Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement states that Ancestry transfers Personal Information and Genetic Information from the EU, UK, and Switzerland to U.S.-based entities using Standard Contractual Clauses or the Data Privacy Framework, and that named Ancestry subsidiaries are certified under the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF.
This analysis describes what Ancestry's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal mechanisms for cross-border transfer of sensitive genetic data from the EU, UK, and Switzerland to the United States, and the DPF certification scope determines which entities and data categories are covered by the framework's accountability and redress mechanisms.
The updated Privacy Statement no longer displays a dedicated 'Do Not Sell or Share My Personal Information' link in the footer, which was previously accessible to California residents under CCPA requirements. This link allowed users to exercise data-sharing opt-out rights. The footer now lists 'Consumer Health Privacy' as a separate item but does not explicitly direct users to their CCPA controls. California residents may need to locate their opt-out rights through alternative navigation paths on the Ancestry site.
View change record →The updated privacy policy removes the 'Do Not Sell or Share My Personal Information' link from the footer navigation. This link previously provided direct access to Ancestry's data-sharing opt-out mechanism, which is a required disclosure under California's CCPA. While the removal does not eliminate the opt-out right itself, it may make the opt-out control less easily discoverable from the privacy policy page. Affected users may need to locate the opt-out mechanism through alternate navigation or search methods.
View change record →The updated Privacy Statement clarifies what uses of Ancestry services are permitted and prohibited, establishes that photo face-grouping in your gallery requires your express consent, and introduces SMS messaging as a communication channel for future opt-in communications. The statement now covers Ancestry, AncestryDNA, and Related Brands under a unified framework while noting that other services operated by the company use separate privacy statements. The removal of 'uploaded DNA data' from the account creation section reflects a narrowing of that specific provision's scope, though genetic information processing remains described elsewhere in the policy. You can review the full updated statement to understand how your personal information will be processed and manage your communication preferences when SMS opt-ins become available.
View change record →Under this clause, EU, UK, and Swiss users' Personal Information including Genetic Information is transferred to U.S.-based Ancestry entities under the Data Privacy Framework or Standard Contractual Clauses, with Ancestry remaining responsible for onward transfers to third-party processors under the DPF Accountability for Onward Transfer Principle.
Cross-platform context
See how other platforms handle International Data Transfers and Data Privacy Framework Certification and similar clauses.
Compare across platforms →Monitoring
Ancestry has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"When we transfer your Personal Information (including your Genetic Information) between Ancestry's Ireland-based company and Ancestry's U.S.-based companies for processing in the United States, we rely on established transfer mechanisms such as Standard Contractual Clauses or the Data Privacy Framework. Ancestry and its subsidiaries (namely Ancestry.com Operations Inc., Ancestry.com Operations L.P., Ancestry.com DNA LLC, Ancestry International DNA LLC, FindAGrave Inc., and iArchives Inc.) comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.Excerpt from Ancestry's Privacy Statement
REGULATORY LANDSCAPE: This provision directly engages GDPR Chapter V (international data transfers), the EU-U.S. Data Privacy Framework as administered by the U.S. Department of Commerce and enforced by the FTC, and Standard Contractual Clauses as approved by the European Commission. The Irish Data Protection Commission is the lead supervisory authority. UK GDPR and the UK-U.S. data bridge framework apply to UK transfers. The Swiss Federal Data Protection Act (nFADP) applies to Swiss transfers. GOVERNANCE EXPOSURE: Medium. The DPF certification covers named subsidiaries and establishes FTC enforcement of DPF principles. Any future legal challenge to the DPF (as occurred with Privacy Shield in Schrems II) could require Ancestry to revert to SCCs as the primary transfer mechanism. The document states SCCs are also relied upon, suggesting dual mechanisms are in place. JURISDICTION FLAGS: EU and UK users have the highest exposure given GDPR Chapter V requirements. Swiss users are covered by the Swiss-U.S. DPF but should note that nFADP provisions may impose additional requirements. The transfer of Genetic Information specifically as a special category of data under GDPR Article 9 requires heightened transfer mechanism scrutiny. CONTRACT AND VENDOR IMPLICATIONS: B2B customers or partners processing data through Ancestry's infrastructure should assess whether their own data transfer obligations are satisfied by Ancestry's DPF certification or whether additional SCCs or transfer impact assessments are required. The Accountability for Onward Transfer Principle creates Ancestry's responsibility for subprocessor compliance. COMPLIANCE CONSIDERATIONS: Legal teams should confirm that the DPF certification scope covers all data types and processing activities described in this Privacy Statement, including Genetic Information. Transfer impact assessments may be required for SCCs involving genetic data. Annual DPF recertification status should be monitored.
This provision establishes the legal mechanisms for cross-border transfer of sensitive genetic data from the EU, UK, and Switzerland to the United States, and the DPF certification scope determines which entities and data categories are covered by the framework's accountability and redress mechanisms.
Under this clause, EU, UK, and Swiss users' Personal Information including Genetic Information is transferred to U.S.-based Ancestry entities under the Data Privacy Framework or Standard Contractual Clauses, with Ancestry remaining responsible for onward transfers to third-party processors under the DPF Accountability for Onward Transfer Principle.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Ancestry.