers account deletion and sample-discard choices. In July 2026 23andMe agreed to pay $18 million to settle claims from a coalition of over 40 state attorneys general, who found the company lacked basic safeguards like multifactor authentication and rate limiting against the credential-stuffing attacks and had initially denied a breach occurred before blaming customers. Court and SEC filings confirm TTAM's $305 million acquisition of substantially all of 23andMe's assets closed on July 14, 2025, with TTAM committing to added data-security requirements including an advisory board.

TRACK RECORD

4 ENFORCEMENT ACTIONS
[2026-07-14]
The Pennsylvania Office of Attorney General announced on July 14, 2026 that Attorney General Dave Sunday joined a coalition of 42 other states in an $18 million bankruptcy-claim settlement with 23andMe resolving allegations from the 2023 data breach that compromised the genetic data of 6.9 million consumers worldwide (192,093 in Pennsylvania alone); the release states 23andMe separately agreed to a $46.75 million class-action settlement providing consumer relief. As part of the TTAM Research Institute asset sale in bankruptcy, the release states the sale terms carried data-security requirements comparable to what a direct settlement with 23andMe would have imposed, including enhanced data-security requirements, risk analysis, an Advisory Board, and being bound by comprehensive privacy laws without exception.
attorneygeneral.gov ↗
[2025-06-17]
On June 17, 2025, the UK Information Commissioner's Office fined 23andMe £2.31 million following a joint investigation with the Office of the Privacy Commissioner of Canada into the 2023 credential stuffing attacks, which resulted in unauthorised access to personal information of 155,592 UK residents; the ICO found failures including the lack of mandatory multi-factor authentication and secure password protocols.
ico.org.uk ↗
[2025-03-21]
On March 21, 2025, California Attorney General Rob Bonta issued a consumer alert to 23andMe customers, citing the company's publicly reported financial distress and reminding Californians of their right to direct deletion of their genetic data under California's Genetic Information Privacy Act and the CCPA.
oag.ca.gov ↗
[2023-12-01]
In a Form 8-K/A filed December 1, 2023, 23andMe reported that a threat actor used credential stuffing to access 0.1% of user accounts and, through those accounts, accessed files containing profile information that a significant number of other users had shared via the DNA Relatives feature; the company required two-step verification for all users beginning November 6, 2023.
sec.gov ↗

TIMELINE

1 ENTRY
[2026-09-10] · NEW RECEIPTS
4 new sources on file for 23andMe.
23andMe's file gained 4 new sourced claims since its last review.
bleepingcomputer.com ↗

