You can permanently delete your 23andMe account, which also removes you from Research and destroys your physical DNA sample, but this action is irreversible and cannot be undone.
This analysis describes what 23andMe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy grants users a meaningful deletion right that includes destruction of the physical biological sample, but the irreversibility of the action means users who delete cannot recover their data or sample, and data already shared with third parties before deletion is not affected.
The updated privacy statement no longer explicitly directs users to a separate Medical Record Privacy Notice for telehealth services or explains that medical information collected through telehealth is governed by different privacy rules. Previously, the policy stated that users choosing telehealth services coordinated through 23andMe would find healthcare privacy protections described in a separate notice. That reference is now absent from the main privacy statement. Users seeking privacy information specific to telehealth services will need to determine independently whether a separate notice exists or contact 23andMe directly using the provided contact information.
View change record →The updated privacy statement no longer explicitly discloses a separate Medical Record Privacy Notice that previously described how medical information is used, disclosed, and maintained for telehealth services. Users who receive telehealth services coordinated through 23andMe may now lack clear notice of which privacy framework governs their medical records, since the reference to that parallel notice has been removed. The organizational scope change from '23andMe Research Institute' to '23andMe' narrows the explicitly named entities responsible for the policy, though operational impact depends on how these entities actually function.
View change record →Previous version had empty excerpt; current version now provides specific language about automatic opt-out from Research and irreversible sample discard upon account deletion.
View full change record →Account deletion triggers automatic opt-out from Research participation and physical sample discard, but the policy states the process cannot be cancelled or reversed, meaning users who delete lose access to all genetic reports and cannot restore their account or biological sample.
How other platforms handle this
After your account is deleted, we keep data about interactions you've had on our service to prevent abuse, ban evaders and others in an effort to protect and ensure the safety and security of our service and our members.
If you do not have a social security number you may still be eligible to open a limited Revolut personal account. Depending on your immigration status, we may ask you to provide us with a copy of your supported U.S. visa and may limit your access to certain products and features.
We keep information for as long as we need it to provide our products, comply with legal obligations, or for other legitimate purposes, such as to maintain safety, security, and integrity.
Monitoring
23andMe has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"You can delete your 23andMe account any time. If you do, we will automatically opt you out of Research and discard your sample. Keep in mind this process cannot be cancelled or reversed.— Excerpt from 23andMe's 23andMe Privacy Statement
REGULATORY LANDSCAPE: The account deletion mechanism is relevant to GDPR Article 17 right to erasure, CCPA deletion rights under California law, and the California Genetic Information Privacy Act. The policy's statement that deletion is irreversible and includes sample discard addresses the biological data dimension of deletion rights that is operationally distinct from standard digital data deletion. GOVERNANCE EXPOSURE: Medium. The deletion mechanism appears designed to honor user deletion rights under GDPR and CCPA, but the carve-out for data already incorporated into Research or shared with third parties prior to deletion creates a compliance gap relative to GDPR's right to erasure, which requires evaluation of whether the research exemption under Article 17(3)(d) applies to all third-party partners or only qualifying scientific research. JURISDICTION FLAGS: EU and UK users have GDPR erasure rights that may be more expansive than what the policy fully addresses for third-party research data. California residents have CCPA deletion rights that may require additional disclosure about data already shared with partners prior to deletion. The biological sample discard aspect is operationally unique to genetic testing companies and has no direct analogue in most consumer data frameworks. CONTRACT AND VENDOR IMPLICATIONS: The irreversibility of deletion should be documented in user-facing consent flows. Legal teams should confirm that laboratory partners have contractual obligations to destroy samples upon receiving discard instructions, and that these destruction events are logged for regulatory compliance. COMPLIANCE CONSIDERATIONS: Compliance teams should map the data flows that are not affected by account deletion, specifically genetic data already shared with research partners, to assess whether additional disclosures or opt-out mechanisms are required under applicable law. The consent interface for account deletion should clearly communicate the carve-out for previously shared Research data.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The policy grants users a meaningful deletion right that includes destruction of the physical biological sample, but the irreversibility of the action means users who delete cannot recover their data or sample, and data already shared with third parties before deletion is not affected.
Account deletion triggers automatic opt-out from Research participation and physical sample discard, but the policy states the process cannot be cancelled or reversed, meaning users who delete lose access to all genetic reports and cannot restore their account or biological sample.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by 23andMe.