{
  "meta": {
    "name": "The Genetic Privacy Ledger — the 23andMe custody chain and the state genetic-privacy statute wave",
    "site": "https://ai-analytics.org",
    "landing": "https://ai-analytics.org/voidly/genetic-privacy/",
    "endpoint": "https://ai-analytics.org/genetic-privacy/index.json",
    "license": "Statute and court/regulator source material: public records. This compilation: CC BY 4.0.",
    "attribution": "AI Analytics — Voidly accountability datasets (https://ai-analytics.org)",
    "manifest": "https://ai-analytics.org/voidly/datasets.json",
    "pii": "Statute, court, regulator, and institution-level facts only. No breach victim is named or identifiable anywhere in this dataset; no leaked material was accessed, cited, or linked in building it; every aggregate figure comes from an official document. Personal names are omitted throughout, including executives and judges — entities act through their institutional roles. Bill sponsors appear only as standard legislative citations.",
    "asOf": "2026-07-18",
    "generated": "2026-07-18",
    "registers": {
      "company-said": "the company's own SEC filings and public statements",
      "regulator-found": "findings by a regulator (ICO, OPC, FTC)",
      "court-record": "filings, orders, and opinions on a court docket",
      "congressional-record": "letters, hearings, and bills in Congress",
      "state-ag-record": "state attorney-general filings and releases",
      "legislature": "state legislative actions"
    },
    "proceduralStatuses": {
      "final": "adjudicated or completed on the public record",
      "pending-court-approval": "agreed by parties; the court had not entered approval as of the asOf date",
      "reported-pending-verification": "reported by press; not yet reproduced from a court record as of the asOf date"
    },
    "methodNotes": [
      "Three-register discipline: what the company said, what regulators found, and what courts held are never blended; every event row carries its register.",
      "The widely cited 6.9 million total does not appear in any 23andMe SEC filing or company blog post; the company's own figures are ~14,000 credential-stuffed accounts, ~5.5 million DNA Relatives profiles, and ~1.4 million (blog) / ~1.5 million (SEC filings) Family Tree profiles. The UK ICO's penalty notice fixes the worldwide affected-customer figure at 6,984,430, and the company's bankruptcy first-day filings say approximately 7 million.",
      "Settlement figures always carry their procedural status: the 42-office governmental stipulation ($18M recovery on a $150M allowed claim, against proofs of claim recited at approximately $100 billion face amount) was signed 2026-07-14 and awaits court approval; the class settlement's reported final approval of a $46.75M fund has not yet been reproduced from a court record.",
      "The dataset was built without accessing, citing, or linking any leaked material. The documented targeting of customers by ancestry is reported exactly at the strength of the court and congressional record that describes it.",
      "Deletion-request figures conflict in the official record — approximately 1.9 million (House Oversight testimony, 2025-06-10, and the bankruptcy court's 2025-06-27 opinion) versus 1.3 million (a Senate Judiciary printed transcript) — and are published side by side, never blended."
    ],
    "schema": {
      "statutes": "one row per state genetic-privacy statute or notable non-enactment: state, bill, year, model (dtc-consent | private-right-of-action | criminal-property | foreign-adversary | vetoed), citation, effectiveDate, consent, deletionRight, sampleDestruction, enforcement, privateRightOfAction, note, sourceUrl",
      "events": "one row per documented event in the 23andMe custody chain, 2023-2026: date, title, detail, register, status, sourceUrl",
      "federalGap": "one row per federal-law scope fact explaining why the custody chain unfolded as it did: law, holds, gap, sourceUrl"
    },
    "counts": {
      "dtcStates": 12,
      "statuteRows": 18,
      "events": 42,
      "federalGapRows": 8
    }
  },
  "statutes": [
    {
      "state": "Illinois",
      "bill": "Genetic Information Privacy Act",
      "year": 1998,
      "model": "private-right-of-action",
      "citation": "410 ILCS 513",
      "effectiveDate": "1998",
      "consent": "Written authorization required for genetic testing and for disclosure of results.",
      "deletionRight": "Not the DTC-wave model; confidentiality and disclosure limits instead.",
      "sampleDestruction": "Not specified in the DTC-wave form.",
      "enforcement": "Private right of action",
      "privateRightOfAction": true,
      "note": "The oldest statute in the set: a private right of action with liquidated damages of $2,500 per negligent violation or $15,000 per intentional or reckless violation, plus attorney's fees — the strongest enforcement in the set. A growing GIPA class-action docket followed the 2023 breach era.",
      "sourceUrl": "https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=1567&ChapterID=35"
    },
    {
      "state": "Arizona",
      "bill": "HB 2069 — Genetic Information Privacy Act",
      "year": 2021,
