23andMe can use your genetic and health data with identifying details removed, and claims that this 'de-identified' data can be used without restriction — meaning it can be shared or sold without the usual consent requirements.
Because 23andMe can use and share de-identified genetic data without restriction, your DNA-derived information may flow to third parties in ways you cannot control or opt out of, and the re-identification risk for genetic data is scientifically recognized as non-trivial. This provision effectively enables broad commercial use of your genetic information outside the consent framework.
Cross-platform context
See how other platforms handle De-Identification and Aggregation of Genetic Data and similar clauses.
Compare across platforms →Multiple academic studies have demonstrated that genetic data can be re-identified even after standard de-identification, making the 'use without restriction' claim potentially risky — your de-identified DNA may not be as anonymous as the policy implies.
REGULATORY FRAMEWORK: GDPR Art. 4(1) and Recital 26 set the standard for anonymization (data must be irreversibly anonymized to fall outside GDPR scope). The FTC's 2012 Privacy Report guidance on de-identification requires reasonable technical and administrative safeguards, a commitment not to re-identify, and downstream contractual obligations. CCPA §1798.140(a) defines 'aggregate consumer information' as data that cannot reasonably be linked to a consumer, with the standard being a reasonable person test. OCR guidance under HIPAA establishes Safe Harbor and Expert Determination de-identification standards (45 CFR §164.514).
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.