What can I do about this clause?

{'method': 'WEB_FORM', 'recipient': 'https://you.23andme.com/', 'difficulty': 'MODERATE', 'action_type': 'DELETE_DATA', 'instructions': 'Log into your account and navigate to Settings > Account Actions to request account deletion, which will automatically opt you out of Research and initiate sample discard within 30 days. Be aware this is irreversible and will not remove data already used in completed or ongoing research.', 'deadline_days': None, 'deadline_hours': None}

Which regulatory agencies enforce this type of clause?

{'agency': 'FTC', 'reason': 'The FTC has authority to challenge post-deletion data retention practices as unfair or deceptive under FTC Act Section 5, particularly where consumers are not clearly informed that deletion is incomplete.', 'complaint_url': 'https://reportfraud.ftc.gov/'}, {'agency': 'State_AG', 'reason': "California's Attorney General and Privacy Protection Agency enforce CCPA §1798.105 deletion rights; state AGs in breach-affected states may also have jurisdiction over retention practices.", 'complaint_url': 'https://www.naag.org/find-my-ag/'}

What is the severity of this clause?

ConductAtlas classifies this Post-Deletion Research Data Retention clause as high severity. Severity reflects the magnitude of rights affected, the breadth of users impacted, and the degree of discretion the platform retains.

Post-Deletion Research Data Retention — 23andMe

Share 𝕏 Share in Share 🔒 PDF

What it is

Even if you delete your 23andMe account or request your DNA sample be destroyed, any genetic data already contributed to research studies may continue to be used — you cannot get it back.

Consumer impact (what this means for users)

If you previously opted into 23andMe Research, your genetic data may remain in use by 23andMe and its research partners even after you close your account, meaning deletion does not equal full data removal for research participants. This is a significant and permanent limitation on your right to erasure.

What you can do

⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.

Delete Your Data

Log into your account and navigate to Settings > Account Actions to request account deletion, which will automatically opt you out of Research and initiate sample discard within 30 days. Be aware this is irreversible and will not remove data already used in completed or ongoing research.

Cross-platform context

See how other platforms handle Post-Deletion Research Data Retention and similar clauses.

Compare across platforms →

Need full compliance memos? See Professional →

Why it matters (compliance & risk perspective)

This provision means that account deletion — often assumed to be a complete data erasure — does not fully remove your genetic information from ongoing or completed research, creating a permanent data exposure that consumers cannot reverse.

View original clause language

If you have previously provided a saliva sample but request that we discard it, we will discard the sample within 30 days of receiving your request. Please be aware that if you have consented to participating in 23andMe Research, some research using your Genetic Information and/or Self-Reported Information may have already been performed or may still be in progress, and your data may still be used for these purposes, even if you have requested your sample be discarded or your account deleted.

Institutional analysis (Compliance & legal intelligence)

REGULATORY FRAMEWORK: This provision directly engages GDPR Art. 17 (right to erasure/right to be forgotten) and the research exemption under Art. 17(3)(d), which permits retention of personal data for scientific research purposes where erasure would seriously impair research objectives. It also implicates CCPA §1798.105 right to delete and the research exception under §1798.105(d). Enforcement authorities include EU supervisory authorities and the California Privacy Protection Agency.

🔒

Compliance intelligence locked

Regulatory citations, enforcement risk, and due diligence action items.

Watcher $9.99/mo Professional $149/mo

Watcher: regulatory citations. Professional: full compliance memo.

Applicable agencies

FTC

The FTC has authority to challenge post-deletion data retention practices as unfair or deceptive under FTC Act Section 5, particularly where consumers are not clearly informed that deletion is incomplete.
File a complaint →
State AG

California's Attorney General and Privacy Protection Agency enforce CCPA §1798.105 deletion rights; state AGs in breach-affected states may also have jurisdiction over retention practices.
File a complaint →

Provision details

Document information

Document

23andMe Privacy Statement

Entity

23andMe

Document last updated

April 29, 2026

Tracking information

First tracked

April 27, 2026

Last verified

April 27, 2026

Record ID

CA-P-003463

Document ID

CA-D-00148

Evidence Provenance

Source URL

https://www.23andme.com/legal/privacy/

Wayback Machine

View archived versions →

SHA-256

dc3df5a6c7d5e8a0428d5086d3cf2f15f5072911b18402048166183c31b60dd4

Verified

✓ Snapshot stored ✓ Change verified

How to Cite

ConductAtlas Policy Archive
Entity: 23andMe | Document: 23andMe Privacy Statement | Record: CA-P-003463
Captured: 2026-04-27 13:30:15 UTC | SHA-256: dc3df5a6c7d5e8a0…
URL: https://conductatlas.com/platform/23andme/23andme-privacy-statement/post-deletion-research-data-retention/
Accessed: May 2, 2026

Classification

Severity

High

Post-Deletion Research Data Retention