Enforcement action · Oklahoma Attorney General
Oklahoma v. 23andMe (data breach settlement)
Oklahoma v. 23andMe (data breach settlement) is an AI-related enforcement action involving Oklahoma Attorney General. Penalty: monetary_fine of $$276,435. Oklahoma AG Drummond announced a multistate settlement with 23andMe over a 2023 data breach that exposed genetic and personal data of 78,000 Oklahomans, resulting in $276,435 for Oklahoma and mandates for stronger security.
Action details
- Agency
- Oklahoma Attorney General
- Jurisdiction
- OK
- Enforcement type
- settlement
- Document type
- enforcement action
- Penalty
- $$276,435 monetary_fine
- Effective
- 2026-07-16
- Topic
- data privacy
Summary
Oklahoma's Attorney General, Gentner Drummond, announced that Oklahoma will receive $276,435 as part of a multistate settlement with 23andMe. The settlement, which totals $18 million in actual payouts from a $150 million claims pool, resolves claims related to a 2023 data breach that exposed the genetic and personal data of more than 78,000 Oklahomans. The investigation found 23andMe failed to implement basic security measures, and as part of the agreement, the company (now 23andMe Research Institute) committed to stronger data security, privacy protections, allowing data deletion, and establishing an outside advisory board.
Primary source
https://oklahoma.gov/oag/news/newsroom/2026/july/drummond-settles-with-23andme-over-breach-of-oklahomans-data.html →Frequently asked questions
- What is Oklahoma v. 23andMe (data breach settlement)?
- Oklahoma's Attorney General, Gentner Drummond, announced that Oklahoma will receive $276,435 as part of a multistate settlement with 23andMe. The settlement, which totals $18 million in actual payouts from a $150 million claims pool, resolves claims related to a 2023 data breach that exposed the genetic and personal data of more than 78,000 Oklahomans. The investigation found 23andMe failed to implement basic security measures, and as part of the agreement, the company (now 23andMe Research Institute) committed to stronger data security, privacy protections, allowing data deletion, and establishing an outside advisory board. Primary source →
- Which agency brought the action?
- Oklahoma Attorney General brought this enforcement action in OK. Primary source →
- What was the penalty?
- The disclosed penalty is a monetary_fine amount of $$276,435. Primary source →
- When did the action take effect?
- The action was effective 2026-07-16. Primary source →
- Where can I find the primary source?
- The primary source for Oklahoma v. 23andMe (data breach settlement) is at https://oklahoma.gov/oag/news/newsroom/2026/july/drummond-settles-with-23andme-over-breach-of-oklahomans-data.html. AIGI does not paraphrase secondary commentary — every claim on this page links back to that primary source. Primary source →
Related
Regulatory intelligence
Follow reviewed Oklahoma Attorney General AI enforcement developments.
AIGI monitors cited regulatory change and delivers decision-ready analysis. It does not monitor customer AI systems or enforce policy.