      "model": "dtc-consent",
      "citation": "A.R.S. §§ 44-8001 to 44-8004",
      "effectiveDate": "2021 (approved 2021-04-20)",
      "consent": "Express consent for collection, use, and disclosure; separate consent for transfer and secondary uses.",
      "deletionRight": "Access and deletion of account and genetic data.",
      "sampleDestruction": "Destruction of the biological sample on request.",
      "enforcement": "Attorney general; civil penalty up to $2,500 per violation",
      "privateRightOfAction": false,
      "note": "With Utah, the first of the DTC-model wave.",
      "sourceUrl": "https://www.azleg.gov/legtext/55leg/1r/laws/0254.htm"
    },
    {
      "state": "Utah",
      "bill": "SB 227 — Genetic Information Privacy Act",
      "year": 2021,
      "model": "dtc-consent",
      "citation": "Utah Code § 13-60-101 et seq.",
      "effectiveDate": "2021-05-05",
      "consent": "Notice plus initial express consent for collection, use, and disclosure.",
      "deletionRight": "Access and deletion rights.",
      "sampleDestruction": "Sample-destruction right.",
      "enforcement": "Attorney general; civil penalty up to $2,500 per violation",
      "privateRightOfAction": false,
      "note": "Includes a written-consent bar on disclosure to health, life, and long-term-care insurers and employers.",
      "sourceUrl": "https://le.utah.gov/~2021/bills/static/SB0227.html"
    },
    {
      "state": "California",
      "bill": "SB 41 — Genetic Information Privacy Act",
      "year": 2021,
      "model": "dtc-consent",
      "citation": "Cal. Civ. Code § 56.18 et seq.",
      "effectiveDate": "2022-01-01 (approved 2021-10-06)",
      "consent": "Express consent that cannot be inferred from inaction — dark-pattern consent is invalid; separate consents per purpose.",
      "deletionRight": "Deletion of account and genetic data.",
      "sampleDestruction": "Destruction of the biological sample within 30 days of consent revocation.",
      "enforcement": "Attorney general and local prosecutors; civil penalties",
      "privateRightOfAction": false,
      "note": "The largest state in the wave; California later litigated the 23andMe bankruptcy sale separately from the multistate coalition.",
      "sourceUrl": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202120220SB41"
    },
    {
      "state": "Florida",
      "bill": "CS/HB 833 — Protecting DNA Privacy Act",
      "year": 2021,
      "model": "criminal-property",
      "citation": "Fla. Stat. § 760.40",
      "effectiveDate": "2021-10-01",
      "consent": "Express consent required; DNA analysis results are the exclusive property of the person tested.",
      "deletionRight": "Property-model rather than the consent/deletion DTC template.",
      "sampleDestruction": "Not the DTC-wave form.",
      "enforcement": "Criminal penalties for unauthorized collection, submission, or disclosure",
      "privateRightOfAction": false,
      "note": "A distinct criminal/property model, not the DTC consent template — counted separately from the twelve DTC-model states.",
      "sourceUrl": "https://www.flsenate.gov/Session/Bill/2021/833"
    },
    {
      "state": "Wyoming",
      "bill": "HB 86 (2022 Enrolled Act No. 8)",
      "year": 2022,
      "model": "dtc-consent",
      "citation": "Wyo. Stat. §§ 35-32-101 to 35-32-105",
      "effectiveDate": "2022-07-01 (signed 2022-03-08)",
      "consent": "Express consent with separate consents for transfer or disclosure, secondary use, and retention.",
      "deletionRight": "Access and deletion rights.",
      "sampleDestruction": "Sample-destruction right.",
      "enforcement": "Criminal penalty; private civil action (60-day notice-and-cure); AG enforcement up to $2,500 per violation",
      "privateRightOfAction": true,
      "note": "Amended a pre-existing genetic-privacy chapter to add the DTC-company template. Wyo. Stat. § 35-32-104 is titled 'Criminal penalty; private right of action' — an individual may sue to enjoin violations and seek damages after a 60-day notice-and-cure period, making Wyoming one of only two statutes in the set with a private right of action.",
      "sourceUrl": "https://www.wyoleg.gov/2022/Enroll/HB0086.pdf"
    },
    {
      "state": "Kentucky",
      "bill": "HB 502 — Genetic Information Privacy Act",
      "year": 2022,
      "model": "dtc-consent",
      "citation": "KRS 311.705 (2022 Ky. Acts ch. 169)",
      "effectiveDate": "2022 (session act)",
      "consent": "Initial express consent plus separate express consents for transfer or disclosure and sample retention.",
      "deletionRight": "Access and deletion rights.",
      "sampleDestruction": "Sample-destruction right.",
      "enforcement": "Attorney general enforcement",
      "privateRightOfAction": false,
      "note": "Secondary sources conflict on the precise 2022 effective date (June 1 vs the session default of July 14); the session act is the authority.",
      "sourceUrl": "https://apps.legislature.ky.gov/record/22rs/hb502.html"
    },
    {
      "state": "Maryland",
      "bill": "HB 866 — Genetic Information Privacy Act",
      "year": 2022,
      "model": "dtc-consent",
