Ancestry collects your saliva and DNA data when you use a DNA kit, uses it to generate ancestry results, and may use or share it for research purposes if you separately consent to that.
This analysis describes what Ancestry's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Genetic data is among the most sensitive personal information that exists — it reveals information about your health, ancestry, and biological relatives. Understanding how it is used and shared is critical before submitting a sample.
Interpretive note: The precise scope of research partner sharing and the legal basis for retaining saliva samples varies by jurisdiction and may be subject to additional constraints under state genetic privacy laws not fully detailed in the policy.
The updated Privacy Statement no longer displays a dedicated 'Do Not Sell or Share My Personal Information' link in the footer, which was previously accessible to California residents under CCPA requirements. This link allowed users to exercise data-sharing opt-out rights. The footer now lists 'Consumer Health Privacy' as a separate item but does not explicitly direct users to their CCPA controls. California residents may need to locate their opt-out rights through alternative navigation paths on the Ancestry site.
View change record →The updated Privacy Statement clarifies what uses of Ancestry services are permitted and prohibited, establishes that photo face-grouping in your gallery requires your express consent, and introduces SMS messaging as a communication channel for future opt-in communications. The statement now covers Ancestry, AncestryDNA, and Related Brands under a unified framework while noting that other services operated by the company use separate privacy statements. The removal of 'uploaded DNA data' from the account creation section reflects a narrowing of that specific provision's scope, though genetic information processing remains described elsewhere in the policy. You can review the full updated statement to understand how your personal information will be processed and manage your communication preferences when SMS opt-ins become available.
View change record →California residents lose direct navigation to the CCPA-mandated 'Do Not Sell or Share My Personal Information' disclosure page from Ancestry's privacy footer. While California law requires the company to honor data sale opt-out requests, removing the link reduces visibility and accessibility of this right. California residents can locate this right by searching Ancestry's website or contacting the company directly, but the removal creates an additional barrier to exercising a legally protected option.
View change record →If you submit a DNA kit, Ancestry retains your saliva sample until you request its destruction and may use your genetic data for research if you have opted in to that separately. You can request destruction of your saliva sample and withdrawal of research consent at any time through account settings.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If we collect health information from these integrations (such as heart rate), we will not sell or use it for advertising or other similar purposes; we do not disclose it to third parties without your prior consent; and we will only use it for the specific purposes described in this Policy.
We collect your personal data when you use our Services, create a new eBay account, provide us with information via a web form, add or update information in your eBay account, participate in online community discussions or otherwise interact with us.
Monitoring
Ancestry has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"When you purchase and activate a DNA kit, we collect a saliva sample from you. We use this sample to provide you with AncestryDNA results and to improve our products and services. We also store the saliva sample after the test is completed. You can request we destroy your saliva sample at any time. If you choose to participate in research, your DNA data may be used by us or shared with third-party research partners to conduct research.— Excerpt from Ancestry's Ancestry Privacy Statement
(1) REGULATORY LANDSCAPE: Genetic data constitutes a special category of personal data under GDPR Article 9, requiring explicit consent as the legal basis for processing. In the US, genetic data is regulated by an expanding set of state laws including Illinois GIPA, Texas CUBI, and others; federal GINA governs certain uses of genetic information. The FTC has oversight of consumer data practices under Section 5 of the FTC Act. State Attorneys General in states with genetic privacy laws are primary enforcement authorities. (2) GOVERNANCE EXPOSURE: High. The collection and retention of physical biological samples (saliva) combined with derived genetic data represents one of the highest-sensitivity data processing activities in consumer-facing services. The policy asserts a broad storage period for saliva samples and derived data, with deletion contingent on user request rather than automatic, which may create exposure under data minimization principles. (3) JURISDICTION FLAGS: EU/EEA users have the strongest protections under GDPR Article 9 explicit consent requirements. Illinois and Texas residents benefit from state genetic privacy statutes that impose additional obligations. California residents have CPRA-specific rights regarding sensitive personal information including genetic data. UK users are covered by UK GDPR with equivalent special category protections. (4) CONTRACT AND VENDOR IMPLICATIONS: Research partnerships involving genetic data sharing require data processing agreements under GDPR Article 28 and equivalent state law instruments. Procurement teams should ensure research partner agreements include appropriate confidentiality, data security, and purpose limitation provisions. The policy's reference to confidentiality agreements with research partners should be audited for adequacy. (5) COMPLIANCE CONSIDERATIONS: Legal teams should confirm that the consent mechanism for research participation is genuinely separate from the core DNA testing consent, freely given, and withdrawable without detriment. Data retention schedules for saliva samples and derived genetic data should be mapped and reviewed against applicable minimization requirements. Any cross-border transfer of genetic data to research partners must comply with GDPR Chapter V transfer mechanisms.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Genetic data is among the most sensitive personal information that exists — it reveals information about your health, ancestry, and biological relatives. Understanding how it is used and shared is critical before submitting a sample.
If you submit a DNA kit, Ancestry retains your saliva sample until you request its destruction and may use your genetic data for research if you have opted in to that separately. You can request destruction of your saliva sample and withdrawal of research consent at any time through account settings.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Ancestry.