Consumer Protection

Meta must make massive transformations that will reduce the risk of harm from its platforms — and will do it within months.

OAKLAND — California Attorney General Rob Bonta, as part of a bipartisan coalition of 51 attorneys general, today announced a proposed settlement, which remains subject to court approval through entry of a consent judgment, resolving the Attorney General's lawsuit against Meta Platforms, Inc. (Meta), alleging among other things, that the company designed and deployed harmful features on Instagram and Facebook that drive compulsive use by children and teens to their mental and physical detriment, all the while misleading users, their families, and the public regarding the existence and severity of these risks. Trial in this case began on August 18 in the U.S. District Court for the Northern District of California. Today’s settlement, subject to court approval, provides for strong injunctive terms designed to help protect children from the mental health harms associated with social media, including default daily time limits on social media and a block on overnight use that can only be lifted by a parent, enhanced parental supervision tools, robust age assurance measures to detect users under 18 and children under 13 that are on the platform, and the appointment of an independent auditor to oversee compliance. The proposed settlement also includes a monetary payment of up to $17 billion to the states over ten years — California alone will receive $1.5 billion to $2.1 billion if this settlement is approved by the court. 

“Today, we have secured a settlement with Meta that will make social media less dangerous for our kids and make a world of a difference for children and their families,” said Attorney General Bonta. “Meta has agreed to make massive transformations that will reduce the risk of harm from its platforms — and will do it within months. We are talking about time limits, stopping notifications during school, a block on the app during critical overnight hours, bans on plastic surgery filters, and so much more. Alongside a bipartisan coalition of my colleagues, I am proud to deliver this settlement that addresses the concerns at the core of our lawsuit and institutes real change, real transparency, and real enforceable protections for children on Facebook and Instagram — right now, no more waiting.”

TODAY’S SETTLEMENT 

How a significant portion of the payment received by California will be spent will ultimately be decided by the Legislature and Governor, but in the proposed settlement it is earmarked for purposes related to the prevention or remediation of mental health or other harms to young Californians associated with social media use. The proposed settlement critically includes strong injunctive terms designed to help protect teens from the mental health harms associated with social media use, including bans and blocks on features known to be harmful, like:

• A default daily time limit of two hours for users under 18 that can only be lifted by a parent. If other social media platforms agree to similar terms, the daily time limit will drop to one hour. 
• A default nighttime block between midnight and 6am for users under 18 that can only be lifted by a parent. If other social media platforms agree to similar terms, the nighttime block will expand to cover 10pm to 7am. 
• Default blocks on notifications to users under 18 from 10pm to 7am and during the school day (8am to 3pm from August 15 to June 15.)
• An enhanced mechanism for teens to report potentially harmful content and a requirement that Meta respond to 90% of those reports within six hours.
• A ban on displaying numbers of likes or reactions to users under 18. 
• A ban on cosmetic procedure image filters for users under 18. 
• An option for users under 18 to have a non-personalized feed, meaning a feed that doesn’t use an algorithm to target them with content aimed to keep them endlessly scrolling. 
• A commitment from Meta to maintain, review, and improve existing teen content safety measures.

The company will also be required to maintain other potections. For example: 

• Meta has agreed to maintain, review, and improve existing teen content safety measures and will create enhanced parent supervision tools.
• Meta will institute robust age assurance measures to detect users under 18, as well as measures to identify and remove kids under 13 from their platforms.
• Meta will bring on an independent auditor with expansive access to information and resources, regular reporting, and the right to communicate concerns to the Attorneys General.
• Finally, Meta will be subject to an injunction prohibiting it from making further false, misleading, or deceptive statements around its safety features. 

BACKGROUND

The lawsuit, filed in 2023, alleged Meta illegally collected and used the data of children under the age of 13 who used its platforms, made decisions in designing its platforms that drove excessive use and put young users at risk, and that it lied to users, their families, and the public about the safety of Facebook and Instagram. In doing so, it violated federal and state laws, including the Children’s Online Privacy Protection Act, California's False Advertising Law, and California’s Unfair Competition Law. 

In announcing this settlement, Attorney General Bonta is joined by Colorado Attorney General Phil Weiser, Tennessee Attorney General Jonathan Skirmetti, Kentucky Attorney General Russell Coleman, and New Jersey Attorney General Jennifer Davenport. Also joining the settlement are the attorneys general of Alabama, Alaska, Arizona, Arkansas, Connecticut, Delaware, the District of Columbia, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, Wyoming, American Samoa, the Commonwealth of the Northern Mariana Islands, and Puerto Rico. 