      "citation": "Md. Code, Com. Law §§ 14-4401 to 14-4408 (2022 Md. Laws Ch. 501)",
      "effectiveDate": "2022-10-01",
      "consent": "Initial express consent plus separate consents per purpose.",
      "deletionRight": "Access and deletion rights.",
      "sampleDestruction": "Sample-destruction right.",
      "enforcement": "Enforcement under Maryland consumer-protection law",
      "privateRightOfAction": false,
      "note": "Became law without the Governor's signature under Md. Const. Art. II § 17(c).",
      "sourceUrl": "https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/hb0866?ys=2022RS"
    },
    {
      "state": "Montana",
      "bill": "SB 351 — Genetic Information Privacy Act",
      "year": 2023,
      "model": "dtc-consent",
      "citation": "Mont. Code Ann. § 30-23-101 et seq.",
      "effectiveDate": "2023-10-01 (signed 2023-06-07)",
      "consent": "Express consent plus separate informed consent for third-party transfer.",
      "deletionRight": "Access and deletion rights (§ 30-23-104).",
      "sampleDestruction": "Destruction right (§ 30-23-104).",
      "enforcement": "Attorney general; civil penalty up to $2,500 per violation",
      "privateRightOfAction": false,
      "note": "Amended by SB 163 (2025, effective 2025-10-01): a deidentified-research exemption, clinical-trial waivers with express informed written consent, and extension to neurotechnology data.",
      "sourceUrl": "https://leg.mt.gov/bills/mca/title_0300/chapter_0230/part_0010/section_0010/0300-0230-0010-0010.html"
    },
    {
      "state": "Tennessee",
      "bill": "HB 1310 / SB 1295 — Genetic Information Privacy Act (Pub. Ch. 324)",
      "year": 2023,
      "model": "dtc-consent",
      "citation": "Tenn. Code Ann. §§ 47-18-4901 to 47-18-4906",
      "effectiveDate": "2023-07-01 (signed 2023-04-28)",
      "consent": "Express consent with separate consents per purpose.",
      "deletionRight": "Access and deletion rights.",
      "sampleDestruction": "Sample-destruction right.",
      "enforcement": "Attorney general enforcement",
      "privateRightOfAction": false,
      "note": "Codified in Title 47, Chapter 18, Part 49 — distinct from the separate Tennessee Information Privacy Act in Part 33.",
      "sourceUrl": "https://wapp.capitol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=HB1310&GA=113"
    },
    {
      "state": "Texas",
      "bill": "HB 2545",
      "year": 2023,
      "model": "dtc-consent",
      "citation": "Tex. Bus. & Com. Code Ch. 503A",
      "effectiveDate": "2023-09-01",
      "consent": "Express consent; distinctive property-right framing — the individual holds a property right in and exclusive control over their biological sample and genetic data.",
      "deletionRight": "Access and deletion rights.",
      "sampleDestruction": "Sample-destruction right.",
      "enforcement": "Attorney general; civil penalty up to $2,500 per violation",
      "privateRightOfAction": false,
      "note": "The property-right framing later echoed in the multistate bankruptcy complaint's ownership theory.",
      "sourceUrl": "https://capitol.texas.gov/BillLookup/History.aspx?LegSess=88R&Bill=HB2545"
    },
    {
      "state": "Virginia",
      "bill": "SB 1087",
      "year": 2023,
      "model": "dtc-consent",
      "citation": "Va. Code §§ 59.1-593 to 59.1-602",
      "effectiveDate": "2023-07-01",
      "consent": "Express consent with enumerated elements and a required policy summary.",
      "deletionRight": "Access and deletion rights.",
      "sampleDestruction": "Destruction of the biological sample within 30 days of consent revocation.",
      "enforcement": "Attorney general enforcement",
      "privateRightOfAction": false,
      "note": "Prohibits disclosure to entities deciding health, life, long-term-care, or disability insurance or employment.",
      "sourceUrl": "https://legacylis.virginia.gov/cgi-bin/legp604.exe?231+sum+SB1087"
    },
    {
      "state": "Nebraska",
      "bill": "LB 308 — Genetic Information Privacy Act",
      "year": 2024,
      "model": "dtc-consent",
      "citation": "Neb. Rev. Stat. §§ 87-901 to 87-904",
      "effectiveDate": "2024-07-17 (approved 2024-02-13)",
      "consent": "Consent for collection, processing, and disclosure, with a required privacy notice.",
      "deletionRight": "Access and deletion rights.",
      "sampleDestruction": "Sample-destruction right.",
      "enforcement": "Attorney general enforcement",
      "privateRightOfAction": false,
      "note": "The eleventh DTC-model state.",
      "sourceUrl": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-901"
    },
    {
      "state": "South Dakota",
      "bill": "SB 49",
      "year": 2026,
      "model": "dtc-consent",
      "citation": "2026 session law (SB 49)",
      "effectiveDate": "2026-07-01 (signed 2026-03-23)",
      "consent": "Written permission before genetic-information use; a prominent public privacy notice, including notice that de-identified data may be shared for research.",
      "deletionRight": "Deletion rights per the DTC template.",
      "sampleDestruction": "Sample-destruction right.",
      "enforcement": "Attorney general enforcement",
      "privateRightOfAction": false,
