Precedent corpus / ICO (United Kingdom)
23andMe, Inc.
ICO (United Kingdom) case 23andme-2025-06, decided . GBP 2.3M.
We have not checked whether this decision was appealed. This is not a statement that no appeal exists.
No ConsentMark grade rests on this decision. It is published here because it is relevant enforcement, not because it bears on what a browser does before consent.
What the regulator decided
Credential-stuffing attackers reused passwords from unrelated breaches to log into 23andMe accounts and, via the DNA-Relatives feature, exfiltrated the genetic and personal data of around 155,592 UK users; 23andMe had not mandated multi-factor authentication, took four days to shut compromised accounts and force resets, and notified the ICO ten days late, breaching Articles 5(1)(f), 32(1) and 33(1) UK GDPR.
Primary source
Regulator-owned URL. Quote this in legal briefs and academic citations.
https://ico.org.uk/media2/kclbljpo/23andme-penalty-notice.pdfConsentMark interpretation
Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.
Joint enforcement with the Office of the Privacy Commissioner of Canada. Cite when a scanner finds a high-sensitivity service (genetics, health, financial) without mandatory MFA and without compromised-credential checking - the ICO frames optional MFA on a high-risk service as a 32(1) breach.
Verification trail
Checked against the primary source on 27th May 2026. Next review 27th November 2026.
Cite this case
@misc{consentmark-precedent-ico-23andme-2025-06,
author = {{ConsentMark}},
year = {2025},
title = {ICO (United Kingdom) 23andme-2025-06 - 23andMe, Inc.},
howpublished = {\url{https://www.consentmark.com/precedent/ico-23andme-2025-06}},
note = {ConsentMark methodology v7.8.1}
}ConsentMark. (2025, June 5). ICO (United Kingdom) 23andme-2025-06 - 23andMe, Inc.. Methodology v7.8.1. https://www.consentmark.com/precedent/ico-23andme-2025-06[ICO (United Kingdom) 23andme-2025-06 - 23andMe, Inc. - ConsentMark](https://www.consentmark.com/precedent/ico-23andme-2025-06)ICO (United Kingdom) 23andme-2025-06 - 23andMe, Inc. - ConsentMark, 2025-06-05, methodology v7.8.1, https://www.consentmark.com/precedent/ico-23andme-2025-06