23andMe can use a de-identified version of your genetic data to develop new products and services, including sharing it with third-party commercial partners. The terms describe this research participation as voluntary and subject to a separate consent document.
This analysis describes what 23andMe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The provision establishes the scope and permissible uses of de-identified data for internal product development and potential third-party commercialization activities. By specifying that such activities operate under voluntary participation with IRB oversight, the clause delineates the regulatory framework governing 23andMe's research operations on de-identified genetic and health information.
Interpretive note: The scope of 'de-identified' is not defined in the excerpted document text, and whether the de-identification standard applied satisfies the requirements of each served jurisdiction is uncertain and may require jurisdiction-specific legal analysis.
The updated Terms now apply only to users who live outside the United States, Canada, EEA, UK, and Switzerland, or who access the Services from outside those regions. US, Canadian, EEA, UK, and Swiss users are directed to region-specific Terms instead. Additionally, when terms for a specific Service conflict with the main Terms, the specific Service terms now govern that portion of your use rather than the main Terms controlling. The mandatory arbitration provision remains in the document but is no longer prominently featured at the very beginning of the Terms.
View change record →The updated Terms of Service now apply exclusively to users in the United States, narrowing the geographic scope from the prior version that addressed users in multiple regions. The terms now contain a prominently featured mandatory arbitration provision that requires disputes to be resolved through individual arbitration on an individual basis rather than through jury trials or class action lawsuits. This means that if a user has a dispute with 23andMe, the updated terms require arbitration as the method of resolution instead of traditional litigation. Additionally, if a user purchases additional services, the main Terms of Service (including the arbitration provision) will control any conflicting terms from those additional services. You can review the complete updated Terms of Service through the link provided in the document.
View change record →The updated terms now apply only to users who live outside or access services outside the United States, Canada, EEA, UK, and Switzerland. Previously, the terms applied to US-based users. The terms also clarify that when service-specific terms conflict with the general Terms of Service, the service-specific terms will govern that particular service rather than the general terms controlling all conflicts. This means users of additional services may operate under different dispute resolution and governance procedures depending on which service they are using.
View change record →Under these terms, your de-identified genetic information may be used in commercial activities with outside companies as part of 23andMe's product development program. Because this participation is described as voluntary and consent-based, reviewing and understanding your research consent options before submitting a sample is the most important action you can take.
How other platforms handle this
We may use the information we collect to help us improve our products and services, to develop new features, and to perform analytics. We may also use your information to personalize your experience and to allow us to deliver the type of content and product offerings in which you are most interested...
Mixpanel may use aggregated or de-identified data derived from customer event data for its own purposes, including improving its services, developing new features, and generating analytics insights, provided that such data cannot reasonably be used to identify individual users.
We collect information about you when you shop in our stores, including through store cameras, loyalty programs, payment processing systems, and other in-store technologies. This information is used to improve store operations, loss prevention, and marketing.
Monitoring
23andMe has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"When we use the term "Product Development", it means research performed for the purpose of new product development and new product development activities performed by 23andMe on De-identified Information. These activities may include, among other things, improving our Services and/or offering new products or services to you; performing quality control activities; conducting data analysis that may lead to and/or include commercialization with a third party. Participation in such research is voluntary and based upon an Institutional Review Board-approved consent document.— Excerpt from 23andMe's 23andMe Terms of Service
(1) REGULATORY LANDSCAPE: This provision implicates data protection frameworks governing genetic data as a special category, including the GDPR for EEA users (though this document applies to non-EEA users, downstream data flows may still be relevant), Australia's Privacy Act, Singapore's PDPA, and analogous national frameworks in served jurisdictions. The FTC Act's prohibition on unfair or deceptive practices is relevant to the adequacy of disclosures about commercial use. IRB oversight is referenced, which engages research ethics regulations under the Common Rule and equivalent international standards. Enforcement authorities vary by jurisdiction but include national data protection authorities and consumer protection agencies in each served country. (2) GOVERNANCE EXPOSURE: High. The authorization to use de-identified genetic data for commercialization with third parties creates significant compliance exposure because the adequacy of de-identification for genetic data is contested in regulatory and academic contexts. Genetic data has a high re-identification risk even after standard anonymization techniques, and several jurisdictions treat genetic information as a special category regardless of purported de-identification status. The term 'may lead to and/or include commercialization with a third party' is broad and may encompass data licensing, joint research agreements, or other commercial arrangements not further specified in these terms. (3) JURISDICTION FLAGS: Users in Australia, Singapore, Canada (outside EEA scope), and other jurisdictions with specific genetic or health data protections face heightened exposure. Some national laws require explicit, specific consent for commercial use of genetic data that may not be satisfied by a general IRB-approved consent document. In jurisdictions that do not recognize de-identification as a complete exemption from data protection obligations for genetic material, this provision may require additional legal basis or regulatory notification. (4) CONTRACT AND VENDOR IMPLICATIONS: The reference to third-party commercialization without naming specific partners or categories of partners limits the ability of procurement or compliance teams to conduct targeted vendor assessments. B2B contracts with any entity receiving de-identified genetic data from 23andMe should be evaluated for data use restrictions, re-identification prohibitions, and downstream sharing limitations. The provision does not assert audit rights over third-party recipients, which may be a gap relative to standard data processing agreement practice. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the IRB-approved consent document referenced in this provision is accessible to and reviewed by users prior to sample submission, and that the consent mechanism meets the requirements of each served jurisdiction. Data mapping should trace the flow of de-identified genetic data from sample processing through any third-party commercialization channel. Policy review should assess whether the voluntary participation framing is operationally implemented in a manner that allows meaningful opt-out without degrading the core testing service.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The provision establishes the scope and permissible uses of de-identified data for internal product development and potential third-party commercialization activities. By specifying that such activities operate under voluntary participation with IRB oversight, the clause delineates the regulatory framework governing 23andMe's research operations on de-identified genetic and health information.
Under these terms, your de-identified genetic information may be used in commercial activities with outside companies as part of 23andMe's product development program. Because this participation is described as voluntary and consent-based, reviewing and understanding your research consent options before submitting a sample is the most important action you can take.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by 23andMe.