      "note": "The twelfth and newest DTC-model state — enacted the spring after the 23andMe bankruptcy sale closed.",
      "sourceUrl": "https://sdlegislature.gov/Session/Bill/26832"
    },
    {
      "state": "Texas",
      "bill": "HB 130 — Texas Genomic Act of 2025",
      "year": 2025,
      "model": "foreign-adversary",
      "citation": "2025 session law (HB 130)",
      "effectiveDate": "2025-09-01",
      "consent": "Second-phase model: storage and transfer restrictions rather than consumer consent.",
      "deletionRight": "Not applicable (security-model statute).",
      "sampleDestruction": "Not applicable.",
      "enforcement": "State enforcement per the act",
      "privateRightOfAction": false,
      "note": "Prohibits storing genome-sequencing data within foreign-adversary borders and restricts sale or transfer of genomic data in bankruptcy to foreign adversaries — a direct post-23andMe-bankruptcy provision.",
      "sourceUrl": "https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB130"
    },
    {
      "state": "Florida",
      "bill": "SB 768",
      "year": 2025,
      "model": "foreign-adversary",
      "citation": "2025 session law (SB 768)",
      "effectiveDate": "2025-07-01",
      "consent": "Second-phase model: sequencing-software sourcing restriction for the state's public-health laboratories.",
      "deletionRight": "Not applicable.",
      "sampleDestruction": "Not applicable.",
      "enforcement": "State enforcement per the act",
      "privateRightOfAction": false,
      "note": "Bars the Department of Health's clinical and environmental laboratories from using genetic-sequencing software produced in or by a foreign country of concern, a state-owned enterprise of one, or a company domiciled in one.",
      "sourceUrl": "https://www.flsenate.gov/Committees/billsummaries/2025/html/3683"
    },
    {
      "state": "Utah",
      "bill": "HB 182",
      "year": 2026,
      "model": "foreign-adversary",
      "citation": "2026 session law (HB 182)",
      "effectiveDate": "2028-01-01",
      "consent": "Second-phase model: foreign-adversary access restriction layered on the 2021 GIPA.",
      "deletionRight": "Not applicable (the 2021 GIPA carries the consumer rights).",
      "sampleDestruction": "Not applicable.",
      "enforcement": "State enforcement per the act",
      "privateRightOfAction": false,
      "note": "Restricts foreign adversaries' access to genetic-sequencing data; exempts clinical-trial data and DOJ Data Security Program-permitted transfers.",
      "sourceUrl": "https://le.utah.gov/~2026/bills/static/HB0182.html"
    },
    {
      "state": "Wisconsin",
      "bill": "AB 673",
      "year": 2026,
      "model": "vetoed",
      "citation": "2025-26 legislature, AB 673 (vetoed)",
      "effectiveDate": "n/a — vetoed 2026-03-27",
      "consent": "Would have followed the DTC template.",
      "deletionRight": "n/a",
      "sampleDestruction": "n/a",
      "enforcement": "n/a",
      "privateRightOfAction": false,
      "note": "Passed the legislature and was vetoed, with the veto message citing potential harm to medical and research collaborations — the wave's notable counterexample.",
      "sourceUrl": "https://docs.legis.wisconsin.gov/2025/proposals/ab673"
    }
  ],
  "events": [
    {
      "date": "2023-04-29",
      "title": "The credential-stuffing attack begins",
      "detail": "Per the UK ICO's penalty notice, the attack ran from about April 29 to September 20, 2023 — roughly five months — using passwords reused from other breached sites.",
      "register": "regulator-found",
      "status": "final",
      "sourceUrl": "https://ico.org.uk/media2/kclbljpo/23andme-penalty-notice.pdf"
    },
    {
      "date": "2023-10-01",
      "title": "A threat actor posts a claim online",
      "detail": "The company's SEC amendment records that on October 1, 2023 a threat actor posted a claim to have users' profile information, and that an investigation began immediately with third-party incident-response experts.",
      "register": "company-said",
      "status": "final",
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1804591/000119312523287449/d242666d8ka.htm"
    },
    {
      "date": "2023-10-06",
      "title": "23andMe discloses the incident",
      "detail": "The company publishes its first blog statement, attributing the access to credential stuffing and stating its own systems were not breached.",
      "register": "company-said",
      "status": "final",
      "sourceUrl": "https://www.23andme.org/blog/articles/addressing-data-security-concerns"
    },
    {
      "date": "2023-10-10",
      "title": "Form 8-K furnished; all users forced to reset passwords",
      "detail": "The first SEC disclosure is furnished, and the company requires a password reset for every account.",
      "register": "company-said",
      "status": "final",
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1804591/000119312523253488/d520529d8k.htm"
    },
    {
      "date": "2023-10-20",
      "title": "Senate HELP ranking member sends an 11-question letter",
      "detail": "The letter cites reporting that data on 1.3 million customers was posted, that one posting was titled as an Ashkenazi dataset, and that records were offered at $1 to $10 each.",
