27 of 142 cards in Legal Rights & Agreement Rules
Legal Rights & Agreement Rules · Context
The statement names 12 May 2026 as its effective date. This analysis covers that version only; earlier or later versions are not described here.
Effective: 12 May 2026
Legal Rights & Agreement Rules · Context
Ancestry summarizes its most recent update: it clarified permitted and prohibited uses of the Services and user rights and obligations; it updated product language, including an option to group similar faces in your photo gallery, which happens only with your express consent; and it added references to SMS messaging to support future opt-in communications. Ancestry also encourages reading the full statement together with the Terms and Conditions. The summary is a reading aid; the operative rules are in the statement itself.
This summary is intended to help you better understand recent changes to Ancestry’s Privacy Statement and how the changes may impact you.
We clarified permitted and prohibited uses of the Services, as well as user rights and obligations.
including the option to group similar faces in your photo gallery with your express consent
We included references to SMS messaging to support future opt-in communications.
In our most recent update:
Summary of Changes
Legal Rights & Agreement Rules · Context
The statement applies to Ancestry websites, services and mobile apps that link to it, including Ancestry, AncestryDNA and the listed Related Brands (Fold3, Newspapers.com, Archives, We Remember, Forces War Records and Find a Grave); the statement calls all of these "Ancestry." Other services Ancestry manages that do not link to this statement are governed by their own privacy statements, which are not covered here.
This Privacy Statement covers the Ancestry websites, services, and mobile apps that link to this Privacy Statement.
Within this Privacy Statement, we refer to all of these websites, services, and mobile apps collectively as “Ancestry.”
Other services or websites managed by us that do not link to this Privacy Statement are governed by their own separate privacy statements.
Legal Rights & Agreement Rules · Context
For U.S. customers, the statement says a U.S. Resident Additional Privacy Statement and a Consumer Health Data Privacy Policy contain additional details for residents of certain states. The U.S. supplement appears later in this same document; the Consumer Health Data Privacy Policy is a separate linked document that is not supplied, so its terms are not described here.
U.S. Customers. The U.S. Resident Additional Privacy Statement and the
contain additional details for U.S. residents in certain states, as further outlined below.
Legal Rights & Agreement Rules · Context
For customers outside the United States, Ancestry Ireland Unlimited Company is the controller of your Personal Information, meaning the entity responsible for it. The statement points to its rights section (numbered Section 8, "Your Rights and Choices Regarding Your Personal Information") for your rights.
Non-U.S. Customers. Ancestry Ireland Unlimited Company is the controller of your Personal Information, and Section 8 contains information about your rights.
Legal Rights & Agreement Rules · Context
For Personal Information Ancestry processes about people who are not Ancestry users, the statement points to a separate linked page. That page is not supplied, so how non-users' information is handled is not described by this text.
For information on Personal Information processed by Ancestry relating to non-Ancestry users please click
Legal Rights & Agreement Rules · Context
The statement says it includes Ancestry's Cookie Policy, which describes its use of browser cookies and similar tracking technologies. The Cookie Policy is a separate linked document that is not supplied, so its specific cookie practices and controls are not described in this analysis.
This Privacy Statement includes our
Legal Rights & Agreement Rules · Context
Ancestry states that it is not a covered entity under the U.S. Health Insurance Portability and Accountability Act (HIPAA) and that no data you provide is subject to or protected by HIPAA. Health-related information you share with Ancestry, including DNA and survey data, therefore does not get HIPAA's protections; other laws mentioned elsewhere in the statement may still apply.
Ancestry is not a covered entity under the Health Insurance Portability and Accountability Act (“HIPAA”), and no data provided by you is subject to or protected by HIPAA.
Legal Rights & Agreement Rules · Company commitment
Ancestry says it does not voluntarily give user data to governmental or judicial bodies or law enforcement, and requires government agencies to follow valid legal process as set out in its Guide for Law Enforcement (not supplied). It does not allow law enforcement, or anyone acting for them, to use the Services to investigate crimes or identify human remains. If compelled to disclose, Ancestry will do its best to give you advance notice unless the law prohibits it. Separately, the statement allows sharing when Ancestry believes it is reasonably necessary to comply with laws or valid legal process, enforce its terms, or protect security or safety.
