[Karunamon]

Unchanged:

23andMe will never release your individual-level Genetic Information and/or Self-Reported Information to any third party without asking for and receiving your explicit consent to do so

That sounds pretty cut and dried to me.

[2skep]

I would not imagine 23andMe handing out a table with people's names in one column and their genetic info in next. And their terms and conditions clearly say that.

However, with the changes cited, they are lowering the level of protection they used to offer in order for their client companies to not be able to deconvolute data in order to build that table.

Users are informed of the changes, that is what matters.

[DigitalJack]

The part of the sentence you left out: unless required by law.

[djur]

That can be assumed to be true of any statement made in such a policy, regardless of whether it's there or not. No company can credibly claim that they will defy the law on your behalf.

[Karunamon]

Pretty sure that applies to any and all companies regardless of what they put in their ToS...

[btilly]

Almost, but not quite all!

The first exception that comes to mind is tarsnap. Who does not only offer that promise, but offers code and reasoning for why it is impossible for them to compromise your data even if law enforcement comes calling!

Lavabit also comes to mind. While they could have technically compromised their customers, when law enforcement came calling (after Snowden famously used them), the owner chose to shut down instead of complying with the requests of law enforcement.

That said, such heroes are few and far between.