New terms of use at GEDmatch

In the wake of two class-action lawsuits alleging violations of user privacy, the DNA website GEDmatch has announced changes to its terms of use, effective today, that work to address and excuse the specific violations set out in the court cases while barring future lawsuits and class actions.

The lawsuits, filed in California and in Illinois, both allege that Verogen, the parent company to GEDmatch, violated user privacy by disclosing identities of users to the parent corporation of Facebook by way of a cookie-driven technology linking use of the GEDmatch website to specific Facebook users.¹ The California lawsuit also alleges privacy violations in the transfer of genetic data to the Dutch company Qiagen when it acquired Verogen in 2023 and in disclosures to law enforcement entities since at least 2019.²

Apparently responding to the lawsuits, Verogen notified registered users of the GEDmatch website that changes in its terms of use would take effect today, November 22, 2024, although the prior terms — dated May 2023 — remained on the publicly-facing GEDmatch website as of 10 a.m. EST today. The new terms can be accessed using direct links.³

Terms of use, remember, “are the limits somebody who owns something you want to see or copy or use puts on whether or not he’ll let you see or copy or use it. The phrase ‘terms of use’ isn’t defined in legal dictionaries…. Wikipedia says terms of use, terms of service and terms & conditions are all the same thing (they are) and defines the phrase as ‘rules which one must agree to abide by in order to use a service.’ That’s a pretty fair definition.”⁴ In other words, this is our contract with a website, setting out what we can do with the website’s content — and what it can do with the content we submit there.

So… what are the key changes in the GEDmatch terms of use?

First, from a structural perspective, the new terms split off the provisions into two separate documents: the terms of use themselves;⁵ and a separate privacy policy.⁶ That appears to be mostly because of lengthy required legal disclosures as to privacy for residents of certain U.S. states and certain areas of the world–the European Union and the United Kingdom in particular.

Second, the new terms go to great lengths to bar future lawsuits and particularly future class actions against the website and its operators. In the future, any user who doesn’t expressly opt out in writing by mail within 30 days of first accepting the terms will not be able to sue in a court of law. Dispute resolution for users who don’t opt out will be exclusively by way of arbitration and users won’t be able to join together as a group to try to level the playing field against the corporate opponent.

Any user who does want to opt out can do so “by sending written notice of your decision to opt out to the following address: 19300 Germantown Road, Germantown, Maryland 20874 postmarked within thirty (30) days of first accepting these Terms. You must include (i) your name and residence address, (ii) the email address and/or telephone number associated with your account, and (iii) a clear statement that you want to opt out of these Terms’ arbitration agreement.”⁷

Third, the new terms include an express statement that site features that allow sharing of information with others through third-party accounts–including through social networks–are authorizing the website to provide information with those third-party account providers.⁸ The terms also note that “Verogen has no control over, and assumes no responsibility for, the content, accuracy, privacy policies, or practices of or opinions expressed in any third-party websites or by any third party that you interact with through the Site.” These provisions aren’t specific to Facebook or its parent corporation Meta–but the language does appear to be directed to the claim in the two class actions now pending.⁹

Fourth, the new terms also include an express statement allowing for future mergers or acquisitions of GEDmatch with or by another entity. In such case, the website notes that it reserves the right to provide user data “including Raw Data, Genealogy Data, profile information, and other personal information” to the new entity. Users who object to this provision must agree not to upload their DNA or other data to GEDmatch in the future and to remove any data currently there.¹⁰ Again, the language isn’t specific to the current dispute over acquisition by Qiagen but does appear to be directed to that claim in the California lawsuit.

Fifth, GEDmatch has changed the title of one of its privacy options from “Research” to “Personal Research.” Under this option, a user can see information about kits that match the user’s data but owners of the matching kits will not see the user as a match. Language suggesting a limitation to artificially created research kits has been removed.¹¹

Sixth, GEDmatch now expressly bars use of the website for academic or institutional research purposes. Law enforcement use for criminal investigations remains a permitted use of the website.¹²

Finally, the new terms make it clear that Verogen and GEDmatch disclaim any and all liability to users that the law allows. To the extent that liability cannot be disclaimed, the terms limit any damages to the amount paid by the user in the 12 months preceding any dispute.¹³

Considering that GEDmatch is free for most users, and reviewing the new terms in their entirety, it’s clear that this is a case of “you pays your money, you takes your chances.”

Cite/link to this post: Judy G. Russell, “Of money and chances,” The Legal Genealogist (https://www.legalgenealogist.com/blog : posted 22 Nov 2024).

SOURCES