OAKLAND — California Attorney General Rob Bonta today issued a consumer alert following Governor Gavin Newsom’s declaration of a state of emergency in Calaveras County in response to the Gann Fire. The Gann Fire has burned more than 10,300 acres, threatening communities throughout Calaveras County and forcing the evacuation of thousands. Hot temperatures and low humidity have fueled elevated fire danger conditions in Calaveras County, and the fire threatens homes, structures, and critical infrastructure — including transmission and distribution lines that provide power to large portions of Northern Calaveras County. In today’s alert, Attorney General Bonta reminds all Californians that price gouging during a state of emergency is illegal under Penal Code Section 396. Californians who believe they have been the victim of price gouging should report it to their local authorities or to the Attorney General at oag.ca.gov/report. To view a list of all price gouging restrictions currently in effect as a result of proclamations by the Governor, please visit the Governor's Office of Emergency Services Price Gouging webpage. 

“As high temperatures increase the intensity of the Gann Fire, I urge Californians to listen to officials and keep safe. California’s price gouging law protects people impacted by an emergency from illegal price gouging on housing, gas, food, and other essential supplies,” said Attorney General Bonta. “If you see price gouging, I encourage you to immediately file a complaint with my office online at oag.ca.gov/report or contact your local police department or sheriff’s office. Stay safe, California.” 

California law generally prohibits charging a price that exceeds, by more than 10%, the price a seller charged for an item before a state or local declaration of emergency. For items a seller only began selling after an emergency declaration, the law generally prohibits charging a price that exceeds the seller's cost of the item by more than 50%. This law applies to those who sell food, emergency supplies, medical supplies, building materials, and gasoline. The law also applies to repair or reconstruction services, emergency cleanup services, transportation, freight and storage services, hotel accommodations, and rental housing. Exceptions to this prohibition exist if, for example, the price of labor, goods, or materials has increased for the business. Violations of the price gouging statute are misdemeanors. The Attorney General and local district attorneys and city prosecutors can enforce the statute.

LOS ANGELES — California Attorney General Rob Bonta today announced the creation of the first-of-its-kind Affordability Response Team within the California Department of Justice (DOJ). The Affordability Response Team will draw on the knowledge of experts from sections across the department, working together to find, investigate, and go after individuals and corporations deploying unlawful practices that are making life unaffordable for the people of California.

“Californians, we hear you: The cost of living is much too high. For many people in our state the cost of a week off work, a set of new tires, or a trip to the grocery store — let alone a mortgage or a visit to the emergency room — are not within reach,” said Attorney General Bonta. “Today, I am proud to announce the launch of my office’s Affordability Response Team. Comprised of legal experts from across DOJ, the Affordability Response Team will work to investigate and go after practices that are unlawfully raising costs. It will create a pipeline to tackle affordability from all angles — whether it be unlawful behavior by corporations, landlords, scammers, or policies that are driving up prices. Hardworking Californians deserve fair prices, deserve the ability to make enough to meet their basic needs — and also deserve to have the experiences, vacations, and joys that make life richer.”

Californians are facing an affordability crisis of epic proportion — and many cannot see a light at the end of the tunnel. Housing shortages, skyrocketing grocery prices, rising healthcare and childcare costs, predatory corporate behavior, and the federal government’s unstable economic policies are all making it difficult not only to cover the basics, but to enjoy many of the things hardworking Americans should be able to afford — like a family vacation or a dinner out. The affordability crisis disproportionately impacts low-income households, communities of color, individuals with disabilities, and young adults. In fact, 23% of California’s young adults ages 18–24 live in poverty. And seven in 10 Californians feel that healthcare expenses place a financial strain on their household.

Because these challenges are entrenched and complex, tackling the affordability crisis requires creative thinking and a willingness to attack the problem from all angles. As the top law enforcement officer of California, Attorney General Bonta has been engaged in work that goes after illegal conduct contributing to rising costs. The creation of the Affordability Response Team will amplify DOJ’s ongoing focus on affordability, to allow this work to continue, create a pipeline for continued enforcement, and signal to bad actors that California is zeroed in on this.

THE AFFORDABILITY CRISIS 

Americans across the country are feeling squeezed by a wall of rising costs.

Already high food prices are predicted to increase by 3.4% over the next year and a growing number of people are skipping meals or relying on food banks because of rising food costs. Utility prices and gas prices have also increased, at the same time, wages have stagnated or declined for many workers. Since 1970’s, wages for the bottom 90% of earners have increased 44%, while wages for the top 1% of earners have risen more than 180%. More Americans are taking on debt because of the rising cost of necessities. Credit card debt in the U.S. by the end of 2025 hit a record of $1.28 trillion — and in the first quarter of this year, the percentage of credit-card balances that were at least 90 days delinquent rose to 13.12%, the highest level in 15 years.

