Track 1 platform and get the weekly governance digest. No credit card required.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This is Ancestry's Privacy Statement, covering how the company collects and uses personal data across its genealogy research platform, DNA testing service (AncestryDNA), and associated apps and websites. Ancestry states it collects genetic data, family tree content, contact and payment information, device identifiers, browsing activity, and location-related data, and authorizes sharing this information with service providers, advertising and analytics partners, and research institutions, with DNA data subject to separate consent for research participation. California residents and EU/UK users are provided specific rights including the ability to request deletion of personal data, opt out of the sale or sharing of personal information, and in the case of DNA data, separately withdraw consent for research use through the AncestryDNA settings.
This document is Ancestry's Privacy Statement governing the collection, use, sharing, and retention of personal information across Ancestry's genealogy, DNA testing, and related digital services, with stated legal bases including consent, contractual necessity, and legitimate interests depending on jurisdiction. The agreement states that Ancestry collects a broad range of data including name, contact information, payment details, family tree content, communications, device identifiers, browsing and clickstream activity, IP addresses, and genetic data submitted through AncestryDNA, and authorizes use of this data for product delivery, personalization, advertising, research, and sharing with third-party service providers, business partners, and affiliated companies. The collection and processing of genetic and health-related data represents an operationally distinct element of this policy relative to standard consumer digital services, as the agreement asserts rights to store, analyze, and share DNA data with research partners, subject to separate consent mechanisms described in the AncestryDNA Terms and Conditions; the agreement's asserted authority over such sensitive biological data may interact with state-level genetic privacy statutes and federal frameworks in ways that applicable law may constrain. The policy engages GDPR for EU and UK users, CCPA and California Genetic Information Privacy Act for California residents, and general FTC Act consumer protection principles applicable to US users; jurisdiction-specific rights including access, deletion, portability, correction, and opt-out of sale or sharing of personal information are disclosed with region-specific mechanisms, though the practical enforceability of certain cross-border data transfer provisions and research consent terms depends on evolving regulatory guidance.
Institutional analysis available with Compliance
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.
Start Compliance free trial4 important changes detected
6 versions captured · Last updated: June 2026
Ancestry updated the navigation menu and footer layout of its Privacy Statement on May 6, 2026. The changes reorganized how certain links are presented—moving 'About Us' into the footer, reordering …
View change record →Ancestry removed a reference to 'Do Not Sell or Share My Personal Information' from the footer links in their privacy statement as of May 1, 2026. This link previously connected …
View change record →This expands data sharing scope to explicitly include advertising and analytics partners and allows third-party ad companies direct collection of activity data, significantly broadening monetization of user information.
Newly detailed provision explicitly documenting automatic collection of tracking data across multiple categories that could enable comprehensive user profiling beyond genetic ancestry services.
New provision with vague 'legitimate business purposes' language allows indefinite retention post-deletion, weakening user control over personal data.
Explicit acknowledgment of research data persistence was removed, potentially obscuring the permanent incorporation of user data into research despite deletion requests.
Removal of explicit confidentiality requirements for research partners and the reassurance that DNA data is not sold to third parties diminishes user protections and transparency around research sharing.
Removal of COPPA compliance provisions and deletion procedures for children's data weakens legal protections for minors.
Removal of explicit GDPR/UK GDPR rights provisions eliminates detailed disclosure of European privacy protections and data controller identification.
This detailed provision specifying service provider obligations and limitation of use was replaced with vaguer language in the advertising/analytics section, reducing contractual clarity around data protection.
Removed specific mention of saliva sample collection and destruction rights; expanded to include health conditions and physical traits; shifted from 'choose to participate' to 'opted in to our research program'.
Removed notification requirement, opportunity to opt out, and disclosure of changes to privacy policy; significantly weakened user protections in corporate transactions.
Generalized California-specific CCPA/CPRA rights into jurisdiction-dependent language; removed explicit mention of the right to know what is collected/disclosed, right to limit sensitive data use, and removal of specific toll-free number contact method.
Monitoring
Ancestry has updated this document before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
Compliance Governance Intelligence
Need provision-level monitoring and regulatory mapping?
Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.
Start Compliance free trialCross-platform context
See how other platforms handle Aggregate Research Data Persistence After Deletion and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.