At the risk of sounding overly cynical I'm going to sound overly cynical - I don't think that statement is worth the pixels it's activating. They are going to say whatever they need to say to keep the money rolling in. It could be a lie, it could be something that changes tomorrow without notification. They don't care because why should they?

Why would they care about saying it and not care about doing it? Obviously they've identified that their customers value those protections, so if they were demonstrated to be lying about it or changed their policy in the future don't you expect that they'd risk losing the customers who made the choice to use 23andme based on their progressive law enforcement policy?

That's the market-based ethics enforcement. Usually this cause and effect link is too weak to be practical. Business incentives are short-term, leadership changes, companies get bought, business models change, and market transparency is low.

True, prioritizing short-term gains creates incentives to lie. But they've stood by this progressive policy for quite some time now even though scrutiny of law enforcement access to DNA databases is higher than ever. So I'm not convinced they're lying. Believe me, if there is any sign that that's the case then I will be deleting my account as soon as possible.

> GSK actually used GEDmatch

GSK did not actually use GEDmatch, but his 4th cousins did.

The website identified 10 to 20 distant relatives of the Golden State Killer's (sharing the same great-great-great grandparents)

https://en.wikipedia.org/wiki/Golden_State_Killer

If you read that, and think this means they don't cooperate with legal requests, then you've really made a huge mistake.

They "resist". All that means is they ask for a proper legal document, such as a warrant.

Warrants are easy to obtain. Judges give them out like candy, and I'd be incredibly surprised if after the success of the Golden State Killer case, that 23&me doesn't get 100's or 1000's of search requests per month.

Sure, they are probably not ever getting the full dataset, but you don't really think they are actually contesting the legal authority of the government to do this right? 23&me is not your doctor. You have no HIPAA protections.

They also publish transparency reports and have a policy of notifying users whose data was subject to subpoenas. See the full text of the linked page for more details.