Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The terms define Product Development as research and development activities using de-identified genetic information, which may include commercialization with third parties. The document states participation is voluntary and governed by a separate IRB-approved consent document.
This analysis describes what 23andMe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes 23andMe to use de-identified genetic information derived from user samples for activities that may include commercial arrangements with third parties. The boundary between the base Terms consent and the separate IRB-approved research consent document requires careful evaluation, particularly given that genetic data presents re-identification risks that may affect the adequacy of de-identification under applicable law.
Interpretive note: The adequacy of de-identification under applicable legal standards and the precise scope of the IRB-approved consent document governing research participation are not fully determinable from the provided document text alone.
Under this clause, 23andMe may use de-identified versions of users' genetic information for Product Development activities, which the agreement states may include commercialization with third parties. Participation is described as voluntary and subject to a separate IRB-approved consent process, which users would need to review to understand the specific scope and withdrawal options.
Cross-platform context
See how other platforms handle Product Development and Third-Party Commercialization of De-Identified Genetic Data and similar clauses.
Compare across platforms →Monitoring
23andMe has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"When we use the term "Product Development," it means research performed for the purpose of new product development and new product development activities performed by 23andMe on De-identified Information. These activities may include, among other things, improving our Services and/or offering new products or services to you; performing quality control activities; or conducting data analysis that may lead to and/or include commercialization with a third party. Participation in such research is voluntary and based upon an Institutional Review Board-approved consent document.Excerpt from 23andMe's Terms of Service
(1) REGULATORY LANDSCAPE: This provision engages CCPA and California's Genetic Information Privacy Act given 23andMe's California operations and the use of genetic data. GINA and state genetic privacy statutes in multiple jurisdictions impose restrictions on the use and disclosure of genetic information. HIPAA may apply depending on 23andMe's operational classification. The FTC has enforcement authority over representations about de-identification and data sharing practices under the FTC Act. The NIH Common Rule and OHRP govern IRB-approved research involving human subjects. (2) GOVERNANCE EXPOSURE: High. The commercialization authorization involving de-identified genetic data creates significant exposure given the sensitivity of genetic information and the well-documented re-identification risks associated with genetic datasets. The adequacy of de-identification under applicable legal standards, including CCPA and HIPAA safe harbor or expert determination methods, requires independent verification. The distinction between base Terms consent and IRB research consent creates a layered consent architecture that must be carefully mapped. (3) JURISDICTION FLAGS: California's Genetic Information Privacy Act imposes specific consent requirements for the collection and use of genetic data beyond CCPA's general framework. Illinois, New York, and other states with genetic privacy statutes create heightened exposure. EU and UK users are directed to separate regional terms, but the de-identification and commercialization framework should be assessed against GDPR recital and Article provisions governing special category data if any EU-linked data is involved. (4) CONTRACT AND VENDOR IMPLICATIONS: Third-party commercial partners receiving de-identified genetic data should be assessed for data processing agreement requirements, re-identification restrictions, and downstream use limitations. Procurement teams should evaluate whether data sharing with commercialization partners triggers vendor assessment obligations under CCPA, GDPR, or applicable state genetic privacy law. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should obtain and review the referenced IRB-approved consent document to assess whether its scope, withdrawal procedures, and disclosures satisfy applicable legal requirements. Data mapping should document the de-identification methodology applied and the categories of third parties with whom data may be shared under the Product Development authorization. Any changes to commercialization partners or data use scope may trigger consent refresh or regulatory notification obligations.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision authorizes 23andMe to use de-identified genetic information derived from user samples for activities that may include commercial arrangements with third parties. The boundary between the base Terms consent and the separate IRB-approved research consent document requires careful evaluation, particularly given that genetic data presents re-identification risks that may affect the adequacy of de-identification under applicable law.
Under this clause, 23andMe may use de-identified versions of users' genetic information for Product Development activities, which the agreement states may include commercialization with third parties. Participation is described as voluntary and subject to a separate IRB-approved consent process, which users would need to review to understand the specific scope and withdrawal options.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by 23andMe.