Ancestry Privacy Statement

This document is Ancestry's global Privacy Statement, governing the collection, use, sharing, and retention of personal data across Ancestry's family history, DNA testing, and related services, with its legal basis varying by jurisdiction (consent, legitimate interests, and contractual necessity under GDPR; various state law bases in the US). The policy states that Ancestry collects a broad range of data types including name, contact details, family tree information, payment data, communications, device and usage data, and — most significantly — genetic data from DNA testing kits, and the terms authorize sharing of this information with service providers, business partners, affiliated companies, and in connection with corporate transactions such as mergers or acquisitions. The treatment of genetic and health-related data is operationally distinct: the policy asserts that DNA data is used for genealogy matching, product improvement, and — with separate explicit consent — research purposes, but users who have submitted DNA samples retain a meaningful deletion right, though the policy states that deletion of raw DNA data does not affect results already incorporated into aggregate research datasets. The policy engages GDPR and UK GDPR for EU and UK residents respectively, CCPA and CPRA for California residents, and references compliance with various US state biometric and genetic privacy laws; the handling of genetic data intersects with sector-specific frameworks including the Genetic Information Nondiscrimination Act (GINA) and state-level genetic privacy statutes. Compliance teams should note that the policy's description of data sharing with research partners under a separate consent model, combined with the carve-out preserving aggregate research contributions after individual deletion, warrants careful evaluation under GDPR data minimization and purpose limitation principles and applicable US genetic privacy regimes.