      "register": "congressional-record",
      "status": "final",
      "sourceUrl": "https://www.help.senate.gov/imo/media/doc/cassidy_letter_on_23andme_data_leak.pdf"
    },
    {
      "date": "2023-10-31",
      "title": "Connecticut's attorney general demands answers",
      "detail": "The state letter cites offerings of at least one million profiles of Ashkenazi Jewish heritage and hundreds of thousands of customers of Chinese ancestry.",
      "register": "state-ag-record",
      "status": "final",
      "sourceUrl": "https://portal.ct.gov/AG/Press-Releases/2023-Press-Releases/Attorney-General-Tong-Presses-23andMe-for-Answers-on-Data-Breach"
    },
    {
      "date": "2023-11-06",
      "title": "Two-step verification becomes mandatory",
      "detail": "The company requires email two-step verification for all new and existing customers — MFA had been optional, with regulator findings later fixing pre-breach adoption at 0.2% of customers.",
      "register": "company-said",
      "status": "final",
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1804591/000119312523287449/d242666d8ka.htm"
    },
    {
      "date": "2023-12-01",
      "title": "The full scope is disclosed by amendment",
      "detail": "The 8-K/A states the investigation is complete: about 14,000 accounts (0.1%) were credential-stuffed, through which approximately 5.5 million DNA Relatives profiles and 1.5 million Family Tree profiles were accessed.",
      "register": "company-said",
      "status": "final",
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1804591/000119312523287449/d242666d8ka.htm"
    },
    {
      "date": "2023-12-05",
      "title": "Final company figures on the blog",
      "detail": "The blog update gives roughly 14,000 accounts of 14 million customers, and puts the Family Tree figure at approximately 1.4 million — the widely cited 6.9 million total is the sum of the categories, and appears in neither the filings nor the blog.",
      "register": "company-said",
      "status": "final",
      "sourceUrl": "https://www.23andme.org/blog/articles/addressing-data-security-concerns"
    },
    {
      "date": "2024-01-11",
      "title": "A House member asks the FBI to investigate the targeted lists",
      "detail": "The letter describes about one million users of Ashkenazi Jewish heritage on a curated list — 17.2 percent of the American Jewish population.",
      "register": "congressional-record",
      "status": "final",
      "sourceUrl": "https://gottheimer.house.gov/posts/release-gottheimer-calls-for-fbi-investigation-into-23andme-data-breach"
    },
    {
      "date": "2024-01-26",
      "title": "The Melvin complaint documents the lists",
      "detail": "The class complaint alleges one million profiles of Ashkenazi Jews offered as of the October 1 leak (¶36) and 100,000 Chinese customers' data posted with 350,000 records claimed (¶38).",
      "register": "court-record",
      "status": "final",
      "sourceUrl": "https://storage.courtlistener.com/recap/gov.uscourts.cand.423954/gov.uscourts.cand.423954.1.0.pdf"
    },
    {
      "date": "2024-04-16",
      "title": "Roughly 40 federal suits centralized as MDL 3098",
      "detail": "The Judicial Panel on Multidistrict Litigation centralizes the federal cases in the Northern District of California.",
      "register": "court-record",
      "status": "final",
      "sourceUrl": "https://www.courtlistener.com/docket/68477389/in-re-23andme-inc-customer-data-security-breach-litigation/"
    },
    {
      "date": "2024-06-26",
      "title": "Consolidated class action complaint filed",
      "detail": "The consolidated complaint follows the April consolidation of the federal cases.",
      "register": "court-record",
      "status": "final",
      "sourceUrl": "https://www.kellerrohrback.com/currentcases/data-breach-23andme/"
    },
    {
      "date": "2024-07-29",
      "title": "A $30 million settlement term sheet is executed",
      "detail": "The company's 10-Q discloses a confidential term sheet agreeing all material terms including payment of $30.0 million; the company separately disclosed $22.1 million in probable insurance recoveries.",
      "register": "company-said",
      "status": "final",
      "sourceUrl": "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001804591&type=10-Q"
    },
    {
      "date": "2024-09-12",
      "title": "Preliminary approval sought for a $30M non-reversionary fund",
      "detail": "The motion describes extraordinary claims up to $10,000 for documented losses, statutory cash claims, and health-information claims; the class is about 6.4 million US residents.",
      "register": "court-record",
      "status": "final",
      "sourceUrl": "https://storage.courtlistener.com/recap/gov.uscourts.cand.428003/gov.uscourts.cand.428003.103.1.pdf"
    },
    {
      "date": "2024-12-04",
      "title": "Conditional preliminary approval — and the court states the targeting",
      "detail": "The order conditionally grants preliminary approval and records that cybercriminals specifically targeted customers of Ashkenazi Jewish and Chinese descent, offering their data for sale; nearly 16,000 individual arbitrations had been filed by mid-September 2024.",
