23andMe have laid out their rules pretty well in the agreement you sign with them. Iirc, they can do whatever they what with your data but it's "anonymous" when they sell it. They're are research companies that gather the DNA data and run it through cold cases to check for matches.

Read up on how 23andMe changed their products, fought with the FDA, and where they make their money before selling yours to them for a $100.

That's not to say they are an evil company nor the research work done with the data bad or wrongfully incriminating, just that once you let your DNA (or any other personal data) in the hands of another company, you loose the ability to argue how it's used.