23andMe Privacy Statement

This is 23andMe's privacy policy, explaining how the company collects and uses your DNA, health history, and personal information when you use their genetic testing service. The most important thing to know is that if you opt into their Research program, your genetic data and health information may be shared with pharmaceutical and biotech companies for drug development — and data already contributed to research may not be fully deleted even if you close your account. You should review your Research participation settings in your account and consider whether to opt out of the Research program if you do not want your genetic data used for commercial research purposes.

This Privacy Statement governs 23andMe Research Institute's collection, use, storage, processing, and transfer of personal information — including genetic data, health information, and self-reported data — across all 23andMe websites, mobile applications, and Services, with legal basis grounded in user consent, contractual necessity, and legitimate interests depending on jurisdiction. The most significant obligations created include 23andMe's right to share de-identified or aggregated genetic and phenotypic data with third-party research partners, including pharmaceutical and biotech companies, subject to user opt-in consent for the Research program; to store biometric/genetic samples unless users affirmatively elect destruction; and to retain certain data even after account deletion. Notable provisions that deviate from industry standard include the explicit commercial research use of genetic data (including potential sharing with drug development partners), the collection of data about non-users through the DNA Relatives feature, and the fact that deletion of an account does not guarantee deletion of already-contributed research data or derived research outputs. The policy engages CCPA/CPRA (Cal. Civ. Code §1798.100 et seq.) for California residents, GDPR and UK GDPR for EU/UK users, HIPAA tangentially via a separate Medical Record Privacy Notice for Telehealth users, and FTC Act Section 5 unfair or deceptive practices standards; material compliance considerations include the sensitivity of genetic data as a special category under GDPR Art. 9, CCPA's treatment of biometric and health information as sensitive personal information, and ongoing scrutiny following 23andMe's 2023 data breach affecting approximately 6.9 million users.