23andMe provides direct-to-consumer genetic testing, and its privacy policy explains how the company collects, uses, and shares your DNA and related data. Understanding the details helps you make informed decisions about your genetic information.
The following overview highlights key aspects of the 23andMe privacy policy using a concise comparison format that focuses on practical implications for users.
| Data Type | Primary Uses | Sharing With | User Controls |
|---|---|---|---|
| Raw DNA Data | Health predispositions, carrier status, traits | Research partners, law enforcement | Opt-in research, downloadable data |
| Health Reports | Personalized health insights, wellness guidance | Healthcare providers, third-party apps | Share controls, download options |
| Self-Reported Information | Enhanced analysis, matching features | Research, service improvement | Edit profile, deletion requests |
| Location Data | Service personalization, regional content | Service providers, analytics | Account settings, limit tracking |
How 23andMe Collects and Processes Your Genetic Data
23andMe collects DNA through saliva kits and combines it with survey responses to generate reports. The privacy policy details how this information is processed for product features and analytics.
Processing includes automated analysis to generate health predispositions and ancestry composition. These operations are designed to balance scientific rigor with transparency about what users can expect from their results.
Key Definitions and Terminology in the Policy
The policy uses specific terms to clarify roles such as data controller and processor. Understanding these definitions helps you interpret how responsibility for your data is assigned.
Clear language around genetic data, de-identification, and research participation ensures that you can navigate the terms without needing a legal background. Each section is structured to emphasize practical outcomes rather than abstract legalese.
Your Rights and Choices Over Your Data
Access and Portability
You can request access to your data and download your raw DNA file, enabling you to move your information to other services if you choose.
Opt-Out and Deletion
Options exist to opt out of data sharing for research and marketing, as well as to request deletion of your account and associated data under applicable laws.
Data Security and Retention Practices
23andMe implements technical and organizational measures to protect your genetic information from unauthorized access. Encryption and access controls are described in detail within the security section of the policy.
Data retention periods vary based on service type and legal requirements. The policy explains how long different categories of information are kept and the criteria used to determine those timeframes.
Final Privacy Considerations for Users
- Review research and marketing consent settings regularly to match your current preferences.
- Download your raw data periodically to maintain a personal copy.
- Check regional legal protections, as privacy rights vary by jurisdiction.
- Use strong account credentials and enable any available security features.
FAQ
Reader questions
Can law enforcement access my DNA data from 23andMe?
Yes, 23andMe may comply with valid legal requests, such as court orders, and has a dedicated process for responding to requests from law enforcement.
Does 23andMe share my health information with employers?
No, the policy states that health data is not shared with employers, and robust safeguards are in place to prevent this type of disclosure.
Can I delete only certain parts of my data while keeping the account?
Some data can be deleted or requested for removal depending on the type and legal obligations, though certain core data may need to remain to maintain your account. Location data is used mainly for service personalization and is generally kept separate from your genetic results, with its own settings and sharing options.