If you previously opted into Research, genetic and health data you contributed may already have been shared with third-party research partners and cannot be recalled, even if you later withdraw consent or delete your account.
This analysis describes what 23andMe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy discloses that Research consent, once acted upon and data shared, creates an irreversible commitment; withdrawal from Research stops future sharing but does not remove already-contributed data from third-party researchers who received it.
This new provision emphasizes the irreversibility of opting out of research and data deletion, establishing a distinct high-severity provision around research participation consequences.
View full change record →Users who opted into Research and whose genetic or self-reported data was shared with academic or commercial partners before withdrawal cannot have that data recalled, meaning third parties may continue to use contributed genomic data indefinitely under the terms of their research agreements with 23andMe.
How other platforms handle this
We will also provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected.
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
"You can delete your 23andMe account any time. If you do, we will automatically opt you out of Research and discard your sample. Keep in mind this process cannot be cancelled or reversed.Excerpt from 23andMe's Privacy Statement
REGULATORY LANDSCAPE: Research use of genetic data implicates GDPR Article 9 (special category data) and the research exemptions under Article 89, as well as US Common Rule requirements if federally funded research is involved.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The policy discloses that Research consent, once acted upon and data shared, creates an irreversible commitment; withdrawal from Research stops future sharing but does not remove already-contributed data from third-party researchers who received it.
Users who opted into Research and whose genetic or self-reported data was shared with academic or commercial partners before withdrawal cannot have that data recalled, meaning third parties may continue to use contributed genomic data indefinitely under the terms of their research agreements with 23andMe.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by 23andMe.