Not all Americans are feeling the squeeze. As most households are trying to figure out how the numbers are supposed to add up for life in America, demand for luxury yachts and private jets is surging. The top 1% of Americans held 32% of America’s wealth and CEO compensation increased by almost 6% to $17.7 million as company boards rewarded their top executives for bigger profits. President Trump has said he doesn’t think about Americans financial situation and his Administration is walking the talk by exacerbating the affordability crisis with its polices. Policies like rolling back antitrust enforcement that holds large corporations accountable, pursuing international policy that leaves consumers feeling pain at the pump, prioritizing tax cuts for wealthier Americans, levying an illegal regime of tariffs, and destroying the agency responsible for protecting Americans from exploitation by big businesses who aren’t playing by the rules. All the while, the President and his own family are profiting wildly from holding public office.

FOCUS AREAS 

The Affordability Response Team will deploy DOJ's tools in these areas:

Keeping the Household Running: Grocery, Gas, and Utility Costs

From cable bills to grocery runs, the household bills Californians grapple with every month seem to be endlessly going up.

Affordability in Action:

• May 2026: Attorney General Bonta Secures End of Unlawful Meat Price Coordination, Announces Settlement with Agri Stats
• April 2026: Naming Names: Attorney General Bonta Secures Public Access to Evidence in Amazon Price Fixing Case

A Roof Over Your Head: Housing & Insurance Costs

Confronting California’s housing shortage, unlawful landlord behavior, and rising home insurance costs.

Affordability in Action:

• February 2026: Attorney General Bonta Announces Settlement with Redding Property Management Company for Violating Tenant Protection Act
• November 2025: Attorney General Bonta Announces $7 Million Settlement with Greystar for Participating in an Algorithmic Rent Alignment Scheme

Relief from Sickening Healthcare Costs

Tackling consolidation in the healthcare industry and the rising costs associated with going to the doctor and paying for prescriptions, so that all Californians can afford the care they need to be well.

Affordability in Action:

• May 2026: Attorney General Bonta Conditionally Approves Proposed Transaction to Ensure Continued Access to Senior Care Services in Fresno County
• March 2026: Attorney General Bonta Opposes Trump Administration’s Proposed Expansion of Catastrophic Health Insurance Plans 

Investing in Our Future: Childcare, Education, & Retirement

Ensuring Californians can care for their families, pursue a livelihood, invest in their future, and plan for every stage of their lives.

Affordability in Action:

• May 2026: Attorney General Bonta Opposes Plan to Weaken Federal Protections for Retirement Investments
• February 2026: Attorney General Bonta Defeats Trump Administration in Court Again, Continues Protecting Over $10 Billion in Child Care and Family Assistance Funding

All Work and Harder to Play: The High Cost of Enjoying Life

From planning a vacation to seeing your favorite band in concert, the joys of life are getting harder and harder to afford. The Affordability Response Team is tackling hidden fees and going after corporate practices hiking up prices for entertainment, tech, and trips.

Affordability in Action:

• April 2026: Attorney General Bonta Celebrates Historic Verdict in Live Nation/Ticketmaster Trial
• July 2024: Attorney General Bonta to Consumers: This Summer, Enjoy California — Without the Hidden Fees

Financial Protection: Protecting Your Hard-Earned Money

Protecting Californians by going after shady practices by big banks, lenders, and policies that unfairly penalize consumers and leave them worse off.

Affordability in Action:

• January 2026: Attorney General Bonta Helps Secure $425 Million Capital One Settlement
• January 2026: We're Going to Need a Bigger Boat: Attorney General Bonta Continues Championing Legislation to Protect California Veterans Against Claim Sharks, Financial Exploitation

Earning Less: Labor, Wages, and the Cost of Doing Business

Championing workers’ rights and maintaining a vibrant, profitable economy go hand in hand.

 Affordability in Action:

• March 2026: Attorney General Bonta Urges Congress to Fix Trump’s Tariff Mess, Refund Americans
• July 2025: Attorney General Bonta Announces Nearly $2 Million Settlement with Janitorial Franchising Companies Barring Use of Franchising to Misclassify Workers

Scams, Scams, Scams!

From social media investment scams to job scams and robocalls, cracking down and sounding the alarm on conduct preying on consumers’ pocketbooks.

Affordability in Action:

• April 2026: All That Glitters isn’t Gold: Attorney General Bonta Warns Californians of LA 2028 Olympic Games Ticket Scams
• August 2025: The Robocall Task Force Strikes Again! Attorney General Bonta Launches Operation Robocall Roundup

Click here to learn more about DOJ’s Recent Affordability Work.

RESOURCES — You Tell Us, What Corporations or Practices Should We Know About?

Housing: The Housing Justice Team reminds Californians that they can send complaints or tips related to housing to oag.ca.gov/report. Tenants who need legal help can find legal aid resources in their area at www.LawHelpCA.org.