Ancestry does not voluntarily provide access to user data to governmental or judicial bodies or to law enforcement agencies.
we require all government agencies seeking access to Ancestry customers’ data to follow a valid legal process as detailed in
We do not allow law enforcement or anyone working on their behalf to use the Services to investigate crimes or to identify human remains.
If we are compelled to disclose your Personal Information to law enforcement, we will do our best to provide you with advance notice, unless we are prohibited under the law from doing so.
Law Enforcement
Legal Rights & Agreement Rules · Company commitment
Ancestry publishes a Transparency Report listing the number of valid law enforcement requests for user data across all its sites. The report itself is a separate page and is not supplied. This sits alongside Ancestry's commitment to try to give advance notice of compelled disclosures where the law allows.
Ancestry produces a
where we list the number of valid law enforcement requests for user data across all our sites.
Legal Rights & Agreement Rules · User right or choice
You have the right to complain to the Irish Data Protection Commission or any other competent supervisory authority in your country of residence.
You have the right to make a complaint to the Irish Data Protection Commission (
Legal Rights & Agreement Rules · Company commitment
Ancestry and named subsidiaries (Ancestry.com Operations Inc., Ancestry.com Operations L.P., Ancestry.com DNA LLC, Ancestry International DNA LLC, FindAGrave Inc. and iArchives Inc.) say they comply with the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, and have certified adherence to the Framework Principles for personal data received from the EU, the UK (and Gibraltar) and Switzerland. If this statement conflicts with those Principles, the Principles govern. The statement names these frameworks without describing their content.
Ancestry and its subsidiaries (namely Ancestry.com Operations Inc., Ancestry.com Operations L.P., Ancestry.com DNA LLC, Ancestry International DNA LLC, FindAGrave Inc., and iArchives Inc.) comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.
If there is any conflict between the terms in this Privacy Statement and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.
Legal Rights & Agreement Rules · Procedure
Ancestry commits to resolve complaints related to the Data Privacy Framework Principles about how it collects and uses your Personal Information. Individuals in the EU, UK and Switzerland with inquiries or complaints about data received under those frameworks should first contact Ancestry by email. Unresolved complaints can then go to the EU, UK, Gibraltar and Swiss data protection authorities and, in some cases, binding arbitration.
Ancestry commits to resolve DPF Principles-related complaints about our collection and use of your Personal Information.
EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of Personal Information received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Ancestry at:
Legal Rights & Agreement Rules · Procedure
For unresolved complaints about data received under the Data Privacy Frameworks, Ancestry commits to cooperate with and follow the advice of the EU data protection authorities' panel, the UK Information Commissioner's Office, the Gibraltar Regulatory Authority and the Swiss Federal Data Protection and Information Commissioner. In certain circumstances described in Annex I of the Framework Principles, you may invoke binding arbitration for complaints not resolved by other means. The U.S. Federal Trade Commission has jurisdiction over Ancestry's compliance with the frameworks.
Ancestry commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner’s Office (ICO), the Gibraltar Regulatory Authority (GRA), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints
As set forth in Annex I of the DPF Principles, in certain circumstances, an individual has the right to invoke binding arbitration to resolve complaints not resolved by other means.
The Federal Trade Commission has jurisdiction over Ancestry’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Legal Rights & Agreement Rules · Company commitment
Ancestry may modify the Privacy Statement at any time. For material changes, it will give prominent advance notice, such as a notice in the Services, on its websites or by email, so you can review them and decide whether to keep using the Services. For non-material changes, it will notify you as of their effective date in the same ways.
We may modify this Privacy Statement at any time, but we will provide prominent advance notice of any material changes to this Privacy Statement, such as by posting a notice through the Services, on our websites, or sending you an email, to provide you the opportunity to review the changes and choose whether to continue using the Services.
