Following a hack that potentially ensnared 6.9 million of its users, 23andMe has updated its terms of service to make it more difficult for you to take the DNA testing kit company to court, and you only have 30 days to opt out.
In a filing with the US Securities and Exchange Commission last week, 23andMe said hackers accessed around 14,000 customer accounts earlier this year by trying login-password combinations exposed in unrelated breaches. It later said hackers had access to 6.9 million accounts due to the interconnected nature of its DNA Relatives feature.
23andMe has since updated its terms of service in a way that changes how the company resolves disputes with users. As Ars Technica reports, citing a post on Hacker News, customers were informed via email that "important updates were made to the Dispute Resolution and Arbitration section" on Nov. 30 "to include procedures that will encourage a prompt resolution of any disputes and to streamline arbitration proceedings where multiple similar claims are filed."
Customers have 30 days to let the site know if they disagree with the terms. If they don’t reach out via email to opt out, the company will consider their silence an agreement to the new terms.
Previously, 23andMe's terms of service had users agree to a neutral arbitrator during disputes rather than the courts; however, they "would have the right to sue in court and have a jury trial," Ars says. The former version of the TOS also suggested that any arbitration would be handled on an individual basis rather than through a class-action lawsuit.
The new TOS specifically calls out class-action lawsuits as prohibited. “To the fullest extent allowed by applicable law, you and we agree that each party may bring disputes against the only party only in an individual capacity, and not as a class action or collective action or class arbitration," it says.
Instead, "if 25 or more demands for arbitration are filed relating to the same or similar subject matter and sharing common issues of law or fact, and counsel for the parties submitting the demands are the same or coordinated," this "will constitute a 'Mass Arbitration.'"
It's a lot of legalese, but a private arbitration is likely more appealing to a company (and its legal team) than a public class-action battle. Whether these changes and that 30-day turnaround would hold up in court if someone tries to challenge them remains to be seen.