23andMe · 23andMe Privacy Statement · View original document ↗

Sample Storage Choice

Medium severity High confidence Explicitdocumentlanguage Unique · 0 of 343 platforms
Share 𝕏 Share in Share 🔒 PDF
Monitor governance changes for 23andMe Create a free account to receive the weekly governance digest and monitor one platform for governance changes.
Create free account No credit card required.
Document Record

What it is

You can choose whether 23andMe stores your physical DNA sample for potential future testing; if you choose to discard it, the sample is destroyed after lab processing and that choice cannot be undone.

This analysis describes what 23andMe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology

ConductAtlas Analysis

Why it matters (compliance & governance perspective)

The policy provides a meaningful choice over biological sample retention, which is operationally significant because a stored sample could be used for future genetic analyses if you later consent, while a discarded sample cannot be recovered for any future purpose.

Recent Activity

This document changed recently

Medium May 5, 2026

The updated privacy statement no longer explicitly directs users to a separate Medical Record Privacy Notice for telehealth services or explains that medical information collected through telehealth is governed by different privacy rules. Previously, the policy stated that users choosing telehealth services coordinated through 23andMe would find healthcare privacy protections described in a separate notice. That reference is now absent from the main privacy statement. Users seeking privacy information specific to telehealth services will need to determine independently whether a separate notice exists or contact 23andMe directly using the provided contact information.

View change record →
Medium Mar 23, 2026

The updated privacy statement no longer explicitly discloses a separate Medical Record Privacy Notice that previously described how medical information is used, disclosed, and maintained for telehealth services. Users who receive telehealth services coordinated through 23andMe may now lack clear notice of which privacy framework governs their medical records, since the reference to that parallel notice has been removed. The organizational scope change from '23andMe Research Institute' to '23andMe' narrows the explicitly named entities responsible for the policy, though operational impact depends on how these entities actually function.

View change record →

Clause Stability Stable

0
Changes
3
Months Monitored
May 10, 2026
First Seen
May 22, 2026
Last Seen
This clause type exists across 3350 other provisions on other platforms.

Change history

added May 21, 2026

This new provision adds granularity around physical sample storage decisions and irreversibility, giving users explicit awareness of sample destruction options post-analysis.

View full change record →

Consumer impact (what this means for users)

Users who choose to discard their physical DNA sample cannot reverse that decision; users who allow storage should be aware that the stored sample may be used for additional analyses if they provide future consent, and the sample is subject to transfer provisions in the event of a business transfer.

How other platforms handle this

Ledger Medium

At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.

Garmin Medium

If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...

Strava Medium

We may display advertisements on our Services and those advertisements may be targeted to your interests based on your personal information. We may share your personal information with advertising partners for interest-based advertising purposes. You may opt out of interest-based advertising by visi...

See all platforms with this clause type →

Monitoring

23andMe has changed this document before.

Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.

Start Monitor free trial Or create a free account →
▸ View Original Clause Language DOCUMENT RECORD
"
You can choose to have your sample stored. If not, no problem. It will be securely destroyed after the laboratory completes its work. Note that a discard choice cannot be reversed.

— Excerpt from 23andMe's 23andMe Privacy Statement

ConductAtlas Analysis

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Biological sample storage and use implicates state genetic privacy laws including the California Genetic Information Privacy Act, Illinois Genetic Information Privacy Act, and similar statutes in other states. The storage and potential future use of biological samples also engages FDA regulatory considerations for certain laboratory testing contexts. GOVERNANCE EXPOSURE: Medium. The irreversibility of the discard choice creates a one-way operational gate; once discarded, no future testing is possible, which may limit the company's ability to provide future services but also limits user exposure to expanded testing without fresh consent. The key governance question is whether the sample storage consent is sufficiently specific to authorize future uses not contemplated at the time of original consent. JURISDICTION FLAGS: State genetic privacy laws vary significantly in their requirements for consent to store and reuse biological samples. Illinois, California, Texas, and New York have specific genetic privacy statutes that may impose consent requirements beyond what the policy describes. CONTRACT AND VENDOR IMPLICATIONS: Laboratory partners who process and store samples should be assessed for compliance with applicable genetic privacy laws and their obligations in the event of a business transfer involving the sample repository. COMPLIANCE CONSIDERATIONS: Consent forms for sample storage should be reviewed to ensure they adequately disclose the potential future uses of stored samples and the business transfer scenario. Audit trails for sample storage and discard choices should be maintained.

Full compliance analysis

Regulatory citations, enforcement risk, and due diligence action items.

Track 1 platform — free Try Monitor free for 14 days

Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.

Applicable agencies

  • FTC
    The FTC has authority over consumer privacy practices, including representations made about biological sample storage and destruction.
    File a complaint →

Applicable regulations

BIPA
Illinois, USA
CCPA/CPRA
California, USA
Connecticut Data Privacy Act Amendments
US-CT
CAN-SPAM
United States Federal
FTC Act Section 5
United States Federal
GDPR
European Union
HIPAA
United States Federal
Indiana Consumer Data Protection Act
US-IN
Kentucky Consumer Data Protection Act
US-KY
Universal Opt-Out Mechanism Expansion 2026
US

Provision details

Document information
Document
23andMe Privacy Statement
Entity
23andMe
Document last updated
May 5, 2026
Tracking information
First tracked
May 12, 2026
Last verified
May 12, 2026
Record ID
CA-P-008859
Document ID
CA-D-00148
Evidence Provenance
Source URL
Wayback Machine
Content hash (SHA-256)
dc3df5a6c7d5e8a0428d5086d3cf2f15f5072911b18402048166183c31b60dd4
Analysis generated
May 12, 2026 13:37 UTC
Methodology
Evidence
✓ Snapshot stored   ✓ Hash verified
Citation Record
Entity: 23andMe
Document: 23andMe Privacy Statement
Record ID: CA-P-008859
Captured: 2026-05-12 13:37:21 UTC
SHA-256: dc3df5a6c7d5e8a0…
URL: https://conductatlas.com/platform/23andme/23andme-privacy-statement/sample-storage-choice/
Accessed: June 27, 2026
Permanent archival reference. Stable identifier suitable for legal filings, compliance documentation, and research citation.
Classification
Severity
Medium
Categories

Other risks in this policy

Related Analysis

Compliance Governance Intelligence

Need to monitor specific governance provisions?

Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.

Arbitration clauses AI governance Data rights Indemnification Retention policies
Start Compliance free trial

Or start with Monitor →

Built from archived source documents, structured governance mappings, and historical version tracking.

Frequently Asked Questions

What does 23andMe's Sample Storage Choice clause do?

The policy provides a meaningful choice over biological sample retention, which is operationally significant because a stored sample could be used for future genetic analyses if you later consent, while a discarded sample cannot be recovered for any future purpose.

How does this clause affect you?

Users who choose to discard their physical DNA sample cannot reverse that decision; users who allow storage should be aware that the stored sample may be used for additional analyses if they provide future consent, and the sample is subject to transfer provisions in the event of a business transfer.

Is ConductAtlas affiliated with 23andMe?

No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by 23andMe.