We will also notify you of non-material changes to this Privacy Statement as of their effective date by posting a notice through the Services, on our websites, or sending you an email.
Legal Rights & Agreement Rules · Context
Under EU/EEA and UK law Ancestry must state the purposes and legal bases for processing your Personal Information. It says it relies on several legal bases for Personal and Genetic Information and lists them on a separate linked page, which is not supplied; the specific basis for each use is therefore not described here.
Under EU/EEA and UK law, we are required to specify the purposes for which we process your Personal Information and the legal bases which we rely on to do this.
Ancestry relies on a number of legal bases to collect and process your Personal Information and Genetic Information. You can view the details of our legal bases
Legal Rights & Agreement Rules · Context
If you live in the United States, Ancestry.com Operations, L.P., Ancestry.com Operations Inc. and Ancestry.com DNA, LLC are responsible for the use of your data and for responding to requests about your Personal Information.
If you reside in the United States, Ancestry.com Operations, L.P., Ancestry.com Operations Inc., and Ancestry.com DNA, LLC, are responsible for the use of your data and for responding to any requests related to your Personal Information.
Customers in the United States
Legal Rights & Agreement Rules · Procedure
U.S. users can write to Ancestry.com Operations, L.P., Attn: Privacy Office, in Draper, Utah, or email. Separate email routes exist for U.S. state privacy requests and for authorized agents, with no postal address for those. The email addresses themselves are obscured in the saved copy of the page.
Ancestry.com Operations, L.P. Attn: Privacy Office 42 Future Way, Suite 400 Draper, UT 84020
U.S. State Privacy Requests
Authorized Agent Support
For Users Located in the United States
Legal Rights & Agreement Rules · Procedure
Users outside the United States may contact the Irish Data Protection Commission or their local supervisory authority (EU/EEA residents), the UK Information Commissioner's Office (UK residents), or their local data protection authority (others). Ancestry's own contact is Ancestry Ireland Unlimited Company, Attn: Privacy Office, in Dublin, Ireland, or by email.
Users outside the United States may contact the Irish Data Protection Commission or your local data protection supervisory authority (EU/EEA residents), the Information Commissioner’s Office (UK residents) or your local Data Protection Authority (Others).
Ancestry Ireland Unlimited Company Attn: Privacy Office 10th floor, EXO Building Point Square Plaza East Wall Road Dublin 1 Ireland
Customers Outside the United States
For Users Located Outside of the United States
Legal Rights & Agreement Rules · Procedure
Ancestry customers can find contact details through a link or ask questions by chat. Law enforcement requests for information should follow Ancestry's Guide for Law Enforcement, which is not supplied.
For Ancestry Customers. For details on how to contact us, you can click here, or you can submit questions via chat.
Law Enforcement Requests. Requests for information from law enforcement should follow
Legal Rights & Agreement Rules · Context
The U.S. Statement supplements the Privacy Statement with more detail on the Personal Information Ancestry collects, processes and shares, and explains how residents of U.S. states that provide the listed rights can exercise them. It covers Ancestry websites, services and apps that link to it, including Ancestry, AncestryDNA, Fold3, Forces War Records, Newspapers.com, Archives, We Remember and Find a Grave, and applies to Personal Information collected through the Services and any other way you engage with Ancestry. Consumer health data under certain state laws is covered by a separate Consumer Health Data Privacy Policy, which is not supplied.
This U.S. Resident Additional Privacy Statement (“U.S. Statement”), supplements our Privacy Statement and provides additional information about the Personal Information we collect, process, and share.
It also provides information on how residents of U.S. states that provide for the privacy rights outlined below may exercise those rights.
It applies to the Personal Information we collect from your use of our Services and through any other means by which you engage with us.
for additional information about “Consumer Health Data” as defined under certain state consumer health privacy laws.
