Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement discloses that laboratory partners that process AncestryDNA samples are independently required under CLIA regulations to retain DNA Data and test results for at least seven years, and that this retention continues even if the user requests deletion from Ancestry.
This analysis describes what Ancestry's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that a user's deletion request directed to Ancestry does not terminate the retention of DNA Data at the laboratory partner level, as CLIA and CAP regulatory obligations require laboratory partners to maintain records independently of Ancestry's user-facing deletion mechanisms.
The updated Privacy Statement no longer displays a dedicated 'Do Not Sell or Share My Personal Information' link in the footer, which was previously accessible to California residents under CCPA requirements. This link allowed users to exercise data-sharing opt-out rights. The footer now lists 'Consumer Health Privacy' as a separate item but does not explicitly direct users to their CCPA controls. California residents may need to locate their opt-out rights through alternative navigation paths on the Ancestry site.
View change record →The updated privacy policy removes the 'Do Not Sell or Share My Personal Information' link from the footer navigation. This link previously provided direct access to Ancestry's data-sharing opt-out mechanism, which is a required disclosure under California's CCPA. While the removal does not eliminate the opt-out right itself, it may make the opt-out control less easily discoverable from the privacy policy page. Affected users may need to locate the opt-out mechanism through alternate navigation or search methods.
View change record →The updated Privacy Statement clarifies what uses of Ancestry services are permitted and prohibited, establishes that photo face-grouping in your gallery requires your express consent, and introduces SMS messaging as a communication channel for future opt-in communications. The statement now covers Ancestry, AncestryDNA, and Related Brands under a unified framework while noting that other services operated by the company use separate privacy statements. The removal of 'uploaded DNA data' from the account creation section reflects a narrowing of that specific provision's scope, though genetic information processing remains described elsewhere in the policy. You can review the full updated statement to understand how your personal information will be processed and manage your communication preferences when SMS opt-ins become available.
View change record →Under this clause, users who request deletion of their DNA Data from Ancestry should be aware that laboratory partners retain DNA Data and test results for at least seven years under CLIA regulations, and this retention is outside Ancestry's direct control and cannot be resolved through Ancestry's standard deletion tools.
Cross-platform context
See how other platforms handle Laboratory Partner Independent Data Retention Post-Deletion and similar clauses.
Compare across platforms →Monitoring
Ancestry has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"If you were a customer of AncestryHealth, our AncestryHealth laboratory partners are required to retain your DNA Data and test result for a period of at least seven years, or as required by state law and the Clinical Laboratory Improvements Act (CLIA) and the guidelines that apply to laboratories certified by the College of American Pathologists (CAP). Our laboratory partners may also retain information they receive from us to comply with laws or regulations requiring retention of certain data, such as the Clinical Laboratory Improvements Amendments regulations administered by the U.S. Food and Drug Administration.Excerpt from Ancestry's Privacy Statement
REGULATORY LANDSCAPE: This provision engages the Clinical Laboratory Improvements Amendments (CLIA, 42 U.S.C. 263a) and College of American Pathologists (CAP) accreditation standards, administered by the FDA and CMS. It also implicates GDPR Article 17(3)(b), which permits retention where processing is necessary for compliance with a legal obligation, and analogous state data retention laws. For AncestryHealth customers specifically, state laboratory record retention laws may impose additional minimum retention periods. GOVERNANCE EXPOSURE: Medium. The independent laboratory retention obligation is a disclosed limitation on the completeness of Ancestry's user-facing deletion right. Regulatory frameworks that provide a right to deletion must accommodate this statutory carve-out, but users may not be aware that their deletion request does not affect laboratory partner records. JURISDICTION FLAGS: The seven-year minimum retention period applies to AncestryHealth customers specifically, and state laboratory laws may impose longer retention periods. EU and UK users exercising GDPR Article 17 deletion rights should be informed of this limitation at the point of deletion request. California users should be informed under CCPA deletion right disclosure requirements. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams engaging Ancestry as a vendor should assess whether laboratory partner retention obligations create a data management gap in their compliance frameworks. Agreements with Ancestry should address how laboratory partner retention is disclosed to end users and whether Ancestry assumes any obligation to facilitate laboratory-level deletion requests. COMPLIANCE CONSIDERATIONS: Legal teams should verify that deletion confirmation communications to users clearly disclose the laboratory partner retention limitation. GDPR data subject response templates should include this carve-out. For AncestryHealth customers specifically, state-by-state review of laboratory record retention laws should be conducted to confirm the seven-year minimum is accurate and complete.
This provision establishes that a user's deletion request directed to Ancestry does not terminate the retention of DNA Data at the laboratory partner level, as CLIA and CAP regulatory obligations require laboratory partners to maintain records independently of Ancestry's user-facing deletion mechanisms.
Under this clause, users who request deletion of their DNA Data from Ancestry should be aware that laboratory partners retain DNA Data and test results for at least seven years under CLIA regulations, and this retention is outside Ancestry's direct control and cannot be resolved through Ancestry's standard deletion tools.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Ancestry.