Thanks, but: neither of those links say it's a California requirement, nor that it's stored with PII, nor that it's necessarily/always kept for 10 years (your original claim).

Instead, it's said to be kept for at most 10 years, & even that is in a paragraph describing what happens if a customer specifically chooses optional storage!

Further, if you're referencing 23andme's own privacy/terms documents, those also repeatedly pledge that samples are irreversibly destroyed upon request.

So while I can still believe your original claim might be true – California requires many dumb & anti-privacy things, sometimes in dishonest ways! – the links you've forwarded provide more grounds to doubt your claim than support it.

If it's truly a state legal requirement that overrides a user's explicit discard request for a full 10 years, that should be easy to document with a clear and authoritative link, shouldn't it?