23andMe updated their Terms of Service on March 23, 2026, changing which users these terms apply to. The previous version applied to US users, while the new version applies to users outside the US, Canada, EU/EEA, UK, and Switzerland — making this an international version of the terms. Additionally, the conflict resolution clause was reversed: previously 23andMe's core Terms would override any additional terms, but now additional service-specific terms will take precedence over the main Terms.
The reversal of which terms win in a conflict — from the master Terms to service-specific terms — directly affects what rights and dispute resolution mechanisms apply to users, potentially reducing the protections they had under the prior structure. The removal of the mandatory arbitration warning also fundamentally changes the legal landscape for how disputes are resolved outside the US.
This update means the main 23andMe Terms of Service now govern users outside the US, Canada, EEA, UK, and Switzerland, rather than US users — who presumably have their own separate terms. Critically, the conflict resolution rule was reversed: if you use additional 23andMe services with their own terms, those specific terms now override the main Terms, which could reduce protections consumers previously had under the master agreement. You can check which regional version of 23andMe's Terms applies to you by visiting their website and reviewing the region-specific terms linked there.
23andMe has restructured its Terms of Service on March 23, 2026 to serve as the international baseline document (excluding US, Canada, EEA, UK, Switzerland users), and has reversed its conflict resolution hierarchy so that additional service-specific terms now supersede the main Terms. This directly impacts vendor risk assessments for any organization relying on 23andMe's prior arbitration and dispute resolution provisions as the controlling framework — those provisions may now be overridden by subsidiary service terms. Compliance officers with 23andMe in their vendor stack should verify which terms govern their specific services and whether the new hierarchy affects contractual protections. Action required for review.
1. GDPR (Regulation (EU) 2016/679): Art. 13(1)(c) and Art. 14(2)(b) require that data subjects be informed of the legal basis for processing in a clear and transparent manner. Rerouting international users to this Terms version without a corresponding update to privacy notices may create an Art. 13/14 gap. Art. 7(2) requires that consent requests be presented in an intelligible and easily accessible form — restructuring which Terms govern which users affects the consent chain.
Compliance intelligence locked
Obligation analysis, escalation trigger, board language, and recommended action.
Watcher: regulatory citations + obligations. Professional: full compliance memo.
ConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-000061.
ConductAtlas Policy Archive Entity: 23andMe | Document: 23andMe Terms of Service | Record: CA-C-000061 Captured: 2026-03-23 06:06:11 UTC URL: https://conductatlas.com/change/2026-03-23-23andme-23andme-terms-of-service-61/ Accessed: April 4, 2026
On March 23, 2026, 23andMe updated their privacy policy with several small but notable changes. The company removed a sentence …
Create a free account and add 23andMe to your watchlist. We'll email you the moment something changes.