Guide for Law Enforcement - 23andMe Canada

Services Provided By 23andMe

The 23andMe Personal Genetic Service is a direct-to-consumer genetic testing service that provides information and tools for individuals interested in learning about and exploring their DNA. Depending on where they live, customers who submit saliva samples using the 23andMe Personal Genetic Service saliva collection kit can access their Genetic Information through two different services:

23andMe Ancestry Service: customers have access to genealogical DNA test results and can opt-in to our DNA Relatives database.
23andMe Health + Ancestry Service: in addition to the Ancestry Service information, Health + Ancestry customers will also have access to Genetic Health Risks, Carrier Status, Wellness, and Trait reports.

Customers may purchase either the Ancestry Service or the Health + Ancestry Service.

Information 23andMe Collects

We collect user information in accordance with the applicable Terms of Service (TOS) and Privacy Statement.

We work with third-party companies to provide users with services on behalf of 23andMe, and in some cases these companies may have access to a limited amount of non-genetic user information. Specifically, our contracted lab has access to users’ DNA samples and limited user information for processing purposes.

Under the federal Clinical Laboratory Improvement Amendments (CLIA) of 1988, 23andMe is required to provide the laboratory with the customer’s sex and date of birth. No other Registration Information (such as name, address, email, phone number or other contact information) is provided to the laboratory. Samples and data are otherwise identifiable only by the unique barcode that is used to register a saliva collection kit tube.

Requests for 23andMe User Information

23andMe chooses to use all practical legal and administrative resources to resist requests from law enforcement, and we do not share customer data with any public databases, or with entities that may increase the risk of law enforcement access. In certain circumstances, however, 23andMe may be required by law to comply with a valid court order, subpoena, or search warrant for genetic or personal information.

23andMe requires valid legal process in order to consider producing information about our users. 23andMe will only review inquiries as defined in 18 USC § 2703(c)(1) related to a valid trial, grand jury or administrative subpoena, warrant, or order. Administrative subpoenas must be served on 23andMe by personal service just like subpoenas in a court setting. 23andMe will consider releasing additional account information or transactional information pertaining to an account only in response to a court order issued pursuant to 18 USC § 2703(d). In addition, 23andMe will only consider inquiries from a government agency with proper jurisdiction.

To date, 23andMe has never received a request to preserve information potentially relevant to legal proceedings pursuant to 18 USC § 2703(f). If we do receive a valid preservation request, we will preserve a temporary snapshot of the relevant records for 90 days, after which we will automatically remove the information from our servers unless we receive a renewed valid preservation request for an additional 90-day period.

If a 23andMe user completes a valid authorization to disclose their Genetic Information to law enforcement, then 23andMe will disclose the information identified in the authorization. 23andMe will not disclose any identifying information about the authorizing user’s genetic relatives or connections that 23andMe holds unless those users also provide express, written consent.

23and Me publishes a Transparency Report which contains details on all law enforcement requests for user information that we receive.

How to Request 23andMe User Information

23andMe responds to valid legal process issued in compliance with applicable law. When requesting user account information, please include:

If available/known, the full name of the subject 23andMe account holder, and the email and/or mailing address associated with the account(s).
Details about what specific information is requested (e.g., basic user information) and its relationship to the investigation. We are unable to process overly broad or vague requests.
A valid official email address (e.g., name@agency.gov) so we may get back in touch with you upon receipt of your legal process.

Requests should be made in writing and should be submitted by certified mail, express courier, or in person at the addresses listed below; and an additional copy may be sent by email. We do not accept legal process by email or fax unless the request is an emergency request. Our contact information is available at the bottom of both this Guide and our Terms of Service (TOS). Written requests must be made on law enforcement letterhead and be signed by the responsible law enforcement officer.

Even if a law enforcement request for information meets the minimum requirements listed above, 23andMe will assess whether or not it is required by law to comply with the request, based on whether 23andMe is subject to personal jurisdiction in the requesting entity, the validity of the method of service, the relevance of the requested data, the specificity of the request, and other factors.

User Notification About Law Enforcement Requests

If 23andMe is required by law to comply with a valid court order, subpoena, or search warrant for genetic or personal information, we will notify the affected individual(s) through the contact information they have provided to us before we disclose this information to law enforcement, unless doing so would violate the law or a court order. We will give them a reasonable period of time to move to quash the subpoena before we answer it.

If law enforcement officials prevent this disclosure by submitting a Delayed Notice Order (DNO) pursuant to 18 U.S.C. § 2705(b) or equivalent state statute that is signed by a judge, we will delay notifying the user until the order expires. 23andMe retains sole discretion to not notify the user if doing so would create a risk of death or serious physical injury to an identifiable individual or group of individuals, and if we are legally permitted to do so. Under these circumstances, we will notify users of the law enforcement request once the emergency situation expires.

To date, 23andMe has not received a law enforcement request for information in the form of a National Security Letter (NSL) containing an indefinite non-disclosure provision. If 23andMe receives such a request in the future, 23andMe is committed to requesting judicial review of the order pursuant to the USA Freedom Act. Once the non-disclosure provision no longer applies, 23andMe will notify affected users about the order.

Use of 23andMe Personal Genetic Service for Law Enforcement Casework and Forensics

Use of the 23andMe Personal Genetic Service for casework and other criminal investigations falls outside the scope of our services intended use.

With respect to user information, while our Terms of Service (TOS) requires that participants provide 23andMe with true and accurate Registration Information, 23andMe cannot precisely authenticate or verify an individual’s identity when they use or sign up for our service, and thus does not have the means to reliably connect any particular DNA sample or account to an individual. This means that 23andMe Personal Genetic Service has no chain of custody and is not considered a confirmatory test or proof in a legal context.

Submitting a saliva sample to 23andMe for processing requires that the person providing the sample, or their legal representative, has read and agreed to our TOS and our Privacy Statement. Those who wish to participate in the 23andMe service must guarantee that any sample they provide is either their own saliva or that of an individual for whom they have legal authorization to agree to the TOS on their behalf. Under our TOS, those who participate in 23andMe’s services by submitting a saliva sample agree not to “use any information received through the Services to attempt to identify other customers, to contact other customers (other than through features for contacting other users such as DNA Relatives offered pursuant to the Services), or for any forensic use.”

Therefore, it is a violation of our TOS for law enforcement officials to submit samples on behalf of a prisoner or someone in state custody who has been charged with a crime.

Additionally, the analysis that we provide can only be performed using a ~2ml saliva sample collected using our saliva kit. We cannot process samples or biospecimens collected in any other format.