Antitrust: Antitrust laws and their enforcement help protect consumers by ensuring businesses compete fairly, which often results in lower prices, higher quality goods, and more innovative products. Use DOJ’s Antitrust Complaint Form to report anticompetitive conduct — like price fixing, collusion, or monopolization concerns — that potentially violate the antitrust laws.

Consumer/Business/Healthcare: If you have a complaint about a business who is not complying with consumer protection or other laws, consumers can visit DOJ’s reporting page to submit a complaint.

OAKLAND — California Attorney General Rob Bonta today announced a $4.6 million settlement with Select Portfolio Servicing (SPS), a large sub-prime mortgage servicer operating in California, resolving allegations that the company violated state and federal mortgage servicing and debt collection laws during the COVID-19 pandemic. Today’s settlement includes enforcement of California’s Homeowner Bill of Rights (HBOR), a set of laws that provide protections to homeowners who are facing foreclosure. Under the settlement, subject to court approval, SPS must pay $1.6 million in civil penalties and $3 million in consumer relief, and must implement changes to ensure, among other things, that homeowners receive adequate support and accurate information when seeking loan modifications and other foreclosure-prevention alternatives. 

“Californians are facing a crisis of affordability, and many of our residents struggle every month to keep a roof over their heads. Our state recognized this when it passed strong debt collection and mortgage servicing laws designed to give homeowners a meaningful opportunity to avoid losing their homes amid rough financial patches — patches like the one brought on by the COVID-19 pandemic,” said Attorney General Bonta. “My office's settlement with Select Portfolio Servicing resolves our investigation into the company, which found that the mortgage servicer violated these laws amid the COVID-19 pandemic, resulting in struggling homeowners not having clarity or accurate information at a time of chaos and financial uncertainty. As part of the settlement, we are proud to secure $3 million that goes right back into the pockets of thousands of impacted homeowners.”

Due to the COVID-19 pandemic, families across California faced difficulty affording rent and mortgage payments, including as a result of layoffs and reduced working hours. In 2021, Attorney General Bonta issued a consumer alert reminding California’s tenants and homeowners of their rights and protections amidst the COVID-19 pandemic.

The California Department of Justice’s investigation into SPS, based in part on information provided by Housing and Economic Rights Advocates and California Rural Legal Assistance, Inc., found, among other things, that the company:

• Failed to give homeowners adequate information about COVID-19 forbearance plans, including related to their forbearance exit options and their ability to apply for other loss mitigation options while in forbearance.
• Sent mortgage statements to borrowers on COVID-19 forbearance plans wrongly stating that late fees would be charged for missed payments.
• Failed to have tailored loss mitigation discussions with homeowners nearing the end of their COVID-19 forbearance plans.
• Failed to ensure that homeowners seeking foreclosure prevention alternatives received adequate support from the single points of contact SPS was required to provide under HBOR. 
• Failed to ensure that homeowners could submit loan modification applications according to the timelines and under the circumstances that HBOR allows.

Homeowners eligible to receive restitution from this settlement have already been identified and will receive payment automatically.

What is the California’s Homeowner Bill of Rights?

California’s HBOR provides protections to homeowners facing foreclosure and tenants in foreclosed homes and puts certain responsibilities on mortgage servicers. Key provisions include:

• Notification of Foreclosure-Prevention Options: Your mortgage servicer must try to contact you at least 30 days before starting the foreclosure process to discuss your financial situation and explore your options to avoid foreclosure. Within five days of recording a notice of default, your servicer must generally give you information about options to avoid foreclosure that may be available.
• Acknowledgment of Application: If you apply for a loan modification, your servicer must notify you within five business days of any missing information, other errors, and deadlines for completing your application.
• Guaranteed Single Point of Contact: If you ask for a loan modification or other foreclosure-prevention alternative, your servicer must assign you a specific person or team who can walk you through application requirements and deadlines, knows the facts and status of your application, including missing documents needed to complete your application, and can get you a decision on your application.
• Restrictions on Dual Tracking: Your servicer must generally pause the foreclosure process while it is making a decision on your completed loan-modification application and until after it gives you time to appeal a denial. It also cannot foreclose on you while you are complying with the terms of an approved loan modification, forbearance, repayment plan, or other foreclosure-prevention option.
• Tenant Rights: Purchasers of foreclosed homes must give tenants at least 90 days before starting eviction proceedings. If the tenant has a fixed-term lease that was entered into before the foreclosure sale, the new owner must honor the lease unless certain exceptions apply.

For more information about the Homeowner Bill of Rights, please visit https://oag.ca.gov/hbor. The Housing Justice Team reminds Californians that they can report complaints related to housing to oag.ca.gov/report. Tenants who need legal help can find legal aid resources in their area at www.LawHelpCA.org. 

