Provision record
23andMe · 23andMe Terms of Service · View original document ↗

Product Development and Third-Party Commercialization of De-Identified Genetic Data

High severity Medium confidence Explicit document language Unique · 0 of 352 platforms
Stay ahead of the changes
Track 23andMe and get the diff the day its terms change.
Share 𝕏 Share in Share 🔒 PDF
Document Record

What it is

The terms define Product Development as research and development activities using de-identified genetic information, which may include commercialization with third parties. The document states participation is voluntary and governed by a separate IRB-approved consent document.

This analysis describes what 23andMe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology

ConductAtlas Analysis

Why it matters (compliance & governance perspective)

This provision authorizes 23andMe to use de-identified genetic information derived from user samples for activities that may include commercial arrangements with third parties. The boundary between the base Terms consent and the separate IRB-approved research consent document requires careful evaluation, particularly given that genetic data presents re-identification risks that may affect the adequacy of de-identification under applicable law.

Interpretive note: The adequacy of de-identification under applicable legal standards and the precise scope of the IRB-approved consent document governing research participation are not fully determinable from the provided document text alone.

Clause Stability Stable

0
Changes
5
Months Monitored
Jul 9, 2026
First Seen
Jul 9, 2026
Last Seen

Consumer impact (what this means for users)

Under this clause, 23andMe may use de-identified versions of users' genetic information for Product Development activities, which the agreement states may include commercialization with third parties. Participation is described as voluntary and subject to a separate IRB-approved consent process, which users would need to review to understand the specific scope and withdrawal options.

What you can do

⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.
  • Delete Your Data
    Log in to your 23andMe account, navigate to Account Settings, and review options to withdraw research consent or delete your account and associated data as described in the Privacy Statement.

Cross-platform context

See how other platforms handle Product Development and Third-Party Commercialization of De-Identified Genetic Data and similar clauses.

Compare across platforms →
▸ View Original Clause Language DOCUMENT RECORD
"
When we use the term "Product Development," it means research performed for the purpose of new product development and new product development activities performed by 23andMe on De-identified Information. These activities may include, among other things, improving our Services and/or offering new products or services to you; performing quality control activities; or conducting data analysis that may lead to and/or include commercialization with a third party. Participation in such research is voluntary and based upon an Institutional Review Board-approved consent document.

Excerpt from 23andMe's Terms of Service

ConductAtlas Analysis

Institutional analysis (regulatory & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages CCPA and California's Genetic Information Privacy Act given 23andMe's California operations and the use of genetic data.

Insight

Unlock the full institutional analysis

Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.

Applicable agencies

  • Federal Trade Commission (ftc)
    Oversees unfair or deceptive business practices and can investigate companies that mislead consumers about data collection, sharing, or use.
    Who can file: Anyone affected by the company's practices (US or international)
    What you need: Your account details, a timeline of relevant events, and a description of the specific issue
    What to expect: Complaints inform FTC enforcement priorities and investigations but do not result in individual resolution or compensation
    File a complaint →
  • Department Of Health & Human Services, Office For Civil Rights (hhs Ocr)
    Enforces HIPAA Privacy and Security Rules, which protect health information held by healthcare providers, health plans, and their business associates.
    Who can file: Anyone whose HIPAA rights may have been violated by a covered entity (healthcare provider, health plan, or healthcare clearinghouse)
    What you need: Name of the entity, description of the violation, date of the incident, and your contact information. Must file within 180 days of the violation.
    What to expect: HHS OCR investigates and may require the entity to take corrective action. Does not provide individual compensation. Serious violations can result in civil monetary penalties.
    File a complaint →

Provision details

Document information
Document
23andMe Terms of Service
Entity
23andMe
Document last updated
May 5, 2026
Tracking information
First tracked
May 11, 2026
Last verified
July 9, 2026
Record ID
CA-P-016447
Document ID
CA-D-00147
Evidence Provenance
Source URL
Wayback Machine
Content hash (SHA-256)
bddb92bc01773d87e5f6157d525fe0a08abb0e48becacc33725f316880d9f25e
Analysis generated
May 11, 2026 23:34 UTC
Methodology
Evidence
✓ Snapshot stored   ✓ Hash verified
Citation Record
Entity: 23andMe
Document: 23andMe Terms of Service
Record ID: CA-P-016447
Captured: 2026-05-11 23:34:45 UTC
SHA-256: bddb92bc01773d87…
URL: https://conductatlas.com/platform/23andme/23andme-terms-of-service/provision/CA-P-016447/product-development-and-third-party-commercialization-of-de-identified-genetic-data/
Accessed: Sept. 8, 2026
Permanent archival reference. Stable identifier suitable for legal filings, compliance documentation, and research citation.
Classification
Severity
High
Categories

Other risks in this policy

Get the research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.

Frequently Asked Questions

What does 23andMe's Product Development and Third-Party Commercialization of De-Identified Genetic Data clause do?

This provision authorizes 23andMe to use de-identified genetic information derived from user samples for activities that may include commercial arrangements with third parties. The boundary between the base Terms consent and the separate IRB-approved research consent document requires careful evaluation, particularly given that genetic data presents re-identification risks that may affect the adequacy of de-identification under applicable law.

How does this clause affect you?

Under this clause, 23andMe may use de-identified versions of users' genetic information for Product Development activities, which the agreement states may include commercialization with third parties. Participation is described as voluntary and subject to a separate IRB-approved consent process, which users would need to review to understand the specific scope and withdrawal options.

Is ConductAtlas affiliated with 23andMe?

No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by 23andMe.