Ancestry collects your saliva and DNA data when you use a DNA kit, uses it to generate ancestry results, and may use or share it for research purposes if you separately consent to that.
This analysis describes what Ancestry's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Genetic data is among the most sensitive personal information that exists — it reveals information about your health, ancestry, and biological relatives. Understanding how it is used and shared is critical before submitting a sample.
Interpretive note: The precise scope of research partner sharing and the legal basis for retaining saliva samples varies by jurisdiction and may be subject to additional constraints under state genetic privacy laws not fully detailed in the policy.
California residents lose direct navigation to the CCPA-mandated 'Do Not Sell or Share My Personal Information' disclosure page from Ancestry's privacy footer. While California law requires the compa…
If you submit a DNA kit, Ancestry retains your saliva sample until you request its destruction and may use your genetic data for research if you have opted in to that separately. You can request destruction of your saliva sample and withdrawal of research consent at any time through account settings.
How other platforms handle this
We may access, preserve, and share information with regulators, law enforcement, or others if we believe it is reasonably necessary to: detect, prevent, and address fraud and other illegal activity; protect ourselves, you, and others, including as part of investigations; and prevent death or imminen...
Customer authorized Mistral AI to transfer Personal Data to any country deemed to have an adequate level of data protection by the European Commission. Customer also authorizes Mistral AI to perform International Data Transfers to (a) on the basis of adequate safeguards in accordance with Applicable...
Personal data collected by Unity may be transferred to and processed in countries outside of the European Economic Area, including the United States, where data protection laws may differ from those in your country. Where we transfer personal data from the EEA or the UK, we rely on appropriate safeg...
Monitoring
Ancestry has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"When you purchase and activate a DNA kit, we collect a saliva sample from you. We use this sample to provide you with AncestryDNA results and to improve our products and services. We also store the saliva sample after the test is completed. You can request we destroy your saliva sample at any time. If you choose to participate in research, your DNA data may be used by us or shared with third-party research partners to conduct research.— Excerpt from Ancestry's Ancestry Privacy Statement
(1) REGULATORY LANDSCAPE: Genetic data constitutes a special category of personal data under GDPR Article 9, requiring explicit consent as the legal basis for processing. In the US, genetic data is regulated by an expanding set of state laws including Illinois GIPA, Texas CUBI, and others; federal GINA governs certain uses of genetic information. The FTC has oversight of consumer data practices under Section 5 of the FTC Act. State Attorneys General in states with genetic privacy laws are primary enforcement authorities. (2) GOVERNANCE EXPOSURE: High. The collection and retention of physical biological samples (saliva) combined with derived genetic data represents one of the highest-sensitivity data processing activities in consumer-facing services. The policy asserts a broad storage period for saliva samples and derived data, with deletion contingent on user request rather than automatic, which may create exposure under data minimization principles. (3) JURISDICTION FLAGS: EU/EEA users have the strongest protections under GDPR Article 9 explicit consent requirements. Illinois and Texas residents benefit from state genetic privacy statutes that impose additional obligations. California residents have CPRA-specific rights regarding sensitive personal information including genetic data. UK users are covered by UK GDPR with equivalent special category protections. (4) CONTRACT AND VENDOR IMPLICATIONS: Research partnerships involving genetic data sharing require data processing agreements under GDPR Article 28 and equivalent state law instruments. Procurement teams should ensure research partner agreements include appropriate confidentiality, data security, and purpose limitation provisions. The policy's reference to confidentiality agreements with research partners should be audited for adequacy. (5) COMPLIANCE CONSIDERATIONS: Legal teams should confirm that the consent mechanism for research participation is genuinely separate from the core DNA testing consent, freely given, and withdrawable without detriment. Data retention schedules for saliva samples and derived genetic data should be mapped and reviewed against applicable minimization requirements. Any cross-border transfer of genetic data to research partners must comply with GDPR Chapter V transfer mechanisms.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Genetic data is among the most sensitive personal information that exists — it reveals information about your health, ancestry, and biological relatives. Understanding how it is used and shared is critical before submitting a sample.
If you submit a DNA kit, Ancestry retains your saliva sample until you request its destruction and may use your genetic data for research if you have opted in to that separately. You can request destruction of your saliva sample and withdrawal of research consent at any time through account settings.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Ancestry.