Legal Rights & Agreement Rules · Company commitment
The U.S. Statement repeats that Ancestry does not voluntarily disclose your Personal Information to law enforcement or regulatory bodies and requires valid legal process, as described in the sharing section (numbered Section 7), before giving data to law enforcement. Its Transparency Report shows what has been disclosed.
We do not voluntarily disclose your Personal Information to law enforcement or regulatory bodies. We require a valid legal process as described in Section 7 before we would provide any data to law enforcement.
Legal Rights & Agreement Rules · Context
Ancestry links to annual, global metrics on requests received from users (not supplied). Questions about U.S. privacy policies or practices can go to usprivacyrequests@ancestry.com.
to see our annual, global requests received from users.
16.10 Contact Us. If you have questions about our U.S.-related privacy policies or practices, please contact us at usprivacyrequests@ancestry.com.
Legal Rights & Agreement Rules · Procedure
Alabama residents alleging a violation of the Alabama Genetic Data Privacy Act of 2024 may complain to the Alabama Attorney General. California residents alleging a violation of the California Genetic Information Privacy Act may complain to the California Attorney General or their district attorney; residents of cities over 750,000 people may go to their city attorney, and residents of cities with full-time city prosecutors to their city prosecutor. California residents who believe their Personal Information was used improperly may complain to the California Attorney General or the California Privacy Protection Agency. The statement names these laws without describing them; this analysis does not interpret them.
Alabama residents who wish to allege a violation of the Alabama Genetic Data Privacy Act of 2024 may file a complaint with the
California residents who wish to allege a violation of the California Genetic Information Privacy Act (GIPA)
Residents of cities with more than 750,000 residents may file a complaint with their city attorney, and residents of cities with full-time city prosecutors may file a complaint with their city prosecutor.
California residents who believe that their Personal Information was used improperly
16.11 Actions for Relief.
Legal Rights & Agreement Rules · Procedure
Minnesota residents alleging a violation of the Minnesota Genetic Information Privacy Act may complain to the Minnesota Department of Commerce, under a cited Minnesota statute. Virginia residents alleging a violation of Virginia's 2023 genetic data privacy provisions (Va. Code Ann. sections 59.1-593 through 59.1-602) may complain to the Virginia Attorney General. The statement names these laws without describing them; this analysis does not interpret them.
Minnesota residents who wish to allege a violation of the Minnesota Genetic Information Privacy Act (GIPA)
Virginia residents who wish to allege a violation of Va. Code Ann. §59.1-593 through §59.1-602 of 2023 (relative to genetic data privacy) may file a complaint with the
Legal Rights & Agreement Rules · Company commitment
If the Australian Privacy Act 1988 applies to how your Personal Information is handled, additional clauses apply. Genetic Information is treated as "Sensitive Information" under that Act, and Ancestry says it will collect, use or disclose sensitive information about you only as the law permits, for example with your consent or where collection is required or authorized by law. The statement names the Act without describing it; this analysis does not interpret it.
If the Australian Privacy Act 1988 (Cth) (Privacy Act) applies to the handling of your Personal Information, the following clauses will also apply.
Genetic Information is considered “Sensitive Information” as set out under the Privacy Act. We will collect, use or disclose sensitive information about you only as permitted by law, for example where we have received your consent to do so or the collection is required or authorized by law.
Legal Rights & Agreement Rules · Procedure
In connection with your rights, you may have the right to complain to the privacy or data protection regulator in your jurisdiction. If you have questions or concerns, or believe Ancestry has not complied with this statement or the relevant privacy law, Ancestry asks that you first contact it using the controller contact details (numbered Section 15); it will investigate and decide what action, if any, to take. Contacting Ancestry first is a request, not a precondition to complaining to a regulator.
In relation to Section 8 (Your Rights and Choices Regarding Your Personal Information), you may have the right to make a complaint to the relevant privacy or data protection regulator in your jurisdiction.
we would appreciate it if you contact us in the first instance using the details in Section 15. We will investigate the complaint and determine what action, if any, to take.