Your Genetic Data Just Got a Little Safer: The 23andMe Settlement and What It Means for You

42 Attorneys General Walk Into a Bankruptcy Court…

No, this isn't the start of a bad joke. It's the reality of the 2023 23andMe data breach, which exposed the genetic and personal information of millions. Now, a coalition of 42 state attorneys general has reached a settlement with 23andMe's bankruptcy trustee, setting a precedent that could reshape how genetic testing companies handle your most intimate data.

Featured Snippet Bait: The 2023 23andMe data breach exposed 6.9 million users' genetic and ancestry data. The settlement requires 23andMe to implement stronger security measures, obtain explicit consent for data sharing, and delete data upon request.

What Actually Happened?

In October 2023, hackers used credential stuffing—reusing passwords stolen from other sites—to access 23andMe accounts. They didn't just grab names and emails; they accessed DNA Relatives profiles, which include genetic information. The breach affected 6.9 million users, roughly half of 23andMe's customer base.

Reading the settlement terms is about as exciting as watching paint dry, but the implications are huge. The agreement requires 23andMe to:

• Implement a comprehensive information security program
• Conduct regular risk assessments and penetration testing
• Obtain affirmative consent before sharing genetic data with third parties
• Allow users to delete their data easily
• Notify users of any future breaches within 30 days

Why Should You Care?

If you've ever used a genetic testing kit, your data is out there. Unlike a credit card number, you can't change your DNA. This settlement sends a message: companies that handle genetic data have a heightened duty of care. It's like the difference between losing your house keys and losing the blueprint to your house.

The settlement also requires 23andMe to be transparent about how long they keep your data and to destroy biological samples upon request. That's a big deal for privacy advocates who've long warned about the risks of genetic data being sold or hacked.

The Precedent: Genetic Data Gets Special Treatment

This is the first multistate settlement specifically addressing genetic data privacy. It establishes that genetic information is not just another data point—it's uniquely sensitive. The attorneys general argued that genetic data can reveal predispositions to diseases, family relationships, and even ethnic origins, making it a prime target for discrimination or misuse.

The settlement also highlights the role of state attorneys general in enforcing privacy laws when federal legislation lags. With no comprehensive federal privacy law in the US, states are stepping up. This agreement could serve as a template for future enforcement actions against other genetic testing companies.

What Should You Do Now?

If you have a 23andMe account, log in and check your privacy settings. Request deletion of your data if you're uncomfortable. For everyone else, consider using unique passwords and enabling two-factor authentication on any account that holds sensitive information. And maybe think twice before spitting in a tube for a free ancestry report.

For more details on the settlement, read the full article on Hunton Privacy Blog.

FAQ