Track 1 platform and get the weekly governance digest. No credit card required.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This document establishes 23andMe's data collection, use, and sharing practices for genetic testing services, including DNA information, health data, and personal identifiers. The policy authorizes sharing genetic and health data with third-party research partners in de-identified form when users opt into Research participation, and permits transfer of personal and genetic data to successor entities in the event of merger, acquisition, or bankruptcy. Users may modify Research participation status, sample storage preferences, and request account deletion through account settings, though the policy specifies that data already incorporated into completed research or previously shared with third parties cannot be recalled upon deletion.
This Privacy Statement, published by 23andMe Research Institute, governs the collection, use, storage, processing, and transfer of personal information across all 23andMe websites, the mobile app, and related services, including genetic testing and optional telehealth services for which a separate Medical Record Privacy Notice applies. The agreement states that 23andMe collects genetic information, self-reported health and demographic data, web and app usage data, device identifiers, and payment information; the terms authorize use of this data for product improvement, research (with separate consent), and sharing with service providers, business partners, and successors in interest. The policy discloses that genetic and health data contributed to Research may be shared with third-party research partners in de-identified or aggregated form, and that in a business transfer scenario such as a merger or bankruptcy, personal and genetic data may be transferred to an acquiring entity, creating operationally distinct exposure given the sensitivity of genomic information; the agreement asserts that users retain certain deletion rights but notes that data already incorporated into research or shared with third parties prior to deletion may not be fully recoverable. This document engages GDPR for EU/EEA users, CCPA and California Genetic Information Privacy Act for California residents, HIPAA considerations arise at the margins given the health-related nature of data though 23andMe is not a covered entity for its primary DTC service, and the FTC has authority over unfair or deceptive privacy practices applicable to this document. Given 23andMe's pending bankruptcy proceedings and the sensitivity of genomic data held at scale, compliance teams should evaluate data transfer obligations, successor entity consent requirements, and the adequacy of de-identification standards used prior to third-party research sharing.
Institutional analysis available with Compliance
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.
Start Compliance free trial4 important changes detected
5 versions captured · Last updated: May 2026
23andMe updated its Privacy Statement on April 19, 2026 to clarify that the policy applies to websites owned and operated by 23andMe Research Institute rather than 23andMe broadly. The update …
View change record →23andMe removed a reference to its Research Institute from the opening scope statement, changing 'websites owned and operated by 23andMe Research Institute' to 'websites owned and operated by 23andMe'. The …
View change record →This new provision emphasizes the irreversibility of opting out of research and data deletion, establishing a distinct high-severity provision around research participation consequences.
This new provision clarifies user control over DNA sharing features, elevating genetic data sharing decisions to high severity by creating a separate named provision for this critical choice.
This new provision adds granularity around physical sample storage decisions and irreversibility, giving users explicit awareness of sample destruction options post-analysis.
This addition explicitly separates DNA sharing feature participation from other provisions, emphasizing user control over secondary data uses like relative matching.
This new provision highlights security measures as a standalone disclosure, building transparency around account protection mechanisms.
The removal of this high-severity provision regarding pharmaceutical data sharing represents a significant change in transparency about third-party research commercialization, though content may be integrated into other provisions.
Removal of explicit law enforcement disclosure provision eliminates transparency about government access to genetic data, a critical privacy safeguard previously highlighted.
The removal of this distinct high-severity provision on data transfer during corporate events reduces clarity on what happens to genetic data in M&A or bankruptcy scenarios.
Removal of explicit international data transfer provision eliminates disclosure about cross-border data movement and associated regulatory frameworks affecting user privacy.
The removal of this state-specific privacy rights provision reduces explicit guidance for California residents on their statutory rights and exercise mechanisms.
Previous version had empty excerpt; current version now provides specific language about automatic opt-out from Research and irreversible sample discard upon account deletion.
Previous version had empty excerpt; current version now provides detailed language specifying that telehealth involves licensed healthcare providers and references separate Medical Record Privacy Notice.
Monitoring
23andMe has updated this document before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
Compliance Governance Intelligence
Need provision-level monitoring and regulatory mapping?
Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.
Start Compliance free trialCross-platform context
See how other platforms handle Business Asset Transfer in Bankruptcy or Acquisition and similar clauses.
Compare across platforms →Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do…
Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.