Data Report Card · 23andMe
23andMe Data Report Card
Genetic testing · DNA data
§ Enforcement action
Data
Practices
Practices
2Access2Portability1Friction1Deletion1Sells1Trains AI
=
D
§
4/12
Agent
Readiness
Readiness
2Access
2Portability
0API access
=
C
4/6
Agent Readiness is a derived signal — a synthesis of two existing cells (Access, Portability) plus one sourced factor (API access), not an independently measured grade. API access scale: Best (2) consumer-grantable API · Moderate (1) partial / encumbered · Restrictive (0) manual export only. What is Agent Readiness?
§ This grade reflects a 4-point deduction (severity 2) for a verified regulatory action: 8/12 on data practices − 4 = 4/12 → D. The enforcement record is below.
Reviewed Jun 2026 · policies are checked weekly for changes · stated — every cell is read from 23andMe's published policy; none has been tested (run by us) yet.
2Accessstated
You can download a copy of your raw genotype data self-serve from within your account (
23andMe Customer Care — Accessing Your Raw Genetic Data · accessed Jun 2026 ↗Resources → Browse Raw Genotyping Data → Download) at no charge, alongside reports and account data.2Portabilitystated
Raw data exports as a zipped plain-text (
23andMe Customer Care — Accessing Your Raw Genetic Data · accessed Jun 2026 ↗.txt) genotype file — your A/T/C/G calls keyed to rsIDs, a standard genomics format directly uploadable to third-party tools like GEDmatch or Promethease.1Frictionstated
Download is not instant — you submit a request, re-confirm your date of birth, and are emailed when the file is ready, making it an asynchronous, verification-gated flow rather than a one-click export.
23andMe Customer Care — Accessing Your Raw Genetic Data · accessed Jun 2026 ↗1Deletionstated
Account deletion is self-serve and irreversible on email confirmation, but 23andMe "and/or our contracted genotyping laboratory will retain your Genetic Information, date of birth, and sex" as required under the federal Clinical Laboratory Improvement Amendments (CLIA), and any research "already performed or published" before withdrawal cannot be reversed.
23andMe — Privacy Statement (full version, CLIA retention) · accessed Jun 2026 ↗1Sells / sharesstated
23andMe does not sell individual-level genetic data and research is opt-in, but its US privacy disclosures acknowledge that sharing identifiers with advertising partners for cross-context behavioral advertising "may constitute a 'sale' or 'sharing' of personal information" under the CCPA (opt-out via Cookie Choices / Global Privacy Control).
23andMe — How We Use Information (US Privacy) · accessed Jun 2026 ↗1Trains AIstated
The privacy statement references deriving information via algorithms or machine learning but contains no explicit statement either prohibiting model training on personal or genetic data or offering an AI-training opt-out separate from the opt-in research consent — the AI-training question is unaddressed.
23andMe — Privacy Statement (full version) · accessed Jun 2026 ↗§Enforcement action — deducts 4 points (severity 2); data practices without the penalty scored C (8/12)verified
A 2023 breach exposed data on 6.9 million users, leading to a $30 million US class-action settlement and a £2.31 million fine from the UK's ICO in June 2025 for failing to protect users' genetic data.
UK Information Commissioner's Office · 17 Jun 2025 ↗0API access — feeds Agent Readiness, not the /12stated
There is no consumer-grantable self-data API. 23andMe shut off its Personal Genome / developer API to third parties in 2018; fetching your own raw data is manual request-and-download only — no OAuth grant/revoke, refresh tokens, or scheduled pulls.
CNBC — 23andMe cuts off API access to outside developers (2018) · accessed Jun 2026 ↗All cells are "stated" (sourced to 23andMe's current privacy statement and help-center docs, last updated May 19 2026; not yet live-tested). Provenance: 23andMe's assets were acquired by TTAM Research Institute — a nonprofit founded by co-founder Anne Wojcicki — for $305M after the March 2025 Chapter 11 filing (sale closed ~July 14 2025). TTAM committed to honor the existing privacy policies, stand up a Consumer Privacy Advisory Board, and bar any future sale or transfer of genetic data to a recipient that does not adopt the same commitments.
How to request your data from 23andMe
- Go to https://you.23andme.com/user/edit/ — 23andMe's data-request entry point.
- Account Settings → 23andMe Data (download raw data; or delete account).
- Expected wait: raw-data download is asynchronous (confirm date of birth, emailed when ready); deletion is self-serve and begins immediately on email confirmation (irreversible) — 23andMe's stated turnaround (we haven't independently timed a request yet).
- No self-serve option, or want a formal request? Contact 23andMe — Privacy Team (operated by TTAM Research Institute): mailto:privacy@23andme.com.
These steps reflect 23andMe's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.