Iowa Nets $439K in 23andMe $18M Multistate Privacy Settlement

State attorneys general are increasingly filling the void left by absent federal privacy legislation, using their enforcement power to penalize firms that mishandle genetic data. The $18 million settlement with 23andMe, funded directly from the bankrupt company’s estate, raises critical questions about creditor priority, regulatory deterrence, and the evolution of biometric privacy litigation.

The recent announcement that Iowa will receive over $439,000 from an $18 million multistate settlement with 23andMe stems from one of the most alarming data breaches in the direct-to-consumer genetic testing industry. In October 2023, a cyberattack on 23andMe illicitly accessed the accounts of approximately 6.9 million users, exposing deeply personal information that had been voluntarily shared by customers—profile photos, names, birth years, locations, and family surnames. The breach disproportionately affected Ashkenazi Jewish and ethnically Chinese individuals, adding a troubling dimension of targeted exposure. The settlement, orchestrated by a coalition of 42 state attorneys general and paid from 23andMe's bankruptcy estate, represents a significant enforcement action against a company already under financial duress.

“

The recent announcement that Iowa will receive over $439,000 from an $18 million multistate settlement with 23andMe stems from one of the most alarming data breaches in the direct-to-consumer genetic testing industry.

For the legal and regulatory community, this resolution is a landmark in several respects. First, it underscores the aggressive posture state AGs are taking toward data privacy violations involving sensitive biometric and genetic information. While federal comprehensive privacy legislation remains stalled in the U.S., states are increasingly leveraging existing consumer protection statutes to extract multimillion-dollar settlements from companies that fail to safeguard data. The 23andMe breach did not involve a direct hack into the company’s core systems but rather a credential-stuffing attack exploiting weak user passwords; nevertheless, regulators held the company accountable for not enforcing adequate security measures like mandatory multi-factor authentication sooner.

Second, the settlement being funded through bankruptcy proceedings introduces a complex layer. 23andMe’s financial troubles—driven by declining consumer interest and mounting legal liabilities—culminated in its filing for bankruptcy protection. The distribution of settlement funds from the bankruptcy estate, bypassing some traditional litigation processes, signals to the market that financially precarious companies holding sensitive data may face accelerated enforcement and asset distribution. It also raises questions about the priority of consumer claims against other creditors in such proceedings.