23andMe can use a de-identified version of your genetic data to develop new products and services, including sharing it with third-party commercial partners. The terms describe this research participation as voluntary and subject to a separate consent document.
This analysis describes what 23andMe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Your genetic data, even when de-identified, is among the most sensitive personal information that exists and can potentially be re-identified. The terms authorize use of that data for commercial purposes with third parties, which is a significant permission that users should consciously evaluate before agreeing.
Interpretive note: The scope of 'de-identified' is not defined in the excerpted document text, and whether the de-identification standard applied satisfies the requirements of each served jurisdiction is uncertain and may require jurisdiction-specific legal analysis.
The updated Terms now apply only to users who live outside the United States, Canada, EEA, UK, and Switzerland, or who access the Services from outside those regions. US, Canadian, EEA, UK, and Swiss…
The updated Terms of Service now apply exclusively to users in the United States, narrowing the geographic scope from the prior version that addressed users in multiple regions. The terms now contain…
The updated terms now apply only to users who live outside or access services outside the United States, Canada, EEA, UK, and Switzerland. Previously, the terms applied to US-based users. The terms a…
Under these terms, your de-identified genetic information may be used in commercial activities with outside companies as part of 23andMe's product development program. Because this participation is described as voluntary and consent-based, reviewing and understanding your research consent options before submitting a sample is the most important action you can take.
How other platforms handle this
Perplexity may collect and use aggregated and de-identified data derived from Customer's and Authorized Users' use of the Service for purposes of improving, developing, and enhancing the Service and Perplexity's AI models, provided that such data does not identify Customer or any individual user.
We may de-identify, anonymize, or aggregate information we collect so the information cannot reasonably identify you or your device, or we may collect information that is already in de-identified form. For example, we may disclose performance benchmark data and other aggregated, anonymized, or de-id...
We use your personal information to personalize your experience with our products and services, improve and develop new features and products, conduct research and analytics, and to send you communications about products and services that may interest you.
Monitoring
23andMe has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"When we use the term "Product Development", it means research performed for the purpose of new product development and new product development activities performed by 23andMe on De-identified Information. These activities may include, among other things, improving our Services and/or offering new products or services to you; performing quality control activities; conducting data analysis that may lead to and/or include commercialization with a third party. Participation in such research is voluntary and based upon an Institutional Review Board-approved consent document.— Excerpt from 23andMe's 23andMe Terms of Service
(1) REGULATORY LANDSCAPE: This provision implicates data protection frameworks governing genetic data as a special category, including the GDPR for EEA users (though this document applies to non-EEA users, downstream data flows may still be relevant), Australia's Privacy Act, Singapore's PDPA, and analogous national frameworks in served jurisdictions. The FTC Act's prohibition on unfair or deceptive practices is relevant to the adequacy of disclosures about commercial use. IRB oversight is referenced, which engages research ethics regulations under the Common Rule and equivalent international standards. Enforcement authorities vary by jurisdiction but include national data protection authorities and consumer protection agencies in each served country. (2) GOVERNANCE EXPOSURE: High. The authorization to use de-identified genetic data for commercialization with third parties creates significant compliance exposure because the adequacy of de-identification for genetic data is contested in regulatory and academic contexts. Genetic data has a high re-identification risk even after standard anonymization techniques, and several jurisdictions treat genetic information as a special category regardless of purported de-identification status. The term 'may lead to and/or include commercialization with a third party' is broad and may encompass data licensing, joint research agreements, or other commercial arrangements not further specified in these terms. (3) JURISDICTION FLAGS: Users in Australia, Singapore, Canada (outside EEA scope), and other jurisdictions with specific genetic or health data protections face heightened exposure. Some national laws require explicit, specific consent for commercial use of genetic data that may not be satisfied by a general IRB-approved consent document. In jurisdictions that do not recognize de-identification as a complete exemption from data protection obligations for genetic material, this provision may require additional legal basis or regulatory notification. (4) CONTRACT AND VENDOR IMPLICATIONS: The reference to third-party commercialization without naming specific partners or categories of partners limits the ability of procurement or compliance teams to conduct targeted vendor assessments. B2B contracts with any entity receiving de-identified genetic data from 23andMe should be evaluated for data use restrictions, re-identification prohibitions, and downstream sharing limitations. The provision does not assert audit rights over third-party recipients, which may be a gap relative to standard data processing agreement practice. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the IRB-approved consent document referenced in this provision is accessible to and reviewed by users prior to sample submission, and that the consent mechanism meets the requirements of each served jurisdiction. Data mapping should trace the flow of de-identified genetic data from sample processing through any third-party commercialization channel. Policy review should assess whether the voluntary participation framing is operationally implemented in a manner that allows meaningful opt-out without degrading the core testing service.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Your genetic data, even when de-identified, is among the most sensitive personal information that exists and can potentially be re-identified. The terms authorize use of that data for commercial purposes with third parties, which is a significant permission that users should consciously evaluate before agreeing.
Under these terms, your de-identified genetic information may be used in commercial activities with outside companies as part of 23andMe's product development program. Because this participation is described as voluntary and consent-based, reviewing and understanding your research consent options before submitting a sample is the most important action you can take.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by 23andMe.