      "register": "court-record",
      "status": "final",
      "sourceUrl": "https://storage.courtlistener.com/recap/gov.uscourts.cand.428003/gov.uscourts.cand.428003.160.0.pdf"
    },
    {
      "date": "2025-03-05",
      "title": "The Genomic Data Protection Act is introduced",
      "detail": "S. 863 would require direct-to-consumer genomic testing companies to provide simple deletion and sample-destruction mechanisms.",
      "register": "congressional-record",
      "status": "final",
      "sourceUrl": "https://www.congress.gov/bill/119th-congress/senate-bill/863"
    },
    {
      "date": "2025-03-21",
      "title": "California's attorney general issues an urgent consumer alert",
      "detail": "Ahead of the widely reported financial distress, the alert reminds customers of their deletion and sample-destruction rights under the state's Genetic Information Privacy Act.",
      "register": "state-ag-record",
      "status": "final",
      "sourceUrl": "https://oag.ca.gov/news/press-releases/attorney-general-bonta-urgently-issues-consumer-alert-23andme-customers"
    },
    {
      "date": "2025-03-23",
      "title": "23andMe files Chapter 11",
      "detail": "The petition is filed in the Eastern District of Missouri (No. 25-40976) to run a sale process for substantially all assets — including the genetic database.",
      "register": "court-record",
      "status": "final",
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1804591/000119312525060817/d933650d8k.htm"
    },
    {
      "date": "2025-03-31",
      "title": "The FTC chairman warns the trustee",
      "detail": "The letter enumerates the categories of data 23andMe holds, quotes the privacy statement's bankruptcy clause, and states that any purchaser should be bound by the privacy promises made to consumers.",
      "register": "regulator-found",
      "status": "final",
      "sourceUrl": "https://www.ftc.gov/system/files/ftc_gov/pdf/23andme-letter-ferguson.pdf"
    },
    {
      "date": "2025-04-15",
      "title": "House Oversight opens an inquiry",
      "detail": "The committee requests documents on the bankruptcy and the data's fate from the company's co-founder as a board member.",
      "register": "congressional-record",
      "status": "final",
      "sourceUrl": "https://oversight.house.gov/wp-content/uploads/2025/04/04.15.2025-23andMe-Letter.pdf"
    },
    {
      "date": "2025-04-17",
      "title": "House Energy & Commerce sends ten questions",
      "detail": "The letter to the interim chief executive covers post-sale privacy protections and enforcement of buyer commitments.",
      "register": "congressional-record",
      "status": "final",
      "sourceUrl": "https://energycommerce.house.gov/posts/chairmen-guthrie-bilirakis-and-palmer-launch-investigation-into-23and-me-and-its-handling-of-americans-sensitive-medical-and-genetic-information"
    },
    {
      "date": "2025-04-28",
      "title": "Senate Intelligence leaders press DOJ and the FTC",
      "detail": "The bipartisan letter urges both agencies to exercise the full scope of their authorities in the bankruptcy.",
      "register": "congressional-record",
      "status": "final",
      "sourceUrl": "https://www.warner.senate.gov/public/index.cfm/2025/4/warner-young-push-doj-ftc-to-use-every-available-resource-to-protect-americans-data-amid-23andme-bankruptcy-proceedings"
    },
    {
      "date": "2025-04-29",
      "title": "The parties stipulate to a Consumer Privacy Ombudsman",
      "detail": "A joint stipulation and agreed order (Dkt. 346) provides for the appointment under 11 U.S.C. § 332 to examine the sale of personally identifiable information.",
      "register": "court-record",
      "status": "final",
      "sourceUrl": "https://www.courtlistener.com/docket/69776571/chrome-holding-co/"
    },
    {
      "date": "2025-05-06",
      "title": "The Consumer Privacy Ombudsman is appointed",
      "detail": "The US Trustee's notice (Dkt. 388) formalizes the appointment.",
      "register": "court-record",
      "status": "final",
      "sourceUrl": "https://www.courtlistener.com/docket/69776571/chrome-holding-co/"
    },
    {
      "date": "2025-05-19",
      "title": "Regeneron wins the first auction at $256 million",
      "detail": "After a seven-bidder auction opening at $52 million, the pharmaceutical company's bid is selected; the auction is later reopened.",
      "register": "company-said",
      "status": "final",
      "sourceUrl": "https://www.moeb.uscourts.gov/sites/moeb/files/opinions/25-40976_BK_01_23andMe.pdf"
    },
    {
      "date": "2025-05-22",
      "title": "The Don't Sell My DNA Act is introduced",
      "detail": "S. 1916 would amend the Bankruptcy Code's definition of personally identifiable information — which does not currently enumerate genetic data — to include it.",
      "register": "congressional-record",
      "status": "final",
      "sourceUrl": "https://www.govinfo.gov/content/pkg/BILLS-119s1916is/html/BILLS-119s1916is.htm"
    },
    {
      "date": "2025-06-05",
      "title": "The UK ICO fines 23andMe £2,310,000",