Federal data privacy law should not preempt strong state privacy laws  

OAKLAND — California Attorney General Rob Bonta yesterday led a coalition of 18 attorneys general and state agencies in opposing the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act (SECURE Data Act), a proposed federal data privacy bill. The SECURE Act would result in California’s landmark privacy law being replaced with weaker protections and would hamper the ability of California to adequately protect the privacy of its citizens. In the letter, the coalition calls on Congress to reject the SECURE Data Act, and to respect additional privacy protections states already grant their residents or would provide in future state-level legislation.

“Federal action to protect Americans' privacy is essential, but not at the expense of the strong state laws that already protect Californians. I join colleagues from across the country in opposition to the SECURE Data Act, federal legislation that would leave millions of consumers worse off and with fewer privacy protections,” said Attorney General Bonta. “As tech and data collection practices rapidly innovate, it is essential states keep our ability to respond just as rapidly to protect our residents from emerging privacy threats.” 

Since California passed the first comprehensive privacy law in 2018, numerous states have followed suit. For years, the California Consumer Privacy Act and other similar state laws give millions of Americans robust protections and rights to manage and control the use of their data. Comprehensive state privacy laws have set minimum data privacy standards, including heightened protections for minors and sensitive consumer data, limits on how data may be used and retained, and the ability for consumers to stop the sale of their data via a universal opt-out preference signal. The SECURE Data Act would wipe out these meaningful protections, making it harder for consumers to exercise their rights, give businesses more discretion on how to use and retain their data, and significantly limit enforcement remedies. 

In the letter, the coalition argues that the bill moves privacy rights in the wrong direction, leaving consumers worse off and with fewer protections. Any federal privacy framework must leave room for states to legislate responsively to changes in technology and data collection practices, as states are better equipped to address the unique needs of their citizens and quickly adjust to the challenges presented by technological innovation.

In sending the letter, Attorney General Bonta was joined by the attorneys general of Connecticut, Delaware, Illinois, Maine, Maryland, Massachusetts, Minnesota, Nevada, New Hampshire, New Jersey, New York, Oregon, Vermont, Virginia, and Washington, as well as the California Privacy Protection Agency and the Hawai’i Department of Commerce and Consumer Affairs. 

OAKLAND — California Attorney General Rob Bonta today filed a lawsuit against Chrome Holding Co., formerly known as 23andMe, for failing to protect its customers’ sensitive personal information and genetic data related to their health, genetic predispositions and risk factors, biological relatives, ancestry, and ethnicity. In 2023, 23andMe experienced a data breach that affected nearly 7 million users across the United States, including 855,541 Californians. While 23andMe publicly touted its commitment to data privacy and transparency, in truth, it failed to take reasonable measures to protect its customers’ most sensitive data, ignored known vulnerabilities in its systems, and failed to properly investigate or respond to numerous warnings that its systems had been compromised. The company also misled its customers and the public regarding crucial aspects of the 2023 data breach. In the complaint, filed today in San Francisco Superior Court, Attorney General Bonta alleges 23andMe’s failures to implement and maintain reasonable security procedures and its misleading statements regarding its security and the data breach were unlawful.

“23andMe collected genetic data about millions of people, failed to meet its obligation under California law to keep that information safe, and then lied to consumers about the severity of its 2023 data breach. Our investigation found that the company failed to take basic steps to protect users’ data — data including the sensitive personal information, family histories, and health conditions of consumers,” said Attorney General Bonta. “The sale of this data on the dark web took place amidst a period of mounting anti-Asian American and Pacific Islander and antisemitic hate and violence — and explicitly called attention to the deeply personal and identifying nature of that information. This is disturbing and incredibly dangerous. Today, my office is suing 23andMe for its categorical failure to comply with California law.”  

BACKGROUND

Founded in San Francisco, 23andMe was the first and one of the largest direct-to-consumer genetic testing companies in the world. Customers sent their saliva samples to 23andMe for DNA analysis. The company stored data on consumers’ raw DNA sequence and used that information to provide consumers with reports about their ancestry, ethnicity, and genetic health predispositions. 

On October 6, 2023, 23andMe confirmed that it had suffered a major data breach. Indeed, for five months, a threat actor had breached 23andMe’s systems undetected by accessing about 14,000 customers’ 23andMe accounts. The threat actor leveraged that access, as well as other vulnerabilities within 23andMe’s systems, to obtain the data of nearly 7 million 23andMe customers.

