Buried in the Boilerplate: Contract Provisions in American DNA Testing Kits That Deserve a Second Reading
Photo: USSR Post, Public domain, via Wikimedia Commons
Most Americans who mail a saliva sample to a consumer genomics company read the terms of service the same way they read any other click-through agreement: not at all. But genomic data is not an online shopping history. It is permanent, inherently identifying, and shared — involuntarily — with biological relatives. The contract language governing it deserves closer reading than most contracts get.
This explainer examines five recurring provisions in the terms of service of major US testing services. We describe what the clauses generally say, why they would give a constitutional or privacy scholar pause, and what a consumer might reasonably demand in their place.
1. The Unilateral Amendment Clause
Nearly every consumer genomics company reserves the right to modify its privacy policy and terms at any time, with changes taking effect upon posting. Some commit to notifying users; some do not even do that.
A constitutional lawyer would notice the resemblance to a due process problem: the government generally cannot change the terms of a binding obligation retroactively and without notice, yet private parties routinely reserve this power. Privacy scholars call this the "unilateral drift" problem — a promise made at purchase can be quietly repudiated years later, after the data has already been collected.
What consumers should demand: a commitment that material changes to data handling apply only prospectively and require affirmative opt-in consent, not mere continued use of the service.
2. The Broad Research License
Many agreements grant the company a sweeping, perpetual, royalty-free license to use de-identified genetic and self-reported data for research, including research conducted with third-party partners and, in some cases, commercialization of resulting discoveries.
The notable feature here is scope. Traditional research consent under the Common Rule is study-specific and revocable; a blanket license in a consumer contract is neither. Bioethicist Barbara Evans and others have argued that such licenses stretch the concept of consent beyond recognition — the participant agrees to everything and nothing at once.
What consumers should demand: study-level consent dashboards, plain-language descriptions of research categories, and a genuine right to withdraw data from future studies, including reasonable efforts to remove data from downstream repositories.
3. Law Enforcement Provisions — and Their Limits
Following the 2018 Golden State Killer case, most major services published transparency reports and added language governing law enforcement requests. Some require a valid legal process; a few historically permitted broader matching at company discretion.
What surprises many observers is how much of this area operates outside contract law entirely. A company can promise today that it will not voluntarily share your data with police; a subpoena, a warrant, or a future policy change can alter that promise. And because genetic information is familial, a distant cousin's kit can expose you regardless of your own choices.
What consumers should demand: clear, published policies on legal process, user notification where legally permitted, and — at minimum — conspicuous disclosure of familial matching exposure at the point of purchase.
4. Data Sale and Corporate Transaction Clauses
Several agreements contemplate the transfer of user data in the event of a merger, acquisition, or bankruptcy, treating genetic profiles as an asset that passes to the acquirer along with servers and office furniture. Some services have also monetized data through partnerships with pharmaceutical companies — arrangements that are disclosed, but often in language that distinguishes "selling" from "licensing" in ways a contract attorney would find instructive.
A privacy expert would note that neither GINA nor HIPAA restricts the sale of de-identified genetic data by consumer firms. The market can, in principle, trade your genome like any other commodity.
What consumers should demand: explicit severability of data from corporate transactions — an opt-out of transfer, or at minimum, binding successor-liability language requiring the acquirer to honor the original privacy terms.
5. The Reconsent Substitution Clause
A subtle provision in some agreements states that continued use of the service, or failure to opt out within a window, constitutes consent to new research uses or updated policies. In effect, silence is converted into agreement — the mirror image of how consent is understood in research ethics, where it must be informed, voluntary, and active.
Scholars of the First Amendment's association and speech principles have occasionally noted, half-seriously, that compelled silence-as-speech sits uneasily with American constitutional tradition. In the research context, the concern is simpler: implied consent is not consent at all.
What consumers should demand: active, affirmative reconsent for each new category of research use, with reminders delivered through channels the user actually monitors.
The Broader Point
None of these clauses is illegal. That is precisely the finding. American consumer genomics operates in a regulatory space where contract law, not data protection law, does most of the governing — and contract law presumes a sophistication and bargaining power that individual consumers simply do not have against a national testing company. Until a comprehensive federal privacy framework addresses genetic data specifically, the burden of vigilance falls on the least equipped party. Policy responses at the state level, such as the genetic privacy statutes enacted in several states since 2019, suggest that lawmakers are beginning to notice. The clauses will keep evolving; the underlying imbalance will not, unless governance catches up.
