Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement states that de-identified Genetic Information and phenotypic information may be shared with commercial or non-profit research partners, including those with a financial interest in the research, upon the user's separate express informed consent, and that once included in active or completed research, this data cannot be withdrawn even if the user later revokes consent.
This analysis describes what Ancestry's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes disclosure of genetic and phenotypic data to commercial entities developing therapeutics, medical devices, and diagnostic products, with an explicit disclosure that financial interests may exist in the research arrangement, which creates material considerations for research ethics compliance, conflict of interest disclosure, and the scope of GDPR Article 89 research exemptions.
The updated Privacy Statement no longer displays a dedicated 'Do Not Sell or Share My Personal Information' link in the footer, which was previously accessible to California residents under CCPA requirements. This link allowed users to exercise data-sharing opt-out rights. The footer now lists 'Consumer Health Privacy' as a separate item but does not explicitly direct users to their CCPA controls. California residents may need to locate their opt-out rights through alternative navigation paths on the Ancestry site.
View change record →The updated privacy policy removes the 'Do Not Sell or Share My Personal Information' link from the footer navigation. This link previously provided direct access to Ancestry's data-sharing opt-out mechanism, which is a required disclosure under California's CCPA. While the removal does not eliminate the opt-out right itself, it may make the opt-out control less easily discoverable from the privacy policy page. Affected users may need to locate the opt-out mechanism through alternate navigation or search methods.
View change record →The updated Privacy Statement clarifies what uses of Ancestry services are permitted and prohibited, establishes that photo face-grouping in your gallery requires your express consent, and introduces SMS messaging as a communication channel for future opt-in communications. The statement now covers Ancestry, AncestryDNA, and Related Brands under a unified framework while noting that other services operated by the company use separate privacy statements. The removal of 'uploaded DNA data' from the account creation section reflects a narrowing of that specific provision's scope, though genetic information processing remains described elsewhere in the policy. You can review the full updated statement to understand how your personal information will be processed and manage your communication preferences when SMS opt-ins become available.
View change record →Under this clause, users who consent to the Informed Consent to Research agree that their de-identified Genetic Information may be shared with commercial partners, including those with financial stakes in the research, and that once shared, the data cannot be removed from active or completed research projects even if the user later requests deletion.
Cross-platform context
See how other platforms handle Genetic Information Research Sharing with Financially Interested Partners and similar clauses.
Compare across platforms →Monitoring
Ancestry has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We share de-identified Genetic Information with research partners only when you provide us with your express consent to do so through our Informed Consent to Research. Unless you agree to the Informed Consent to Research, your data will not be included in the data shared with these researchers. Any such de-identified genetic information and phenotypic information we share with third parties for research purposes is done in accordance with Part 46 (beginning with Section 46.101) of Title 45 of the Code of Federal Regulations. Research partners include commercial or non-profit organizations that conduct or support scientific research, the development of therapeutics, medical devices or related material to treat, diagnose or predict health conditions. In some circumstances, a research partner or Ancestry may have a financial interest in the research arrangement.Excerpt from Ancestry's Privacy Statement
REGULATORY LANDSCAPE: This provision implicates GDPR Article 9(2)(j) (research processing of special category data) and Article 89 (safeguards for research purposes), enforced by the Irish Data Protection Commission. It also engages the Common Rule (45 CFR Part 46) as explicitly cited in the document, enforced by the U.S. Department of Health and Human Services. The FTC has jurisdiction over material disclosures related to research data sharing. State AG offices in California, Washington, and other states with genetic privacy statutes may also have authority. GOVERNANCE EXPOSURE: High. The explicit disclosure that research partners or Ancestry may have a financial interest in the research arrangement creates conflict of interest considerations that may require evaluation under Common Rule informed consent requirements and GDPR transparency obligations. The irrevocability of data removal from completed or active research once consent is given is a material limitation on the right to withdraw consent. JURISDICTION FLAGS: EU and UK users face heightened exposure under GDPR Article 9 and Article 89 requirements for research processing of genetic data, including requirements for appropriate safeguards and pseudonymization. California users have CCPA rights but research exemptions may apply. Washington's My Health MY Data Act may impose additional consent and disclosure requirements for health-related genetic data used in commercial research. CONTRACT AND VENDOR IMPLICATIONS: Commercial research partners receiving de-identified Genetic Information under this arrangement should assess whether their data use agreements with Ancestry adequately address Common Rule compliance, GDPR controller/processor responsibilities, and the financial interest disclosure obligations that Ancestry has made in this Privacy Statement. The list of research partners referenced in the document should be reviewed in vendor due diligence. COMPLIANCE CONSIDERATIONS: Legal teams should audit the Informed Consent to Research document to confirm it satisfies Common Rule requirements for disclosure of financial interests and voluntary participation. The irrevocability of data removal from completed research should be clearly communicated at the point of consent. GDPR teams should assess whether the research sharing arrangement satisfies Article 89 safeguards including pseudonymization and data minimization requirements.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision authorizes disclosure of genetic and phenotypic data to commercial entities developing therapeutics, medical devices, and diagnostic products, with an explicit disclosure that financial interests may exist in the research arrangement, which creates material considerations for research ethics compliance, conflict of interest disclosure, and the scope of GDPR Article 89 research exemptions.
Under this clause, users who consent to the Informed Consent to Research agree that their de-identified Genetic Information may be shared with commercial partners, including those with financial stakes in the research, and that once shared, the data cannot be removed from active or completed research projects even if the user later requests deletion.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Ancestry.