The threat actor used a well-known type of cyberattack called “credential stuffing” that businesses, particularly those that collect and maintain sensitive personal and genetic data, can and should know to guard against. Credential stuffing exploits consumers’ tendency to use weak or common passwords or to reuse log-in credentials by using the same username and password that they use with one company to log into accounts with another company. Here, the threat actor used account credentials stolen in prior data breaches — including the highly publicized breach of MyHeritage, a separate genealogy site that had partnered with 23andMe. Although 23andMe’s data security team was aware of the MyHeritage breach, and 23andMe had encouraged its users to create an account with MyHeritage, 23andMe never checked for or prevented credential reuse, even after the MyHeritage data breach. Once in 23andMe’s systems, the threat actor used a vulnerability involving a critical coding error in “DNA Relatives” — a feature that allowed DNA-related customers to share information and contact each other — to steal additional identifying information, ancestry reports, and reports indicating the percentage of DNA shared with potential relatives about nearly 7 million consumers.

News of 23andMe’s breach came to light after the data of one million consumers were offered for sale on the dark web, specifically touting that the data belonged to Asian American and Pacific Islanders (AAPI) and Jewish users. Disturbingly, this occurred during a period of increasing anti-AAPI and antisemitic hate and violence. 

Even more disturbing, 23andMe’s post-breach statements to consumers were misleading and omitted or misrepresented critical information regarding the breach. While 23andMe assured the public that it had not experienced a data security incident within its systems, downplayed the sensitivity of the stolen data by claiming that the information stolen from the “DNA Relatives” feature was essentially public, and attempted to shift blame for the breach to its customers, 23andMe was simultaneously negotiating and paying a ransom to the threat actor in exchange for, among other things, the threat actor removing damaging information regarding the breach that had been posted online and providing information about multiple 23andMe security vulnerabilities, including vulnerabilities the threat actor exploited during the data breach. 

THE INVESTIGATION & LAWSUIT 

A 2023 investigation by the California Department of Justice and a multistate coalition found that 23andMe’s pre-breach data security procedures and practices fell below security and industry standards in several ways. In fact, 23andMe’s security measures were so lax that the threat actor was able to operate undetected within 23andMe’s systems for over five months, and remarkably, the company only began investigating after the threat actor offered the stolen user data for sale on the dark web and reached out to 23andMe to demand a ransom.

The investigation further found 23andMe: 

• Failed to implement reasonable security procedures to prevent and detect the well-known risk of credential stuffing.
• Missed several opportunities to detect the credential stuffing attack.
• Failed to guard against the exploitation of a coding error in the “DNA Relatives” feature that allowed doctored queries to the 23andMe database.
• Failed to properly account for genetic data, its nature, and its high-level of sensitivity when drafting and implementing its data security protocols.

Additionally, 23andMe made misleading statements before and after the breach. Before the breach, 23andMe touted its security practices as meeting the highest industry standards. After the breach, 23andMe’s statements omitted key information in an effort to hide and downplay both the breach’s severity and 23andMe’s responsibility for it. 23andMe continued to inform consumers that there was no data security incident within its systems, despite being informed by the threat actor during ransom negotiations of multiple exploitable vulnerabilities within 23andMe’s systems, including vulnerabilities that were used to facilitate the attack.

In the lawsuit, Attorney General Bonta argues that 23andMe failed to implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information and genetic data that it maintained to protect that information from unauthorized access. The complaint also alleges that the company made untrue and misleading statements intending to encourage members of the public to use 23andMe’s services or products, including statements regarding its security measures in place at the time of the data breach and the circumstances of the data breach. These failures violated, among other laws, California's Genetic Information Privacy Act, Reasonable Data Security Law, False Advertising Law, Unfair Competition Law, and the California Consumer Privacy Act.

Today’s lawsuit is separate from the Attorney General’s pending challenge in the U.S. Bankruptcy Court for the Eastern District of Missouri regarding the sale of Californians’ genetic information and material in bankruptcy.

Settlement reached ahead of scheduled trial 

OAKLAND — California Attorney General Rob Bonta today secured a settlement holding Florida-based MV Realty, its Chief Executive Officer (CEO), and its Chief Operating Officer (COO) accountable for operating a predatory scheme that provided immediate cash payments to financially vulnerable homeowners in exchange for the exclusive right to be their listing agent if they ever sold their homes in the next 40 years. The company misled consumers about the terms of these homeowner agreements and deceptively recorded liens on their homes, which prevented homeowners and their successors from transferring their home unless they paid MV Realty tens of thousands of dollars in so-called “early termination fees.” The liens could also impede homeowners from refinancing their homes or getting home equity loans. The settlement requires MV Realty to individually terminate all its liens, pay back homeowners who paid early termination fees, and void its homeowner agreements. It also imposes significant financial penalties and restrictions on its future business activities in California.

“We will not tolerate predatory conduct that targets vulnerable Californians and puts their homes at risk,” said Attorney General Rob Bonta. “This settlement delivers the relief we sought in our lawsuit, including full restitution for consumers and the complete undoing of the unlawful practices at issue. At a time when Californians are facing an affordability crisis, exploitation like this only adds pressure on households struggling to make ends meet — and it is unacceptable.”