      "detail": "The penalty notice — reduced from a proposed £4.59 million for financial position — finds the attack ran about five months, that 6,984,430 customers worldwide were affected (155,592 in the UK), that only 0.2% of customers had MFA enabled, and that the compromised-password check used about 20,000 passwords while a subscribed 14-billion-credential database went unused.",
      "register": "regulator-found",
      "status": "final",
      "sourceUrl": "https://ico.org.uk/media2/kclbljpo/23andme-penalty-notice.pdf"
    },
    {
      "date": "2025-06-09",
      "title": "27 states and DC sue over the sale",
      "detail": "The adversary complaint (No. 25-04035) seeks a declaration that customers hold ownership and control rights in their biological samples and genetic data, and that the data cannot be sold without express, informed consent.",
      "register": "state-ag-record",
      "status": "final",
      "sourceUrl": "https://ag.ny.gov/sites/default/files/court-filings/the-state-of-arizona-et-al-v-23andme-inc-complaint-2025.pdf"
    },
    {
      "date": "2025-06-10",
      "title": "House Oversight hearing on the sale",
      "detail": "The interim chief executive testifies that about 1.9 million customers — roughly 15% — had requested deletion since the bankruptcy, and commits that the data will not be sold to foreign adversaries; a Senate transcript the next day records a 1.3 million figure uncorrected.",
      "register": "congressional-record",
      "status": "final",
      "sourceUrl": "https://oversight.house.gov/hearing/securing-americans-genetic-information-privacy-and-national-security-concerns-surrounding-23andmes-bankruptcy-sale/"
    },
    {
      "date": "2025-06-11",
      "title": "The ombudsman's 211-page report is filed",
      "detail": "The court-appointed Consumer Privacy Ombudsman's report (Doc 718) examines whether and how genetic data can be sold in bankruptcy — the landmark primary document of the case.",
      "register": "court-record",
      "status": "final",
      "sourceUrl": "https://storage.courtlistener.com/recap/gov.uscourts.moeb.462637/gov.uscourts.moeb.462637.718.0.pdf"
    },
    {
      "date": "2025-06-13",
      "title": "TTAM wins the reopened auction at $305 million",
      "detail": "The nonprofit founded by the company's co-founder and former chief executive outbids Regeneron in the final round.",
      "register": "court-record",
      "status": "final",
      "sourceUrl": "https://www.moeb.uscourts.gov/sites/moeb/files/opinions/25-40976_BK_01_23andMe.pdf"
    },
    {
      "date": "2025-06-17",
      "title": "Canada's privacy commissioner publishes joint findings",
      "detail": "PIPEDA Findings #2025-001 — the Canadian half of the joint investigation with the UK ICO — finds contraventions affecting 319,635 Canadians.",
      "register": "regulator-found",
      "status": "final",
      "sourceUrl": "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2025/pipeda-2025-001/"
    },
    {
      "date": "2025-06-27",
      "title": "The court approves the $305M sale",
      "detail": "The memorandum opinion records about 13 million customers, roughly 1.9 million post-petition account deletions, more than 30 states initially objecting with five still opposed, and conditions binding the buyer to the privacy promises.",
      "register": "court-record",
      "status": "final",
      "sourceUrl": "https://www.moeb.uscourts.gov/sites/moeb/files/opinions/25-40976_BK_01_23andMe.pdf"
    },
    {
      "date": "2025-07-14",
      "title": "The sale closes",
      "detail": "TTAM takes ownership of the assets for $305 million total; objecting states' releases record negotiated conditions including verified permanent deletion rights and restrictions on resale.",
      "register": "company-said",
      "status": "final",
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1804591/000119312525158551/d11473d8k.htm"
    },
    {
      "date": "2025-07-17",
      "title": "The House companion to Don't Sell My DNA is introduced",
      "detail": "H.R. 4492 carries identical operative text amending the Bankruptcy Code's PII definition.",
      "register": "congressional-record",
      "status": "final",
      "sourceUrl": "https://www.govinfo.gov/content/pkg/BILLS-119hr4492ih/html/BILLS-119hr4492ih.htm"
    },
    {
      "date": "2025-10-02",
      "title": "The re-cut class settlement gets bankruptcy preliminary approval",
      "detail": "The revised settlement — a non-reversionary fund of at least $30 million through the Plan Administration Trust — is preliminarily approved, with a final hearing set for January 20, 2026.",
      "register": "court-record",
      "status": "final",
      "sourceUrl": "https://www.kellerrohrback.com/currentcases/data-breach-23andme/"
    },
    {
      "date": "2025-12-01",
      "title": "The Chapter 11 plan is confirmed",
      "detail": "The confirmation order enters for the wind-down debtor, by then renamed Chrome Holding Co.",
      "register": "court-record",
      "status": "final",
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1804591/000119312525308060/d12373d8k.htm"
    },
    {
      "date": "2025-12-04",
      "title": "The public company deregisters",
