Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement states that with user consent, Ancestry creates abstract numerical representations of facial images to group similar faces in the photo gallery, and that these representations are not retained or stored by Ancestry, while acknowledging they may constitute biometric information under certain jurisdictions' laws.
This analysis describes what Ancestry's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision describes a facial processing feature that Ancestry itself acknowledges may constitute biometric information in certain jurisdictions, engaging Illinois BIPA, Texas CUBI, Washington's biometric privacy framework, and potentially New York City's biometric privacy ordinance, each of which imposes distinct notice, consent, retention, and destruction requirements that may apply regardless of Ancestry's assertion that representations are not retained.
Interpretive note: Whether creating and transiently processing a numerical facial representation without retention triggers obligations under BIPA and analogous statutes depends on jurisdictional interpretation of what constitutes 'collection' of biometric information, which has not been uniformly resolved across jurisdictions.
The updated Privacy Statement no longer displays a dedicated 'Do Not Sell or Share My Personal Information' link in the footer, which was previously accessible to California residents under CCPA requirements. This link allowed users to exercise data-sharing opt-out rights. The footer now lists 'Consumer Health Privacy' as a separate item but does not explicitly direct users to their CCPA controls. California residents may need to locate their opt-out rights through alternative navigation paths on the Ancestry site.
View change record →The updated privacy policy removes the 'Do Not Sell or Share My Personal Information' link from the footer navigation. This link previously provided direct access to Ancestry's data-sharing opt-out mechanism, which is a required disclosure under California's CCPA. While the removal does not eliminate the opt-out right itself, it may make the opt-out control less easily discoverable from the privacy policy page. Affected users may need to locate the opt-out mechanism through alternate navigation or search methods.
View change record →The updated Privacy Statement clarifies what uses of Ancestry services are permitted and prohibited, establishes that photo face-grouping in your gallery requires your express consent, and introduces SMS messaging as a communication channel for future opt-in communications. The statement now covers Ancestry, AncestryDNA, and Related Brands under a unified framework while noting that other services operated by the company use separate privacy statements. The removal of 'uploaded DNA data' from the account creation section reflects a narrowing of that specific provision's scope, though genetic information processing remains described elsewhere in the policy. You can review the full updated statement to understand how your personal information will be processed and manage your communication preferences when SMS opt-ins become available.
View change record →Under this clause, activation of the face grouping feature requires express consent, and the agreement states that the resulting numerical representations are not stored; however, users in Illinois, Texas, Washington, and other jurisdictions with biometric privacy laws should evaluate whether applicable statutes impose additional requirements beyond the consent described in this document.
Cross-platform context
See how other platforms handle Face Grouping Biometric Representation Feature and similar clauses.
Compare across platforms →Monitoring
Ancestry has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Classifying, creating image models of, and indexing Your Content (which may include Personal Information) to organize your media, keep our platform safe, and identify your ancestors, places of interest, and other memories; With your consent, to help you organize your photos, we may create an abstract numerical representation of images to group similar faces within your gallery. Ancestry does not retain or store these representations, which may constitute biometric information in certain jurisdictions.Excerpt from Ancestry's Privacy Statement
REGULATORY LANDSCAPE: This provision directly engages Illinois BIPA (740 ILCS 14), Texas CUBI (Texas Business and Commerce Code Chapter 503), and Washington's HB 1493, each of which imposes specific requirements for the collection, use, retention, and destruction of biometric identifiers and information. BIPA in particular provides a private right of action with statutory damages. The FTC has also issued guidance on biometric data practices under its unfair and deceptive practices authority. GOVERNANCE EXPOSURE: High. Ancestry's own disclosure that these representations 'may constitute biometric information in certain jurisdictions' acknowledges legal uncertainty. BIPA's definition of biometric identifiers includes facial geometry, and the creation of a numerical representation from a facial image may trigger BIPA obligations even if the representation is not retained. BIPA litigation has addressed similar processing scenarios. JURISDICTION FLAGS: Illinois presents the highest exposure given BIPA's private right of action and statutory damages of $1,000-$5,000 per violation. Texas and Washington impose state AG enforcement. Users in these states who opt into the face grouping feature are the primary affected population. New York City's biometric identifier law may also be relevant for users in that jurisdiction. CONTRACT AND VENDOR IMPLICATIONS: Vendors or partners processing image data on Ancestry's behalf for this feature must be assessed for BIPA and CUBI compliance. Service agreements should address the specific processing pipeline for facial representations, including whether any intermediate retention occurs at a vendor level even if Ancestry does not store the final representation. COMPLIANCE CONSIDERATIONS: Legal teams should conduct a BIPA-specific compliance review of the facial processing pipeline, including the consent mechanism, the processing workflow, and the vendor chain. The consent obtained under this Privacy Statement should be evaluated against BIPA's written release requirements. Compliance teams in Texas and Washington should assess whether state-specific notice requirements are satisfied by the current policy disclosure.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision describes a facial processing feature that Ancestry itself acknowledges may constitute biometric information in certain jurisdictions, engaging Illinois BIPA, Texas CUBI, Washington's biometric privacy framework, and potentially New York City's biometric privacy ordinance, each of which imposes distinct notice, consent, retention, and destruction requirements that may apply regardless of Ancestry's assertion that representations are not retained.
Under this clause, activation of the face grouping feature requires express consent, and the agreement states that the resulting numerical representations are not stored; however, users in Illinois, Texas, Washington, and other jurisdictions with biometric privacy laws should evaluate whether applicable statutes impose additional requirements beyond the consent described in this document.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Ancestry.