MV Realty began actively operating in California in early 2022. Today’s settlement resolves the lawsuit filed against MV Realty by Attorney General Bonta and the Santa Barbara County and Napa County District Attorneys’ Offices in December 2023. In September 2024, they secured a preliminary injunction against MV Realty, which was upheld on appeal in December 2025, requiring the company to terminate its liens. Trial was scheduled to begin on June 10, 2026 in the Superior Court of Los Angeles County.

“MV Realty placed profits ahead of people by taking advantage of struggling homeowners and locking them into decades-long agreements by employing deceptive and unlawful business practices,” said Napa County District Attorney Allison Haley. “It was a privilege to work with our colleagues at the Attorney General’s Office and the Santa Barbara District Attorney’s Office in obtaining a settlement that holds MV Realty accountable, provides meaningful relief to impacted homeowners, and reinforces that California will take action against predatory practices that exploit the financially vulnerable.”

“The Santa Barbara County District Attorney’s Office was proud to team with the Attorney General’s Office and the Napa County DA’s Office in getting relief for Californians who were victimized by a predatory scheme that took advantage of people who were already struggling financially,” said Santa Barbara County District Attorney John T. Savrnoch. “Californians have a right to expect that when they contract with a real estate company that the company will act in their best interests.  This settlement provides an example of how California authorities will respond when a company fails in its duties to its customers by trying to take advantage of them through a predatory and unfair scheme.”

As a result of the settlement:

• All homeowner contracts are void.
• MV Realty must individually terminate all liens.
• MV Realty, its CEO, and its COO are prohibited from engaging in any business in California that requires a real estate license for 5 years.
• MV Realty must pay full restitution to consumers, totaling over $1.3 million as well as nearly $1.2 million in civil penalties, for a total monetary judgment of $2.5 million.

A number of states, including California, have passed legislation prohibiting fraudulent schemes like the one MV Realty engaged in. In October 2023, Governor Gavin Newsom signed into law AB 1345, which went into effect on January 1, 2024. Sponsored by Attorney General Bonta, AB 1345 imposes a two-year limit on residential exclusive listing agreements and clarifies that these agreements cannot be filed with a county recorder.

In September 2023, MV Realty filed for Chapter 11 bankruptcy in the U.S. Bankruptcy Court for the Southern District of Florida. The court dismissed the bankruptcy in May 2024.

Federal law to protect kids online should set a floor, not a ceiling 

OAKLAND — California Attorney General Rob Bonta today joined a bipartisan coalition of 44 attorneys general in sending a letter to Congress opposing the passage of the Kids Internet and Digital Safety Act (KIDS Act). The KIDS Act would broadly preempt state laws governing major online safety and technology issues — including online obscenity and regulation of artificial intelligence chatbots — while replacing them with ineffective federal standards. The letter argues that passage of the KIDS Act would threaten the progress states across the country have made in addressing the harms social media platforms pose to children, both by suing some of these platforms for acting illegally and by enacting landmark legislation designed to address the same harms targeted by the KIDS Act. 

“California has led the nation in confronting the growing dangers young people face online, from addictive platform designs to emerging AI technologies that threaten children’s mental health, safety, and wellbeing,” said Attorney General Bonta. “The KIDS Act not only fails to meaningfully protect kids, but also, imperils the significant progress California has made on this front. We welcome congressional efforts to address these serious issues, but any federal action should build upon the progress states like California have already made and ensure that children, not corporate interests, remain the priority.” 

Excessive time spent online is associated with depression, anxiety, eating disorders, susceptibility to addiction, and interference with daily life — including learning. Every additional hour that young people spend online is associated with an increased severity in symptoms of depression. Increasing evidence shows that these companies are aware of the adverse mental health consequences imposed on underage users, yet they have chosen to dig in deeper and deploy practices that keep kids' eyes glued to screens. 

California’s own investigations and lawsuits against Meta and TikTok have helped paint a full picture of the scope and intentionality of this public health crisis. California’s lawsuits against Meta and TikTok both claim that the social media giants designed their platforms to addict young people so they would spend longer on the platforms, to the detriment of their mental and physical health. Both lawsuits are ongoing. 

Harms like these are why many states have passed their own laws designed to protect children from the damage caused by social media. In 2024, California responded by enacting the Protecting Our Kids from Social Media Addiction Act (SB 976) to limit social media companies and other website operators from using addictive algorithmic feeds, notifications, and other addictive design features that coerce children and teens into spending long periods of time on their platforms. The state law requires parental consent for these features, empowering families to create healthy boundaries around kids’ social media use. And last year, California enacted the Social Media Warning Law (AB 56), which requires social media companies to periodically display a warning label on their platforms when used by children and teens. While social media may have benefits for some young users, the warning label advises that social media is associated with significant mental health harms and has not been proven safe for young users. 