      "detail": "Chrome Holding Co. files Form 15-12G, formally ending 23andMe's life as a public company.",
      "register": "company-said",
      "status": "final",
      "sourceUrl": "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001804591&type=15-12G"
    },
    {
      "date": "2026-05-28",
      "title": "California sues separately",
      "detail": "The state's complaint — filed outside the multistate coalition — documents the targeting of about 1.1 million individuals of Ashkenazi Jewish heritage and hundreds of thousands of individuals of Chinese ancestry (¶42).",
      "register": "state-ag-record",
      "status": "final",
      "sourceUrl": "https://oag.ca.gov/news/press-releases/attorney-general-bonta-sues-chrome-holding-co-formerly-known-23andme-over-2023"
    },
    {
      "date": "2026-07-07",
      "title": "Final approval of a $46.75M class fund is reported",
      "detail": "Press reports final approval of the enlarged settlement fund; the figure has not yet been reproduced from a court record and ships here as pending verification.",
      "register": "court-record",
      "status": "reported-pending-verification",
      "sourceUrl": "https://www.kellerrohrback.com/currentcases/data-breach-23andme/"
    },
    {
      "date": "2026-07-14",
      "title": "42 attorney-general offices stipulate an $18M resolution",
      "detail": "The joint stipulation allows the signatory governmental claims at $150 million with an $18 million cash recovery — against proofs of claim recited at approximately $100 billion face amount — plus a five-year ban on the wind-down estate's consumer sales and PII collection. California is not a signatory. The published copy's approval line is unsigned; the stipulation takes effect upon court approval.",
      "register": "state-ag-record",
      "status": "pending-court-approval",
      "sourceUrl": "https://www.texasattorneygeneral.gov/sites/default/files/images/press/Stipulation.pdf"
    }
  ],
  "federalGap": [
    {
      "law": "HIPAA",
      "holds": "Governs protected health information held by covered entities — providers, plans, clearinghouses — and their business associates.",
      "gap": "Direct-to-consumer genetic testing companies are not covered entities; HIPAA never applied to 23andMe's consumer database.",
      "sourceUrl": "https://www.congress.gov/crs-product/R44026"
    },
    {
      "law": "GINA (2008)",
      "holds": "Bars genetic discrimination in employment (15+ employees) and health insurance.",
      "gap": "Does not reach life, disability, or long-term-care insurance — the coverage lines a genetic profile most directly prices.",
      "sourceUrl": "https://www.eeoc.gov/genetic-information-discrimination"
    },
    {
      "law": "11 U.S.C. § 101(41A)",
      "holds": "Defines personally identifiable information for bankruptcy purposes.",
      "gap": "The definition does not enumerate genetic information — the gap the Don't Sell My DNA Act targets.",
      "sourceUrl": "https://www.law.cornell.edu/uscode/text/11/101"
    },
    {
      "law": "11 U.S.C. § 332",
      "holds": "Provides for a Consumer Privacy Ombudsman, appointed at least 7 days before a PII-sale hearing, to advise the court.",
      "gap": "Advisory only — the ombudsman informs the court; the provision does not itself bar any sale.",
      "sourceUrl": "https://www.law.cornell.edu/uscode/text/11/332"
    },
    {
      "law": "11 U.S.C. § 363(b)(1)",
      "holds": "Permits sale of PII either consistent with the debtor's privacy policy, or after ombudsman appointment and court findings.",
      "gap": "The privacy policy itself — including its clause contemplating transfer in bankruptcy — sets the baseline the sale is measured against.",
      "sourceUrl": "https://www.law.cornell.edu/uscode/text/11/363"
    },
    {
      "law": "FTC Act § 5 (as applied to genetic data)",
      "holds": "The first FTC genetic-privacy enforcement — In re 1Health.io/Vitagene (complaint June 2023, order finalized September 2023) — required $75,000 in refunds and destruction of retained DNA samples after unencrypted genetic data sat in public storage.",
      "gap": "Case-by-case enforcement against deception and unfairness, not a standing federal genetic-privacy statute.",
      "sourceUrl": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923170-1healthiovitagene-matter"
    },
    {
      "law": "S. 863 — Genomic Data Protection Act (introduced 2025-03-05)",
      "holds": "Would require DTC genomic companies to provide simple deletion and sample-destruction mechanisms.",
      "gap": "Introduced and referred to committee; not enacted as of this dataset's date.",
      "sourceUrl": "https://www.congress.gov/bill/119th-congress/senate-bill/863"
    },
    {
      "law": "S. 1916 / H.R. 4492 — Don't Sell My DNA Act (introduced 2025)",
      "holds": "Would add genetic information to the Bankruptcy Code's PII definition, closing the § 101(41A) gap the 23andMe sale exposed.",
      "gap": "Introduced and referred to committee; not enacted as of this dataset's date.",
      "sourceUrl": "https://www.govinfo.gov/content/pkg/BILLS-119s1916is/html/BILLS-119s1916is.htm"
    }
  ]
}