California residents have the right to know what personal data 23andMe collects, request deletion of their data, opt out of the sale or sharing of their data, and not be discriminated against for exercising these rights.
This analysis describes what 23andMe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision operationalizes 23andMe's compliance obligations under California law by explicitly acknowledging CCPA rights holders and establishing the framework through which residents may submit data requests. The clause creates procedural pathways for exercising legally mandated privacy rights specific to California jurisdiction.
The removal of this state-specific privacy rights provision reduces explicit guidance for California residents on their statutory rights and exercise mechanisms.
View full change record →California residents can request a copy of all personal data 23andMe holds about them, request deletion, and opt out of data sharing that may constitute a 'sale' under CCPA — rights that go beyond what the general privacy policy offers to other users.
How other platforms handle this
you may also have the right to: (i) opt out of processing of Personal Data for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects...and (iii) appeal any decision by ZipRecruiter...
You may contact our privacy team with any requests of disclosure, correction, or deletion of your personal information. You may also request suspension of use or suspension of sharing of your personal information with certain third parties.
When you use them, we'll validate your request by verifying your identity (for example, by confirming that you're signed in to your Google Account).
CCPA and CPRA compliance is mandatory for 23andMe as a data broker handling sensitive personal information; compliance teams should audit whether genetic data sharing with research partners constitutes a 'sale' or 'sharing for cross-context behavioral …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision operationalizes 23andMe's compliance obligations under California law by explicitly acknowledging CCPA rights holders and establishing the framework through which residents may submit data requests. The clause creates procedural pathways for exercising legally mandated privacy rights specific to California jurisdiction.
California residents can request a copy of all personal data 23andMe holds about them, request deletion, and opt out of data sharing that may constitute a 'sale' under CCPA — rights that go beyond what the general privacy policy offers to other users.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by 23andMe.