In sending this letter, Attorney General Bonta joins the attorneys general of Connecticut, Hawai‘i, Ohio, Tennessee, Alabama, Arizona, Arkansas, Colorado, Delaware, District of Columbia, Georgia, Illinois, Kansas, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Northern Mariana Islands, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, and Wyoming.

OAKLAND — California Attorney General Rob Bonta today issued a consumer alert following the Governor’s declaration of state of emergency in response to an overheating tank of methyl methacrylate at an aerospace plastics facility in Garden Grove, California. Beginning May 21, a chemical storage tank containing approximately 5,000 to 7,000 gallons of methyl methacrylate, a volatile and highly flammable liquid, began heating up and emitting toxic fumes at a GKN Aerospace facility in the City of Garden Grove within Orange County. Tens of thousands of residents from surrounding areas have been evacuated amid the possibility of the tank spilling or exploding. In today’s alert, Attorney General Bonta reminds all Californians that price gouging during a state of emergency is illegal under Penal Code Section 396. Californians who believe they have been the victim of price gouging should report it to their local authorities or to the Attorney General at oag.ca.gov/report. To view a list of all price gouging restrictions currently in effect as a result of proclamations by the Governor, please visit the Governor's Office of Emergency Services Price Gouging webpage. 

“Amid the developing situation in Orange County, I urge residents in the impacted area to stay alert, follow all evacuation orders immediately, and monitor official channels for critical updates. California’s price gouging law protects people impacted by an emergency from illegal price gouging on housing, gas, food, and other essential supplies,” said Attorney General Bonta. “If you see price gouging, I encourage you to immediately file a complaint with my office online at oag.ca.gov/report or contact your local police department or sheriff’s office. Stay safe, California.” 

Stay Up to Date:

Orange County Fire Authority:

• Instagram: @ocfireauthority
• Facebook: Orange County Fire Authority
• X: @OCFireAuthority 

City of Garden Grove: https://ggcity.org/emergency

California law generally prohibits charging a price that exceeds, by more than 10%, the price a seller charged for an item before a state or local declaration of emergency. For items a seller only began selling after an emergency declaration, the law generally prohibits charging a price that exceeds the seller's cost of the item by more than 50%. This law applies to those who sell food, emergency supplies, medical supplies, building materials, and gasoline. The law also applies to repair or reconstruction services, emergency cleanup services, transportation, freight and storage services, hotel accommodations, and rental housing. Exceptions to this prohibition exist if, for example, the price of labor, goods, or materials has increased for the business. 

Violations of the price gouging statute are misdemeanors. The Attorney General and local district attorneys and city prosecutors can enforce the statute.

Federal rule must set a floor, not a ceiling and must complement California’s strong consumer protection laws

OAKLAND — California Attorney General Rob Bonta yesterday sent a letter to the Federal Trade Commission (FTC) regarding its rulemaking proceedings to address unfair and deceptive acts or practices related to online food delivery fees. The letter commends the FTC for its attention to this matter and urges that any final rule does not preempt state law, in order to complement California’s existing laws that protect consumers and honest businesses from this deceptive conduct across industries, including food delivery. In 2023, California was the first state to pass an honest pricing law, SB 478, which works to empower consumers by arming them with accurate information upfront, so that they can compare prices between merchants.

“Consumers always, but especially amid a crisis of affordability, deserve to do business with companies that act transparently and with integrity. In 2023, California led the country in banning hidden fees and this week, I applaud the Federal Trade Commission’s work to ensure all Americans are protected from unfair or deceptive online food delivery fees,” said Attorney General Bonta. “At the same time, any federal rule must work with and complement the robust protections Californians already enjoy. I appreciate the Federal Trade Commission’s continued interest and effort to protect consumers and honest businesses throughout the nation and to recognize and preserve the vital role of state consumer-protection laws.”

California has taken action to protect consumers from deceptive price advertising across industries, including food delivery. In California, when food delivery platforms advertise a price for a delivery service, it must be the full, all-in price of the delivery service. Deceptive price advertising violates California’s False Advertising Law and Unfair Competition Law. To further this work, in 2023, the California Department of Justice and the California Low-Income Consumer Coalition co-sponsored California’s Honest Pricing Law (SB 478), which makes clear that the advertised price must include all mandatory fees other than tax and shipping. This law went into effect on July 1, 2024, and, with limited exceptions, governs all companies doing business in California, including food delivery platforms. SB 478 does not change what price a business can charge or what may be included in that cost, it simply requires that the price listed include all mandatory charges consumers will pay.