Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement states that account deletion triggers automatic research opt-out and physical sample discard, and that neither the deletion process nor a prior sample discard choice can be reversed or cancelled.
This analysis describes what 23andMe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes an irreversible operational workflow for account and biological sample deletion, which has direct implications for data subject rights requests under GDPR Article 17 and CCPA deletion request compliance, as well as for users who may wish to restore access or retrieve data after deletion.
Interpretive note: The document does not specify what data categories, if any, are retained after account deletion for legal or regulatory purposes, or whether deletion propagates to data already pooled in research datasets.
Under this provision, initiating account deletion permanently discards the user's biological sample and removes them from research participation, with no mechanism available to cancel or reverse the process once initiated. A prior choice to discard the sample rather than store it is also described as irreversible.
Cross-platform context
See how other platforms handle Irreversible Account Deletion and Sample Discard and similar clauses.
Compare across platforms →Monitoring
23andMe has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"You can delete your 23andMe account any time. If you do, we will automatically opt you out of Research and discard your sample. Keep in mind this process cannot be cancelled or reversed. Note that a discard choice cannot be reversed.Excerpt from 23andMe's Privacy Statement
(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 17 (right to erasure), CCPA deletion request obligations, and California GIPA provisions governing destruction of genetic information. The FTC's general oversight of consumer data practices is also relevant. The irreversibility language may interact with data subject rights frameworks that require confirmation of deletion and defined timelines. (2) GOVERNANCE EXPOSURE: Medium. The provision aligns account deletion with sample discard and research opt-out in a single irreversible workflow, which may satisfy GDPR and CCPA deletion obligations for the biological sample and associated data. However, the document does not specify the timeline within which deletion is completed, what data categories are retained post-deletion (e.g., for legal or regulatory purposes), or whether any data persists in already-pooled research datasets. These gaps create compliance exposure under transparency requirements. (3) JURISDICTION FLAGS: GDPR and UK GDPR users have a statutory right to erasure under Article 17, and the document should specify whether any data categories are retained under permitted exceptions. California residents have CCPA deletion rights, and California GIPA imposes specific requirements on destruction of genetic information. Heightened exposure exists where users in these jurisdictions have already opted into research and their data has been pooled. (4) CONTRACT AND VENDOR IMPLICATIONS: If research data has been shared with third-party research partners prior to account deletion, the document does not address whether deletion requests propagate to those partners. Legal teams should assess whether research data sharing agreements include deletion or withdrawal provisions aligned with the user-facing representation that opt-out occurs automatically upon account deletion. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should document the technical workflow for account deletion, including the timeline for sample discard and data removal, whether any data categories are retained post-deletion under legal or regulatory exceptions, and whether research partner agreements accommodate deletion propagation. The absence of a retention period disclosure in this excerpt warrants review against GDPR transparency requirements.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes an irreversible operational workflow for account and biological sample deletion, which has direct implications for data subject rights requests under GDPR Article 17 and CCPA deletion request compliance, as well as for users who may wish to restore access or retrieve data after deletion.
Under this provision, initiating account deletion permanently discards the user's biological sample and removes them from research participation, with no mechanism available to cancel or reverse the process once initiated. A prior choice to discard the sample rather than store it is also described as irreversible.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by 23andMe.