TOOLS WE RECOMMEND

PLUS

RECEIPTS

18 ON FILE
[2024-11-08] · COLLECTION
The service's policy indicates many different types of personal data are collected.
23andme.com ↗
[2026-05-19] · COLLECTION
23andMe's Privacy Statement (Last Updated May 19, 2026) states the service collects Genetic Information (genotype data), Sample Information such as the submitted saliva sample, Registration Information, and Self-Reported Information including disease conditions, health-related information, ethnicity and family history.
23andme.com ↗
[2025-03-23] · OWNERSHIP TRANSPARENCY
On March 23, 2025, 23andMe Holding Co. announced it initiated voluntary Chapter 11 proceedings in the U.S. Bankruptcy Court for the Eastern District of Missouri to facilitate a court-supervised sale of its business, stating there were no changes to the way the company stores, manages, or protects customer data.
mediacenter.23andme.com ↗
[2025-07-01] · OWNERSHIP TRANSPARENCY
ABC News reported on July 1, 2025 that a U.S. bankruptcy court approved the $305 million sale of 23andMe's assets, including genetic data belonging to roughly 15 million customers, to TTAM Research Institute, a nonprofit led by 23andMe co-founder and former CEO Anne Wojcicki, replacing an earlier $256 million bid from Regeneron Pharmaceuticals. The report notes that, one month earlier, 27 states and the District of Columbia had sued to try to block the sale of customers' genetic information without their consent, and that TTAM said it would maintain 23andMe's existing customer privacy policies and add further data-security measures.
abcnews.com ↗
[2025-07-14] · OWNERSHIP TRANSPARENCY
On July 14, 2025, TTAM Research Institute, a nonprofit public benefit corporation founded and led by 23andMe co-founder Anne Wojcicki, announced it completed the acquisition of 23andMe's Personal Genome Service and Research Services business lines under Section 363 of the U.S. Bankruptcy Code, committing to customer choice and transparency including the option to change research participation decisions.
mediacenter.23andme.com ↗
[2025-08-04] · OWNERSHIP TRANSPARENCY
23andMe Holding Co.'s SEC 10-Q filing (filed August 4, 2025) confirms that on July 14, 2025 (the "Closing Date"), the company and 23andMe Research Institute (formerly TTAM Research Institute), a California nonprofit public benefit corporation, closed the Asset Purchase Agreement dated June 13, 2025, under which the Research Institute acquired substantially all of the debtor company's assets for a total purchase price of $305.0 million in cash; the filing states the company received $302.5 million of that in cash. The filing confirms the direct-to-consumer genetic testing and research-services businesses ceased to be part of the company's operations as of the closing, while the company retained its Lemonaid Health telehealth subsidiary pending a planned sale.
sec.gov ↗
[2026-05-19] · OWNERSHIP TRANSPARENCY
23andMe's current Privacy Statement (Last Updated May 19, 2026) commits that genetic data will not be sold or transferred in a merger, acquisition, bankruptcy, reorganization, or asset sale unless the buyer is a U.S. nonprofit research institution or a for-profit entity satisfying CFIUS requirements that agrees to adopt the Privacy Statement.
23andme.com ↗
[2018-07-25] · SHARING
On July 25, 2018, GSK and 23andMe announced an exclusive four-year collaboration to develop novel medicines using 23andMe's genetic database, leveraging aggregate, de-identified data from the over 80% of 23andMe customers who consented to participate in research.
gsk.com ↗
[2024-11-08] · SHARING
The service's policy indicates third parties are involved in operating the service.
23andme.com ↗
[2026-04-30] · SHARING
23andMe publishes a semi-annual Transparency Report on government data requests (first published 2015, last updated April 30, 2026); it reports 13 cumulative U.S. data requests received, 17 user accounts specified, and data produced for 0 user accounts, and states it will not voluntarily release data to law enforcement, insurance companies or public databases.
23andme.com ↗
[2026-05-19] · SHARING
23andMe's Privacy Statement (Last Updated May 19, 2026) commits that the company requires law enforcement inquiries to follow valid legal process (court order, subpoena, or search warrant) and states it will not use Genetic Information for personalized or targeted marketing or advertising without explicit consent.
23andme.com ↗
[2023-12-01] · TRACK RECORD
In a Form 8-K/A filed December 1, 2023, 23andMe reported that a threat actor used credential stuffing to access 0.1% of user accounts and, through those accounts, accessed files containing profile information that a significant number of other users had shared via the DNA Relatives feature; the company required two-step verification for all users beginning November 6, 2023.
sec.gov ↗
[2025-03-21] · TRACK RECORD
On March 21, 2025, California Attorney General Rob Bonta issued a consumer alert to 23andMe customers, citing the company's publicly reported financial distress and reminding Californians of their right to direct deletion of their genetic data under California's Genetic Information Privacy Act and the CCPA.
oag.ca.gov ↗
[2025-06-17] · TRACK RECORD
On June 17, 2025, the UK Information Commissioner's Office fined 23andMe £2.31 million following a joint investigation with the Office of the Privacy Commissioner of Canada into the 2023 credential stuffing attacks, which resulted in unauthorised access to personal information of 155,592 UK residents; the ICO found failures including the lack of mandatory multi-factor authentication and secure password protocols.
ico.org.uk ↗
[2026-07-14] · TRACK RECORD
The Pennsylvania Office of Attorney General announced on July 14, 2026 that Attorney General Dave Sunday joined a coalition of 42 other states in an $18 million bankruptcy-claim settlement with 23andMe resolving allegations from the 2023 data breach that compromised the genetic data of 6.9 million consumers worldwide (192,093 in Pennsylvania alone); the release states 23andMe separately agreed to a $46.75 million class-action settlement providing consumer relief. As part of the TTAM Research Institute asset sale in bankruptcy, the release states the sale terms carried data-security requirements comparable to what a direct settlement with 23andMe would have imposed, including enhanced data-security requirements, risk analysis, an Advisory Board, and being bound by comprehensive privacy laws without exception.
attorneygeneral.gov ↗
[2026-07-16] · TRACK RECORD
BleepingComputer reported on July 16, 2026 that 23andMe (by then renamed Chrome Holding Co.) agreed to pay $18 million to settle claims brought by a coalition of 43 state attorneys general over its 2023 data breach, in which credential-stuffing attacks that went undetected for roughly five months (April-September 2023) exposed the data of 6.9 million customers, including genetic ancestry information later offered for sale on the dark web. New York Attorney General Letitia James said the multistate investigation found 23andMe lacked basic safeguards against credential-based attacks, including password blocklisting, multifactor authentication, adequate rate limiting, intrusion prevention, and breach-detection monitoring, and that 23andMe initially denied a breach occurred and then blamed customers' account practices. The settlement imposes new security requirements on successor entity TTAM, including a data security advisory board and continued consumer data-deletion rights.
bleepingcomputer.com ↗
[2024-03-15] · TRACKING TECH
23andMe's Privacy Notice for U.S. State Residents (Last Updated March 15, 2024) discloses that identifiers (including mobile IDs), activity data (browsing, clicks, app usage), device data, and geolocation data collected through its sites and apps may have been "sold" or "shared" as defined under the CCPA in the past 12 months; the notice also states 23andMe responds to Global Privacy Control browser signals.
23andme.com ↗
[2024-09-10] · TRACKING TECH
23andMe's Cookie Policy (Last Updated September 10, 2024) states the company uses advertising cookies, including cross-context behavioral and targeted advertising cookies, and that visit information may be shared with other organizations such as third-party advertisers; it notes browsing information may include sensitive information such as activity related to specific health conditions.
23andme.com ↗

DATA SOURCES

ToS;DR
CC BY-SA · TOSDR.ORG ↗
Claims are summarized from these sources and may be edited from the original. Text adapted from a CC BY-SA source is shared under CC BY-SA.
LAST REVIEWED 2026-09-10 · METHODOLOGY v1.7
HOME
TOP RATED
CITY
WATCHING